7059c2ba4e84d7e78eca45caff708147143a2ccd745c22ecbcfca617356f4760

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260822-nthyestemf
SHA256 7059c2ba4e84d7e78eca45caff708147143a2ccd745c22ecbcfca617356f4760
MD5 8194d2798920c566b7e5ef0514c21883
SHA1 93da90e8ac869c501b8c3a1c4f46ee9ab1cf2d6c
SHA512 356eb7c619bc48d62a665ad9a31c92fabbf43c2d1050dc408797a1bab0e8086770aa686f443e196a7a900d1ae452fb908cb63d309d9e9776aff0e43591e3ddfd
SSDEEP 24576:C3qgcetbQz43+wXatr0zAiX90z/F0jsFB3SQke:0bNUBeaB0zj0yjoB2
TLSH
T1FA75BE0137E89131F1F73A7679B692654E3A7C61AE31D68FA240AD1D2E326C1C934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3620	elevation_service.exe
6688	elevation_service.exe
4908	maintenanceservice.exe
1204	OSE.EXE
4268	PerceptionSimulationService.exe
3020	perfhost.exe
2580	ReFsDedupSvc.exe
4992	SensorDataService.exe
3696	ssh-agent.exe
1580	AgentService.exe
3828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5434852f957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0d032312b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d564cd302b32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000672a66702b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f0899312b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ba543702b32dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
6688	elevation_service.exe
6688	elevation_service.exe
6688	elevation_service.exe
6688	elevation_service.exe
6688	elevation_service.exe
6688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1128	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	3620	elevation_service.exe
Token: SeBackupPrivilege	2580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2580	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1580	AgentService.exe
Token: SeBackupPrivilege	2580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2580	ReFsDedupSvc.exe
Token: 33	3828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3828	SearchIndexer.exe
Token: SeDebugPrivilege	3620	elevation_service.exe
Token: SeDebugPrivilege	6688	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2512	3828	SearchIndexer.exe	103
PID 3828 wrote to memory of 3908	3828	SearchIndexer.exe	104
PID 3828 wrote to memory of 3788	3828	SearchIndexer.exe	105
PID 3828 wrote to memory of 1684	3828	SearchIndexer.exe	106
PID 3828 wrote to memory of 1208	3828	SearchIndexer.exe	110
PID 3828 wrote to memory of 3352	3828	SearchIndexer.exe	111
PID 3828 wrote to memory of 236	3828	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2aa537761a643a2a7138d2f8ec4ba8d63dea14d4c80d4d283a620a623da966f8
MD5 47f9ab43bc3c40ee6217906b1c059a5f
SHA1 3cfb9688f5dda4345036ceb73d9c6d9eeb19a99d
SHA512 532a83192bad057d1f5e108380f0d8c1c7363e7b353a3229e0ab6ab3568733a7b9babcbb7ddb094943a0edb5a801c9f8d916cb9635dfa4eb46b1e17ae71b78a0
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1aB0zj0yjoB2:g3q6HjBTB2Yyjl
TLSH
T115D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bd0c65c4c974f48875adf95e4e5e2da2543f60a1535021d001af7f84727186c9
MD5 72280d13923c89f88fe35b1550cda499
SHA1 2f8faf8de6bf6e6cb7a6eefb4b7f62e2140a7107
SHA512 33c8b842697b1cdc2c19818651c61445b4ab1d94aab62dcf36641e5a20971b8ffaaaf005c2bfb0285aac3c44cc8ce621b56c3780c91e2be176dfa90ec074a125
SSDEEP 24576:aXYfDtczAZatr0zAiX90z/F0jsFB3SQkp:BtcOaB0zj0yjoB2
TLSH
T132650229779504F9DC67823DC9A18506EB73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a3ef99272a8e04df868852a66f86e3b0399a0b9460db6db1f9e25b4532d9e41d
MD5 70b45affb9b3dd77ac908f0c56f61c7f
SHA1 ad88ca83909223df5b23e0bdc0067379b5028150
SHA512 a61aff659aac8015e1794b04237ea9e45b2954745bdd3bf37f9e862ec63e9f3f8263b26ffcddcede8742547efff408ff7d7ca5192c5cd8331b5d790dcd83344b
SSDEEP 24576:N0Le5ji0hmxirMkatr0zAiX90z/F0jsFB3SQk4:NPji0Ac3aB0zj0yjoB2
TLSH
T177859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 21899f4db3bd9adb721bb79e7f1fcc7fc5b2d69f3b01731c6a5621c616795a70
MD5 786a123e27b309da772b3482f1a679a4
SHA1 3d21f5ad20ba33eeeace0fb8ab0aa7de21f5e1b2
SHA512 5efe0c0a1192fa9b952c9907b5f4a937849b4fd0fc8278eae6f448c549758e947d6140fb5edd238f66a86feb5630699e04752094eb6261b74c7ffc771fa3ace2
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyueatr0zAiX90z/F0jsFB3SQkl:C/ezSC6vUzPvxHjybaB0zj0yjoB2
TLSH
T10E755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 60a49f742b9ee9b7b131acf94caf36f80a1089872e52882cd9e581a265f43ecf
MD5 97d402d90dc1d3b657a77b01df92338f
SHA1 8b83998e17561b0e0bc8ac6cecd6846f70f53752
SHA512 9e038584da763dca9e0832ac7b65f3628fc12fcea67e4d520a0f7dddb02e25e315d295c5f2790d41c80bac80bef1de020986da50f516b98c68b81cf443462bba
SSDEEP 24576:fVbqPb88hv/l+6Fatr0zAiX90z/F0jsFB3SQkp:fVO88hXl+oaB0zj0yjoB2
TLSH
T16B55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4320cae4a9d43c9ca005258cc278d9e552f6d6277e0af16d20d14113c5fadb58
MD5 a94e5ae5847c6cc69a025a2b3ff6d404
SHA1 95cf679c3bfdd1ed046693d68b2a318264482c29
SHA512 c08023f33b9a3cef7e9cba1c0863160625adfc2ea872ddc79d3890c45fb3745b00f9f51b0a3c447d8e23eb0e98b10a7c3abce10faf9a14a2a92d9ff24a7607f3
SSDEEP 12288:vRgUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:vRgatr0zAiX90z/F0jsFB3SQk3
TLSH
T1EC45230B340E80F2CDC32B3566989C4B1AB99EB065E2AF45A2913F4F9D3C1C6D6656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 adb96f9d96f4567bb6a220b09e6386e5dc560b64a1da9a1954d2361ab4f22824
MD5 51a186a33cd2f547d91d63494d00a3de
SHA1 9aed02648e82fbafac28a5c677de5b8ff747d60a
SHA512 970e4f43f20dd8676ccd4e724f97408f3c49036484ba72663b4eecd585ccf9059c63d82a774ef5ca815c9d0d082838ece18a3db91a9dd5f896f3ae97d6636859
SSDEEP 12288:5eBNUbTVO86UNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:5JIUNatr0zAiX90z/F0jsFB3SQkT
TLSH
T15B65DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b741a2761b963e0cdef1a69413d3ab2d6872700a3bde25f50f211365e887d027
MD5 b1b5a7224e7d162a47a1e31364ca522e
SHA1 e21a681f8e26cdf6786ada1c2788c8e8443278c2
SHA512 02033bccec4bc11e54f924e6defa43625cf7d937f376b10a2408c3901730862418042145675072a21fcc63d8ab71e3649cbf56440be70e3c8d4fe065b5cc16f5
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:QQvGAdlCEL8c/yRNw5CZB2Yyjl
TLSH
T190267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4c3c25982193e6ff5c4e71246813a48da982575601ef2b817aee93e11e1c4b3a
MD5 6a46e4ec314260c41bec514a1a34c2ef
SHA1 b33f782712864b13c723fa69bf31de9577a0a4bb
SHA512 64664511face87fea8e6822cea39fc5de2f93a2a6be3b90b6809c645367f49b1c060298c2c1d0c4a817063a470d62e03fa0fba595490b56ee7d7e7577cc6d510
SSDEEP 12288:uAwSfxL/2Dc34DLLmt0LDQewsAjHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHf:TdewsAjHatr0zAiX90z/F0jsFB3SQk3
TLSH
T18175E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fabe50c2e78d72688726030700448d01a74454262a524174d17bc7413f083a46
MD5 8daf959f515cf5107cd1f2963dc305c1
SHA1 43e5f059f1c38016ea8eebda4b31627fb9deb8d0
SHA512 8ab9506c4c6cd5860f6ebe163c6e378382a4dfb70ebed35c8cfdc8db521e94d8c22bb13152a30778fcf7587859ad0fcd793e7900e46747578cfdf05acb70a3a0
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSZ:aUEtQevvqc2W1cpV2EI32U
TLSH
T111474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 adc0c00b46180ccc42ffaa9865248c63c4c27d9cfd9512349c815c71727ff451
MD5 164ff0c2f2399ef189b530922ac2bb04
SHA1 3c8eebd600e5e4b16fc5a67329a99a42c7bb5c2d
SHA512 e7db73798260b0795305426512d5c5c28e51cc7429d1f4374199d6f86dba9a88ddab53c34c44dc50933ea567942793ba68b641e33995108abb88a1a495e2fddc
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/znaB0zj0yjoB2:joqtVjnm1B2Yyjl
TLSH
T1FED58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 927fd19f62ff208b002f798aba29f1fa50549d46797ab0ea8c8b95eed56f8e10
MD5 d7445ba7d586595b445ad14bd57d0b43
SHA1 c9432f8a6d110cf69a0fb763971330b76adbef44
SHA512 6ba1dc58e7a1857192d9f24c4ec98b9da9900ce412971afa5af81f921324c610b9cd5a6eb26c91748a2573c0e95ea2116dab340f792165bbec21f0825bf2f590
SSDEEP 24576:cAhGLJIFoiwtA5l7S53Satr0zAiX90z/F0jsFB3SQkP:cAMyFoiq5CaB0zj0yjoB2
TLSH
T1A7359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 177bfa0492a8994fbd08c061c1ac15d4db93864154d012f3aeb810939b6d6318
MD5 bffc0d85f8a857fa7b11caf6594a4609
SHA1 8973584381e678be4377069323631148ae67cc78
SHA512 fb4226fa1b3b03841cc218f97c8476284d02cf30e2f690a5d55b2f16bc99c58917e297f26fe75739a9cac6f78926a07523a8ba83fa848236fa003e62f8545ac5
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+C+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:7wuoOW7atr0zAiX90z/F0jsFB3SQk9
TLSH
T1F365F14A32A90CF9E9A342388657C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cca4f4cd2439c6fcc96155d7cac2e8bf49e1120fb779ca25c3ad8ceadb6358dd
MD5 bdb0d0eb7b0fbbccdf262a66ed008967
SHA1 86b4919535aa8974c18c608a24fd66ec76a2042b
SHA512 9638afc1ffd16a5efadf5c1b9ac30b7f840291e1b8bbcf15a9896768c2720c5c4ce28b456f4be4a48fa92ceb028230c23be3e8414ef3e7191a69f758ac948bc6
SSDEEP 12288:RBZ1IyXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:/Zusatr0zAiX90z/F0jsFB3SQk7
TLSH
T18155124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 23d9163f92bd2a5d0066c1abd0803886467ac142460dcba1ca354e0f9bc32d06
MD5 1899e320f6cf8afcc7ec6940c52ba068
SHA1 ca67626535b7ce0a2d57465bbb98a8de52cc0f39
SHA512 5f569ffd07f3d05a0d93b481c7f444a4ee9e9396079866346692a12b039e0d7b6b7a2f2f3ec60e6bb202cdb0f7f3cef253809fc5255fc4f6951f90100c8949a4
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:3QRQyi36YOcPQLvw2gAf+PN3IB2Yyjl
TLSH
T1C6667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eb43701903397d3872f47377440c249d81f346e7234a90f641c10ca73bb86b3a
MD5 a2df39cdc98e0bdffe297380121f4196
SHA1 425712920a3f6ef97a43926f4860db6655c090a1
SHA512 67c64db1a6469ac46360fe977912c0fa84e4e986d0f609610c5706fca80568480d91917b843743cd9081f6e8dea66993ddc081100999802f5d23a6e890df931b
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:5QRQyi36YOcPQLvw2gAf+PN3IB2Yyjl
TLSH
T1EB667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8e6f76de3e1de3e8d81465f1f23d0f539a67891b2724d5d2807c779080aed680
MD5 f0228c1c8a416e3fe54e74d0d5d4d333
SHA1 8cca7b65145e8dd9ada4dcef3068b652536be80c
SHA512 2db9a9665ed09df5e89df83ebf5b7fb277c879291c759dde7d92b7e0cceefb9e4bde62763fb8e9004052dee656612c499c5945a38537f8a6467367d17c97f5e1
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0catr0zAiX90z/FJ:968Qg55nhheWu7PNU3/3aB0zj0yjoB2
TLSH
T14FB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6a03059e21b54bf416c373145e0933964464bdbfa68c2c6d9b2823c83d7bb16c
MD5 8cf5c63feb702f8049b740ae7bbb7801
SHA1 93f50235ae6520231e6cc3b0a7a8542dcddee13c
SHA512 20018ca9053d2bac7b5b6f00181522ce7a64fbf7ec9957ffea07fe665181a6b1a0ac1edf008709256481ed061b81df70c45d3ae7224c95077075ed27006e45e6
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:by5112gYy5azzVvL69nLKnhZ/B2Yyjl
TLSH
T115167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9caba803f62db1001d5ffeb69df9b92a4a222a6832d64e75c1c87f6f98f4bfce
MD5 93687d6b5c58498b25fcb5a46bf8ee1a
SHA1 04e060d25b11cddb0e9802f2afb2b04d8fdc3a48
SHA512 b9525b844631aa02ff8158c2363e49c21886fe4a9a7ff1fa21a8a78c80026f31f29839b845590b6caa4df136e2bdcdf3f46a5ba5ed7e8abf6dc7a34157f8b70c
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAaB0zj0yjoB2:cu6JmVxd2dfB2Yyjl
TLSH
T193D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1c077d8a9bc2e2a80cc1010a090ad279980b9cd139033c1582e5ce64db9eab60
MD5 8ae68fccc3f7b60fd5a595bc9e648a6c
SHA1 e43fbcfa05e4f7687634be809d4fd091fd0eefc0
SHA512 ce9ae14613db4fef508a9333064a5b79f2373cb5abd4416ec98ae8f96192b76c79e6594c0d0edd46c75711717ea36e239b734d452c52b9e154509f700326a91e
SSDEEP 49152:T1hpsNoJpF1A6UU44CwH7R4xtaB0zj0yjoB2:TmifPbR1B2Yyjl
TLSH
T19FB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a1cff5b29337a2018682100ed7353c93d8a7ba3a3c5c76332216df89366b207b
MD5 06ed3e4b4c1d8ac81f9901588c11f436
SHA1 d3a3929bedd346e70508084a067656504eeb1375
SHA512 f8990cde44bdfb2fee81f539e74809d2ef11b0a1cea57bf918d9816ffb579055f52c9f99e9a0954e5886ea36ac772f3df795fe3918289bb655d5361ff4c394be
SSDEEP 49152:VSuZQIY0Be2KRRVtOnks6NMHqsaB0zj0yjoB2:75dKTi61jB2Yyjl
TLSH
T140C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 122cac1a6ae7ff215540889494fa69cf5b03b734221002db0815a36bf6ff8f66
MD5 159bc403721959925899de29a7c25da3
SHA1 96b4f1ff1ad3a7cf5b90355ce6be6d53e0506898
SHA512 2a1b83310a2bff67ec1dbc7658e7dfa2f2e029f8147147f98404a6bcf07af4e3a24e48846051d9f003e4f50b403de6d1e6b2a4c9a62abfc44925346a8beb3024
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wZaB0zj0yjoB2:7X2iyphRB2Yyjl
TLSH
T1F695BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4c3f74e9ed64bc70b28e6ddd797cab6437ebc302ce3e142978ee58e7d75b63f9
MD5 f66b6a617393404c4329a176a312322e
SHA1 a6976518bcf61e545aa65b921f3470131f1b51f0
SHA512 d738778decc8d2b9b723191ae167acf603398137fa9375d9cc933f9be4890c9af733c0a02d91fc9886a6ed8ed289acdcfae6e529c94523cad6322b73b68fbba5
SSDEEP 12288:ioUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:ioatr0zAiX90z/F0jsFB3SQkk
TLSH
T11045230B341F80F3C8C31B355284984B1AB95EB4B6D36B89F2953F0FDE382C616656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 67ce38cc474c2011d94097cb4039378d569105a7c46dbead0334cf65d37b00c9
MD5 733a32daa72c170a1f8f42eebb2ea434
SHA1 cf319ad2fad99e69f85f85939eccaca134cb8685
SHA512 15c68386dd40cda8e71da71856657bc836ab5c4d2eb71dd81f0c64175f0b6b45188811d219490f6d6e7673ede3be327a13b92160408ad96494f7b768ab804b21
SSDEEP 12288:qTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:qTatr0zAiX90z/F0jsFB3SQks
TLSH
T15045230B341F80F3C8831B355684984B1AB95EB476D36B85B2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 39f136dba432bd55145ccebb0b93c9a6fe53629decd4b8c55988df576f626b05
MD5 e0544a478c5a4355229f3027188131f1
SHA1 7407721d9b64682d9e6ddd6ccbf95e7d1af46569
SHA512 454a6e8fd84c92ac8717c77fad1223b0c464cf6f128bfd29ad7b15bd61d08ed25f1e4af3183511d296105860b0fe4f9f19a06c45ecca99d6261ed2edb47f0e30
SSDEEP 12288:a1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:a1atr0zAiX90z/F0jsFB3SQk6
TLSH
T1D845230B341F80F3C8C31B355244988B5AB95EB4B6D36B89F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f9d0ea7142be8fe5b0830940f30db4e3c2d9f01c3e5b75417a3f868b7189fa9c
MD5 db78f2357a7999d7affeea52d247303e
SHA1 7af48838e678a47567a0d3169c848582ba861cad
SHA512 58635aa9145967006a76dc7e94755724200b21dd7b589a13e2add55b7ce1880fc50b8e7cb763d8b7d07926790c7ea9d8e525d7f8adc1b2fa17e3ddf9b7da1559
SSDEEP 12288:0VyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:hatr0zAiX90z/F0jsFB3SQki
TLSH
T13745230B351F40F2C893973586548846A6B5BDB0A7F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 086d7a1afa469036171b034e9f6f2a8d4199b40b269a42ff422c6d194afa0497
MD5 dc7968c215a4fef2f2fe684c20523cb2
SHA1 53bba2fc21bc34b7cfe6537730088be7786675bf
SHA512 4d8baef477587d13a53e25891595c5a4629a197f781ee5bae3ea175e7ebcd36b1a8552dd11444074bebf05ea47ddc7153c41b9aa6f2f3f498870514253f49da8
SSDEEP 12288:AKUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:AKatr0zAiX90z/F0jsFB3SQkO
TLSH
T13C45230B341F80F3C8831B355644988B1AB95EB476D36B89F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b8de37c3d18d685e0539c56b54f2a00ebff51517f204fbd4c4cfcb8552e5d53c
MD5 53f72dee2e9c43b3f3b3bf0cb0824765
SHA1 c659d97c7b85926a47e0cb84cce61ff1750ce538
SHA512 61da1ea76045b6ff198b77462e2b6fc1a4bb43e1fdcbf947907e816a7ac7d7d19a2b8c68f6f8c4ae0cb4593f191479141683b7b63b613582d0ecf2af5c688300
SSDEEP 12288:KvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:Kvatr0zAiX90z/F0jsFB3SQkO
TLSH
T18A45230B341F80F3C8831B355644988B1AB95FB476D36B89B2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 adde9031f1259874f42529b5e1400ef90488162c644a0b1e9f0ecf8dc7215d64
MD5 e283e12505b0c06567cad5e9710964a9
SHA1 1d18be42b0aa1ae40122dcbbbc71c27c2b19fd78
SHA512 9af70dae5e65af2f9d83af984cd5d42ecd61da5fff1befcf3124286d3e0c2f535be418b543ef282f68c4f800039af05dc107c853b9013575377b668bb76cb897
SSDEEP 12288:RrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:Rratr0zAiX90z/F0jsFB3SQki
TLSH
T1FC45230B341F80F3C88317355244984B1AB95EB4B6E39B89F2957F0FDE382C62565ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c8f077a1a0d9eaf625ee9e6d610dd90a1145111bdee3f6c9e1a8ebb1b2c41ded
MD5 337ca84cdfa24ec6ea0c55a850245b6c
SHA1 b7e2b8e8f67f4cdc41a594b314eb0933ee4fe4ee
SHA512 b0e6a95733ea4ba34489e7465b8e833962d4a7f0bb6229cbaab68aa2556875e1d7d5d8c77c07985d30c27a01a2641752c4422c8214d2cdd4bb8472fc3d02ee78
SSDEEP 24576:JZMSzFVSOzatr0zAiX90z/F0jsFB3SQkg:JZMSzf/aB0zj0yjoB2
TLSH
T10565019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7d22edeeabb6d5f15afe12788274775e68043c04169cb44cfa3a11931e219cba
MD5 705bdceb8404f5ae3c75ff6df4468f87
SHA1 508534562b0a9e63b8642c35c8dddd1497e0688d
SHA512 3265ffbfa30b3784cb9d67369917d8c761902a98cc58efc5f8fe03de14cad23579ce4981dd5bd2464be915d76d72f7bfbe8e25812bae2623e1c075fb1ad0c248
SSDEEP 12288:u8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:u8atr0zAiX90z/F0jsFB3SQkS
TLSH
T10F45230B341F80F3C8831B355244988B5AB95EB476D3AB85F2D63F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 983963ee030b1c35d04ffea1b146df8567416dcdfe39bd7cc58512b715c37dc1
MD5 419e393bdd31f90867895496b2b79c7e
SHA1 28f72aaa3dc467be7c01b7f8ecf61ae1c2c3de98
SHA512 5971e08446a27d4bab348c29201fd405759306004155f4f9c33996e1c6e5c3eb408d2f63f906f1903b7a75ddfadb5b6eaec9a5d137663aa2274409751333ae1e
SSDEEP 12288:8wUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:8watr0zAiX90z/F0jsFB3SQkq
TLSH
T17B45230B341F80F3C88317355284984B1AB95FB4B6D3AB85F2957F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f1068aad67647b63bce4fa62a787f32e3548aa98ec82027e222f3ae1d0683056
MD5 1721637b09f22865f6177cefc3f8439a
SHA1 64f8effc17e6bf8cd8b43c3839775aac02e80ebd
SHA512 42a74222e8ffe02d3147f87d9a75f9d447d3e63db415f9697bbcd1cd55b46d1ed54e0bb3981c3d0526d6709588a45cbec4825ce855c5dde0992b36b06fd5ad00
SSDEEP 12288:+yPz5L8XUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:jzyXatr0zAiX90z/F0jsFB3SQka
TLSH
T1C8551207326620F9C4639239C9901906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cb0dc629ebc91c24e4d7648f88a8d758715b7a0b3eb70b2666bd9d6582e8adf2
MD5 0fcf1d2dfeda6380395ca26eef8683ee
SHA1 c9b496502dd8dc963da5bf1c06544884884663aa
SHA512 5bc1b77937f8c92c13e58e6804385873aaa6791e293e0aee2f75fac994f53b910c4d470ae634ef150f163827c72f3b1a71266e50a55aa0d78e5165928f6ca688
SSDEEP 12288:C8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:C8atr0zAiX90z/F0jsFB3SQkP
TLSH
T18045230B341F80F3C8831B355244988B5AB95EB4B6D3AB85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b1b097215866287fa681caa67adf849757db43bede86e94ae975406405aac119
MD5 b162d2548f37fc3f2935d2ff1d3a7f44
SHA1 44f1238abb6c91610a74186a4c0e2725f855ca43
SHA512 dd9109411e71e4d58e15947e251bb7de96b781e149e87b12322c96d6d8faeeb90c8769adbd66a979624d12bf03b08b32ce31422c6570e1c946e3e1b550f3e733
SSDEEP 12288:m8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:m8atr0zAiX90z/F0jsFB3SQki
TLSH
T11445230B341F80F3C8C31B355644988B1AB95EB476D3AB89F2953F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7b11424148ffa1ad6c8998f928c98be5a27a7e5f17c4c6d36c26a66cdd80da5d
MD5 d269cd9416a3ebebdfc09ecc930b2a59
SHA1 91c0c9eec13dec23a009e5b90365c989cf28a5d0
SHA512 81acd8d5b1231806b01cbd81ed44f69d9b6cbc652854cd383f76a3dafd1f5bbe5e4822b2eb0ce0786703dda722a0ed4a3d809fb6516cc8544dd206bb3a9c855d
SSDEEP 12288:0yPz5L8XUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:tzyXatr0zAiX90z/F0jsFB3SQks
TLSH
T15B551207326620F9C4639238C9911906F776783117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 13f4dd9471983a4ad4db9d5df621a088d8978b23cb62ab9bfa035a22905041b5
MD5 8372eeddab3ffebbef502de61ef0d06e
SHA1 53e6ada0596395e28c1689931c5751d5d8d970f8
SHA512 f6956650001fafd3f73f0a66dd0c94c5a6653a7a9da966098aa3a25b06c7e5120cde2dd8217c2630d767a529d685b43ba9805748d236bc6e63e6541b81a70c9d
SSDEEP 24576:tTHaLl3z0zDlatr0zAiX90z/F0jsFB3SQkG:tT6LljeaB0zj0yjoB2
TLSH
T14B650199735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3d5fc483cae6617fe3d75ffb46f8bce64307aa33657b8c652ce030160157680b
MD5 62177e53695da8dd7488c7055483b711
SHA1 d59a36d748d9b6640f105f1cf113b70646485824
SHA512 a8c6bfda2da3e68444600f87ecc3a5401f016324eec5b62a7ddf8c710726a8c0d12900133d65c4a1ee1cf8b3365f9bb7c175b98416e975e60b637fb4167f6a82
SSDEEP 24576:d37d9CHKy7GZBatr0zAiX90z/F0jsFB3SQk0:97d9CHKya/aB0zj0yjoB2
TLSH
T10A75CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fc508c17f66504492ba4dcfae9b2402e8513120c08dc9c0defa24a143b199ffc
MD5 544e5b949c4cbef52668a16afb9588a6
SHA1 8dfd2334933149dfacee7ff36acf34da4aa7acd9
SHA512 29b940aa232a5e4b6174b56c8e4a1d264314fd12c9849e7589596e1741108999d9ea7fb335e40e66681114f8dc37e2e906299b5f1670404a64cd45711dfa7ebf
SSDEEP 12288:ZVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:ZVatr0zAiX90z/F0jsFB3SQk2
TLSH
T17145230B341F80F3C8831B355644988B1AB95EB476D36B89F2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e91208c34e0fd76733ea1ad453060ef1407527ed2350dd75729f57250a0c0dde
MD5 681f0c6b5e2c85c814c1d406bc95fc44
SHA1 a281fc60e0d77750f87fefafccf7bfda39d2aae0
SHA512 2a87229d6d772e45a26c5c9d22483b4ad7626979aa0ca9d9d9a0187d68f106f39b93ab282508a8ba373f435083b09e2ed9a89e501df74e4eee77b5660f5ec8b3
SSDEEP 12288:K3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:K3atr0zAiX90z/F0jsFB3SQkD
TLSH
T17A45230B381F80F3C88317755688884B1AB95EB4B6E35B85F2D53E0F9E3C2C616656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7753a039c665c220ba6c2bea4003689221daeb75f24e4c929f74a7d9eeab1864
MD5 4087f009a3d84d4bace4c379621d9d3a
SHA1 720fa30224ab635673ad2e7fd9f67d1bc809a0c7
SHA512 13a9ecc1fb4b3cc0ea30fb127d37584f7af6d7dc474ab41d713f5a426c1e5b36be6e3359dbd3e0b57e070b0e608ac94baba01c31493a5a65747ccc45bd75cef2
SSDEEP 12288:5WUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:5Watr0zAiX90z/F0jsFB3SQkv
TLSH
T17E45230B341F80F3C8831B355244988B5AB95EB476D3AB86F2963F0FDE3C2C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e0f818d273ad2a6c387941fe578357aa7a400373839723e183850d6d9e7a8f73
MD5 c51bd64bcc01b13be3a1e2b71fa41173
SHA1 e0ff40e7c12b0b7b8032657cd92ee5adee2085f4
SHA512 bbba88990329bc1e52765f27738ab7f93fe9bc054e3c48d6ddf4ce13e54a62c0a57559d5fe653fc12f94df83440eeb6d8564b588ea3cad0b692641cff81af1db
SSDEEP 12288:h8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:h8atr0zAiX90z/F0jsFB3SQkf
TLSH
T12845230B341F80F3C8831B355244988B5AB95EB476D3AB89F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 42b2328be95b5bd6b8be342112a8cc05164a66f38377e14bb58f77f4ea6d6820
MD5 da651e24a5f1ad1aba01f23f7a64d3cc
SHA1 aa3ff19c50a8de7a0b30e57f011f9b6076cf9f3b
SHA512 2559e9c54f69449d0bd5a8ae8a987cf380b17183399110353ea3778ad169745179573016bdba1705ad502b1cc81a3fe1bebb6d497f9a581f51a7275c77fc45fb
SSDEEP 12288:0VUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:0Vatr0zAiX90z/F0jsFB3SQkz
TLSH
T17A45230B341F80F3C8831B355244988B5AB95EB476D36B89F2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8c74d569b196f5611daca7a5436148b141dbc8b8628740a7ce4870973e29cc11
MD5 24c14b5e0a797f457f45682112ab033f
SHA1 b93b6ff92c0fe75baf9ef11f6db4691418d149c6
SHA512 81a36078e3233aea71fb7d55ed9941c43eeaf0a2ccb7e7f9578e4f87b0c59603b3ed345aece4272d45001c29ed95f3d8ac5431d84e949dbb47f28bec509e15ef
SSDEEP 12288:/UUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:/Uatr0zAiX90z/F0jsFB3SQk5
TLSH
T16545230B381F80F3C8831B755684984B1AB95EB472D3AB85F2953F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ea3191bc601bb5cef4596ebfad0fab6d0b59ce40e5314f03abe8d3faa6484846
MD5 f6f5d3c8c486ec92d1e3cb8d5824d257
SHA1 bfb340079d0da5721248049d73baeaad17c3d18d
SHA512 f8555554f6b01952a01a5e25828f40fcf6a5d2992c29d85ccd0d3d55a591e8d61491a891276a3433a2c7c4e9d8da1c0cc3f264bdb06c92b9e7c79c0b2502b4e9
SSDEEP 12288:zKUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:zKatr0zAiX90z/F0jsFB3SQkN
TLSH
T10845230B381F80F3C8831B355644988B1AB95EB476D36B89F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d59fc4c1defdfc51d329443904b5d5c6f446441b1efaf3e1573b837754167303
MD5 0bdc5fec6c897a3b7a54e40b5666f142
SHA1 2bfa2f1d7c1b41a3b9bdfe9d589577bb45aa2092
SHA512 00d62919202af54afa528c95ec2fa2d9391b4b506f57baf78f2312e3026fd526316cc892d92fda733d1fa09b6446964cb70b4b80e8192c0f007756e479683f9d
SSDEEP 24576:1fwvok9RX6wkyAIAatr0zAiX90z/F0jsFB3SQkQ:zMnYIAaB0zj0yjoB2
TLSH
T1F285D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4e4c09e46c08898f2e6d17a6179f579cbd26f3b1e08ddf1350bbbc94b68e6268
MD5 16bbf0c6e914278f66113bd16301590a
SHA1 3549d2cf2716039434ed52e1a896cb61a5a0a73a
SHA512 453b770756afa68d652a2dfc0dd19a8f0686740e7b7745b798d466fccca4289a679b27018f08095f2ae5da5a16f98bcc463a245fba7fc1961fe3a389a6f019f1
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05aB0zj0yjoB2:BySzPoB2Yyjl
TLSH
T190066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4ea4015878daaa4a8506e210cf8b2a977efb45241c9aa17ddee1686c601d293c
MD5 dfcd798a6243882b800f808498cc3e0e
SHA1 979f9f2ba00957438caf944d57bca6c1b992904d
SHA512 639a5b92f51684bc7a1ed99816f935fa7fc8c7a521c491c18098f474687a8dfcd626b07483c8fc0b26d3640796aa614b8bdf8824867cd4043a3d343e5c183ef9
SSDEEP 24576:T47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYDatr0zAiX90z/F0jsFB3SQkE:T47JUQj1irIhCnDHUPfF/JaB0zj0yjos
TLSH
T18C65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 50faddbb5fb5005028f761830ca93f0e4ec0b475520ee4b41b008de1a73f824f
MD5 48602ced017a7bc3637da3cd85e6ed42
SHA1 7609909f214aac63cbcf2e60a2534ad4705b4375
SHA512 9f238ab80d9042a36e8309d5cdda4b977c93ac5f60f5d824197ce515f674e2f8aa1b27d2442ede7113c7310e4639f04e733a0b11b8209ab35e6d2f8c1597d392
SSDEEP 12288:/NsfsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:csatr0zAiX90z/F0jsFB3SQkl
TLSH
T1F955F00AE25801E5C0AE6239C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6a431a81ff352872301931aeef817cc6c23929079e9a62e3844145a03d0e3817
MD5 137d7902a327aed0921750ab67a9528e
SHA1 6c3f1e2cebf3b15088160f51c1f0a1af2d197acf
SHA512 4ec8bb3cbc6e5c3f9e5ecbe9dc733365854e036b939f672a12a6e6a0313a38150972a87e6977baf34ce69678cb3e943dc2b9bbd19e1817568d74438c929c6e6a
SSDEEP 12288:8xB7IU3fCGYOzFRhiKdXO8V9ol8RLp/0VVLRyJ1f6jgHijVF:8xlIUPDzFRh7UqtRkgJ1fvG
TLSH
T118451840766AC65FC6AD40325E32D1CCA7707D01EE45AF0373C99B3FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2dbacb7811ac23fe4dd99ddcab8471601ef07552ff88b1ba43ca2864a354b7b4
MD5 f73a018f6bded311e68e24e1abacbc73
SHA1 86bc177016647040476d6d5384be5b011bcd01e2
SHA512 9172b62dab51db07b2302c0b52b1d2d837f58e4ecbaa5d35bc2777352234240b8fcc8649419f400693e4cdf57ea58fbafa43dcfdb079894d1b43215a64d81600
SSDEEP 12288:8dT5tTctMBD2xcsOWO1hOoBeVDey9LQ3Lkv1F+0xIQ+ogqH1V6uTYO7DQdi6M:TYSINEY+kY6M
TLSH
T18F65F981513BE3CFD1FA1032072A6B4D6764EC4777096F227788493AD86BB25A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5522683cd90d2d780e3bb95ac6b24e620f49e15f5f5c19a71e0dead6ed005ad3
MD5 72f4d6106c88c90defc1a5051d735be6
SHA1 6eb55784bdad467c7e7baf570236aac91b2255b4
SHA512 97584670114269157978c899e342f048868681a2bc48715d805d7e631b18feb8f7a2109e6d5c24ff066bcd9829776eb0a5b1053bfc96b31e7095a67c6f7c44d3
SSDEEP 12288:tM7EUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:GEatr0zAiX90z/F0jsFB3SQkv
TLSH
T120452307351E80F2D8E32B3416588806267EBA746BD29AC7F1413F4F9D386C65E75ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6e7db91b38f3f42c4666c7ff276d28dad8a1ed1bdc705d4a77231e6a8411b490
MD5 07ddff18dfdcbc635470bdf544fde67c
SHA1 ad1e12a379487821192986a2234d29a74f062094
SHA512 7b0f6a79b87494a500923fc974157119edff0a29a041189a88b99cdccbba3ae551a34daec7b76e75e25d57c6d222239ecf84b69d447e4691b9043e94a106b09a
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYeatr0zAiX90z/F0jsFB3SQkE:dgb4mBIBhGFDaB0zj0yjoB2
TLSH
T16B65AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b76e09e29d9cedcf2f0638e60f8ef2d0826be8ded3d18790cfa934f56f656223
MD5 a864b05fc47d00ecaabed72cb629f317
SHA1 9774ccd9fb54db42ceffed6e1212fdf07f4c5352
SHA512 1171cfba06e3876f75e3f02a80dc6f298c3c2d0cebe086e729c1d3e225895ed874f4c289913b034afc80ada594e93f73d06cd3c4be1e4b949ddade03b5da6a08
SSDEEP 24576:kG88u8FpJqH1bzria7/mzatr0zAiX90z/F0jsFB3SQk8:X7ZFPqVea7/2aB0zj0yjoB2
TLSH
T1D185016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 624d53ea76a93044f78e05a2d5e444123c83ce5a4afb8942f351dbe6eff865d3
MD5 e8216e7ac0635892b46564a3cccfdcad
SHA1 006880846405124f7f30ba80e26025229426291b
SHA512 5e0d5f26686f129f8351be79cc1ef337c24da5958f0809dd1bc4cfa2d1c1f18c142ca61ce5cfb02a26886afed3047d6ad512250078e8200ccea7c1691d2aadd9
SSDEEP 12288:FHvUrBFrEjwaQ/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:FPUr+NQ/atr0zAiX90z/F0jsFB3SQk8
TLSH
T14865E11F22AD18E5E677A13D85818609E772B8621352D2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ca311f35152164a47ed3cb3eb77bbc77190784e72a2946a2b89ffa8ef6f907cf
MD5 76466551dc5ba464a02483502c6540da
SHA1 17f613e9fa932f859d1a8a03bf08498053628cbd
SHA512 b2149dea2e4a427bbfb1bbdf89e3c484ee0e662a2e931b7907efdb1ea7d42f09e179abd251772d4808c6b8f248dacef16633b38fb55954100b4ba13d170c926b
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvaB0zj0yjoB2:tG05lO43b3B2Yyjl
TLSH
T1DCD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 339c11abef5f2588b9f03f5e3f0b7f1554220e8a2ba4b5a93c3f95ca6c100388
MD5 882fe8b106ae91bbd6507b9b01a76a8f
SHA1 bf8ff658cb533ec767bb612bc962d9c93c7ee1f2
SHA512 455e2a5cfc67411e7485940e291b894ac4877f37f1a5218427fa72ddd25b743fb3f390daf44fb0d21a60b3b501a1584674c9b718f9fa4a93e8c17d54efcde1ce
SSDEEP 24576:Mfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn5atr0zAiX90z/F0jsFB3SQkV:Ua5POZ3+Jt2pasx2+m3aB0zj0yjoB2
TLSH
T19265BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b48695c6fb0e13bbe34a391e1b9281e9d9cebf88f288e4a75a87e90bd713d663
MD5 e77f6e59bbe8c2a1d609bfe8b6c58589
SHA1 268bdf88a85278052c68c8f091b002e4a254f2db
SHA512 c6a64df3c5e3969083f46fe19a29018b135e211520b7997a97c4e90d6dd758041c5adad8e3e5bf937e2c1f747ebdafe5d69018993e3e5b4d8f13919dea128fc7
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7Fkbatr0zAiX90z/F0jsFB3SQkm:ONc/zEOVHFWaB0zj0yjoB2
TLSH
T194858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 198b2f12f9454164f4038345b7210f77b7417b02793cabd48371b1657d940d56
MD5 342053484fa1e53bc674a5f51372fc93
SHA1 a235212fc4e3c53d358791a25a5d7f8dbd11cfa0
SHA512 9f53bfc58a0c4ca4aad33cfb6840a687b8c830848f301090634941d1cb27eb04e460e3a48de8b8572f43b7c9bc9cafa4e21307f402fba2d0e79edc9f03345b56
SSDEEP 24576:y8kNvNnaFeYhJNtmZBmUatr0zAiX90z/F0jsFB3SQkL:y8MwBtOmUaB0zj0yjoB2
TLSH
T13155BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 88d82d87af74ab83f00e8f925e1ba6b0ed5eaac21ed429962340800961dbcb97
MD5 66cc3e35bbab40e100346e1662457210
SHA1 207630f8b82abca491a2d5b23f786495e1658fbd
SHA512 46019af3bb8e8ca04de52644799706fb21d8d4259c0606380efae55e91420b141b86de0da4b0ff4e661f8ef16cf23563ad19203674373222d2ddff3465ce429a
SSDEEP 24576:FD3FHshBIYQgAIatr0zAiX90z/F0jsFB3SQkK:FDVHeBIAAIaB0zj0yjoB2
TLSH
T16F75E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F6BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-0-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/1128-1-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/1128-6-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/1128-37-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/1204-281-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1204-56-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1204-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1204-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1580-138-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1580-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1580-129-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1580-135-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1580-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2580-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2580-91-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2580-97-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2580-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2580-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2580-329-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3020-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3020-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3020-86-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3020-81-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3620-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3620-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3620-13-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3620-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3696-123-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3696-317-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3696-117-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3696-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3828-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3828-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3828-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3828-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4268-70-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4268-296-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4268-76-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4268-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4908-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4908-41-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4908-42-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4908-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4908-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4992-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4992-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4992-104-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4992-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4992-314-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4992-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6688-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6688-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6688-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6688-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download