4c91f38373be5e5d46c0c05843be0e211d3e4f4448b5fca5bef4e55ebfb33bd7

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260831-2663nszfpc
SHA256 4c91f38373be5e5d46c0c05843be0e211d3e4f4448b5fca5bef4e55ebfb33bd7
MD5 0cbd813c2f2fbaf8fee7f961b5e398b8
SHA1 837dffe6e8b38e07d806474a84a85887bd7235ed
SHA512 d7d4838081fe3f82c12e64463bf90dd18318f89bdb2b1e563dfc8fe0cc92e2005f25273d8331990ef48ba19fa85fc4ee49c9f76577f871e732d45d562f7c853d
SSDEEP 24576:I+bct0e4FCK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I+gt0e0LNiXicJFFRGNzj3
TLSH
T19A65CF1277E58035F2F32B319D7582715A7BBC31AD39C24E23902A2D9E70A91DA38737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4268	elevation_service.exe
2612	elevation_service.exe
5400	maintenanceservice.exe
5428	OSE.EXE
4284	PerceptionSimulationService.exe
2020	perfhost.exe
1052	ReFsDedupSvc.exe
5356	SensorDataService.exe
2508	ssh-agent.exe
3464	AgentService.exe
3736	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9b90004ce62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4019b449e39dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b3f38879e39dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054c496469e39dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000914317459e39dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079efd9449e39dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4268	elevation_service.exe
4268	elevation_service.exe
4268	elevation_service.exe
4268	elevation_service.exe
4268	elevation_service.exe
4268	elevation_service.exe
4268	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2820	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	4268	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3464	AgentService.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: 33	3736	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeDebugPrivilege	4268	elevation_service.exe
Token: SeDebugPrivilege	2612	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2820	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
2820	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
2820	2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3724	3736	SearchIndexer.exe	100
PID 3736 wrote to memory of 2800	3736	SearchIndexer.exe	101
PID 3736 wrote to memory of 2988	3736	SearchIndexer.exe	102
PID 3736 wrote to memory of 4428	3736	SearchIndexer.exe	103
PID 3736 wrote to memory of 2880	3736	SearchIndexer.exe	105
PID 3736 wrote to memory of 5972	3736	SearchIndexer.exe	106
PID 3736 wrote to memory of 696	3736	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_0cbd813c2f2fbaf8fee7f961b5e398b8_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5428

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5356

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7730959094ef9aec8bb234c11852b6ef333efbf54cb7688c1ad077023c613717
MD5 5f8116ead322b37d33e012a390168d9e
SHA1 8b72a6042af9a3de02992f285730249913248ecc
SHA512 986142933d13aaebe72cce0046fd85a4eda308fee8a6b0934f006d8384334189af0a38c87734115eb07ff4b614bba716825c628e4038d9d986ca29cfdd2f2a48
SSDEEP 49152:hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnELNiXicJFFRGNzj3:n3q6mjBb7wRGpj3
TLSH
T1EBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 89dfc454c1880e4368c8b5d06ad0063f2e3538f69083d815e9e20c9378bb86af
MD5 77bb09e1eb2dc1fb631bb6eac1c8843a
SHA1 5fba6fdc10b64bb0838d9d69cc9e5458c67f2028
SHA512 34cf460dbe75e328c5502c08a4cc19277b95e905cb1635b70421c236dbce467f6013540356e54d7d7b938a317722ce11ab7003c8460ed99d9cf068e23ba23afe
SSDEEP 24576:tXYfDtczAf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4tciLNiXicJFFRGNzj3
TLSH
T1CE65012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c6f32115cef7b7daaf853f24800ae7e0f553c98dd8099b70c1cf4ad2788ee135
MD5 e99c5ee9258bd50b8f4c69ce0e1ad8bb
SHA1 2a8db76bed04cc539f153111feb9be044db64d49
SHA512 af8e475050c7bdd72dee485c05006b13f8ae61f08f06c6f18f9acb30df9733ff01460f1adad47b72e8da5cdfdf4272ac803df678c70e5d9092583555550d956c
SSDEEP 24576:60Le5ji0hmx7rMs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Pji0ApxLNiXicJFFRGNzj3
TLSH
T12B859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 62d8787c18e0e024d8de6173f3997a21ebc3dfe254a86b2d67dcb3e7807caf9e
MD5 ae7e558b78b9386a512fcbc29567d489
SHA1 6e741521149850c4bbcb783d5470fbedcf29b40d
SHA512 90d71c209fb80294f08fe03daa22f23d2c7e927f32239b5c219f57bbb7c163605aef3b1f07f8d46c4f46bf0eb732f56ca5719d5a71c3ebff0e1a6a20f4e06195
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyuS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m/ezSC6vUzPv+HjylLNiXicJFFRGNzj3
TLSH
T1B0756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 51df9c57b4bf6bcc948caa5edbdea26b6365945faf5239ae2508e6be3027bd45
MD5 4d5109fbdf664fe2ff975fe7c7196b4a
SHA1 faf6d961a7a521575c0b81626eda83904023d112
SHA512 bd1a605d8c16c075738dba6587a825cb432430b54c2a6a6764492d3546984388624913d8e6fe182430a4d5918a3db7946f156af0e46f490de72c42f2d3bed968
SSDEEP 24576:FVbqPb88hv/l+BL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FVO88hXl+RLNiXicJFFRGNzj3
TLSH
T109559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 143188b888b518fca3440bae61aae66775d1f3d50a2f3dc5b9f59253536c7f9e
MD5 1676ba1d1b4edf769d0baa2304adc530
SHA1 e12a9f6c80f5693dd9be75cba518bf54cefb1d74
SHA512 acf01338d39c18fd8512a9cc176c171e8665af9812c4d25d0be2bc005de5d98b3d65dedde849379ad0598155edf30b940a446d96d1eff630f3e970b9ffc542d4
SSDEEP 24576:x5o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YLNiXicJFFRGNzj3
TLSH
T1494523D3468864B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E913CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fed1c6a888f6a8107c72dbe1daaad0452a84cb988753b1c5dff925423b6a9751
MD5 b774cf3586948ace9852780a8897edbb
SHA1 f476d03d7db1fa53b63668489454da6a1f15e2e6
SHA512 acb2dbfe2787d1b24e5910a910c0d5f4d85cb28a045c75e137410328b4f4be5c62e9e3d189e28dfea9c7fadcdffd3cd12a7c82052702e069b91aa2a168cfe67a
SSDEEP 24576:qJIUT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qJIUTLNiXicJFFRGNzj3
TLSH
T11765CF7BEE28FCE2C27E4C7957518600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e3b3eeb6689db49f7e667434fc420e0e8a62b9a2df17f3af158f326cefc31ed5
MD5 eb81285b6fae5836872569f4f55f88de
SHA1 661457a48157166795552821cc95efc6e8365582
SHA512 263c40cd8871c91dbbb62a772b9d67a838b2ca65494cc494e7d95df0d068b6f1e77b94a1526b7fe1ca02af9617de0af7bc8deeefc3acf09ee348c34e0c27bfa7
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THX:zQvGAdlCEL8c/WRNw5CC7wRGpj3
TLSH
T129266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5ee6b5c0ad4d24e47b01a20ae18e7656795602ee0e82ada6835c06a3c466a927
MD5 23a54ffd8e78daf69afdcbf538475eaa
SHA1 333a5a5dd6daad7ea906251e0144e788593cafb8
SHA512 c740e63ad7dfa63333ca9bfe9a38014e23e1d9cfd40f6f113bac750dfd90aa637f1915986c648083f5528b390802cb3579eb62b0d837dbf6fa505d55440cc21d
SSDEEP 24576:9hewsAjh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/ljhLNiXicJFFRGNzj3
TLSH
T13065E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e7ae4a55e95272c4529f585e677c73c38f7116b396ba8c4a1e6a5a4e01fb997e
MD5 937efb34ce52ff026a39dcf012f48beb
SHA1 44d194acc191d5dafdfb35bcf9904f594e75e2af
SHA512 a4a74ac42885c445182c80d486bd90f78ca70db78d1d8b5b0340d87026f3a3df0253d938a10b28cb41c6bfdde820a82ffa983dc98ba1ec9e3bae642382978047
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHNF9:qUEtQevvqc2W1cpV20I32z9
TLSH
T165474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3f6ad3c2ed5ef0dcc612e6ebe6b1b427a0e3f9312d210caaffdc00c4bd187928
MD5 b2dc8e3a2e02f008f68542f08be086b8
SHA1 8c6c6b97eb6cc8426adc39b9381e0bd803a97cea
SHA512 48505d721079d579bbabf8ee1ec4e26a1a0c7d863dc35179b6e495cf0c2b5f934a0621f022b42679708e9ed4ff67debe312b58ab06a7bfe62de57186a306e4d5
SSDEEP 49152:rCbRquA/m2yL5zLfFiV+XenmE3/zBLNiXicJFFRGNzj3:0oq2Vjnmm7wRGpj3
TLSH
T1C9D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c7c684fde2c6d9d3f458391db53d0e5e53935977a5f7b0ee133839258f5ee498
MD5 4f75e33a5bb8adbe20c55e21414bbecb
SHA1 d6056a147b714e69e9e11c300444cfd5ba88ffd0
SHA512 17db2fc787b1d55eb52fd38903557dc7668c51c0ed033dc13b41db509d894be629d14bc70387b3503cf47af518486425490e51e46bfbae0d55d9790f47f407ea
SSDEEP 24576:aAhGL6IFoiwtA5l7S53G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aAM5Foiq5WLNiXicJFFRGNzj3
TLSH
T140359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 181cbee805bd60d7e600cf2e76627bdaa849e34a061adabcfd811803972a3377
MD5 0d89486b8265e9e4876f430ad7c85daa
SHA1 04e87638c71c4d6c2f19c6ce3a875f3a22914388
SHA512 fd8a5c4ac1f3197682f9786e4d4b04212b01a4b894d320b50cf82f257c8ab01ee510d87bf217134f3b2fb9b6061382b3bd7b363f8b288cd5ff8eba9c3a6b398e
SSDEEP 24576:wwuiOWF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wwhO6LNiXicJFFRGNzj3
TLSH
T14265F08632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 4599a51ef1923861bd307dc2de9ac240e75ac63f220b99c47d0cc14676bb6216
MD5 2f3eefe82458a76424992dd6f49bb75f
SHA1 5e8a621e459bfdf208917f476dd2d2838463ee06
SHA512 f8c5c9bb83fa3bbea104b771bd14f6d8329649d196a0598a658099f0f32d733be71d0aed8076963fa77c8bc0329ec68e709e8ef78f8b4bbbe06a345160c5220b
SSDEEP 24576:yZu0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ULNiXicJFFRGNzj3
TLSH
T1DD45129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8481679f58580e5ce65584d3aa63abe5e4d8c1776894d72e44a38b8272816fcc
MD5 ffea1028b6abf338c1fa173d7c0fc81f
SHA1 8a4b0c573db43bf2c98b3a938f4d20bf1c658c6f
SHA512 adc18e0e3fb53b674a3d4cc00a32dfbf808eba04bb22362e263679090a90fc3b0db66a04486ad1c7f1fd74e6aedb783e578d790b3917f24cda816760f5efe3bb
SSDEEP 98304:YQRQyi36YOcPDLvw2gAf+PN3H7wRGpj3:PQyiKanX+PNLF9
TLSH
T1A9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7ef95bcfa08c86cc85f66510c3408eaee95b1b0c19c226d96fa55c51112419d0
MD5 09339b1395747f6f92bbcb2eb17d6aec
SHA1 f4f373563507fea8a788a74d61150f48f5e72680
SHA512 2b1af01c20ce28b939cc09f6782476596bcdf3a6b8cb072ec94e76a7a6b3a9b2c3e178a31d7f64eef3c066edc97bd8e2a7113fa63133de35f548d08a324ad457
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3H7wRGpj3:vQyiKanX+PNLF9
TLSH
T1B7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b018e0b7fa03e32fc57bc971c6f826279fa42195a61af70040e7c407f9f2d676
MD5 517d2a902fe8fc1d411185d07c7570a1
SHA1 6fa796e1eb2f749d7fbcd9c0c045e13bd5a07ce6
SHA512 582451762a66badc942b898654c9b5d4d000784686ea7f65c51494b082b3979081a255641afb950c7a17849ed87cdd38981a6289907188a53d63febdc96d5c51
SSDEEP 49152:T68Qg55nhkeWu7PNU3/xLNiXicJFFRGNzj3:NthTRc/x7wRGpj3
TLSH
T170B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 75192dbb6cc444ad55122a5a13e0f8344a7ce7a5b35725a7b9e76f7d8abf0840
MD5 f6c9c3657ab65e05417566d85a028ed0
SHA1 51a8d88953d3b3fc9a473b2af4fdab06c1ae2a7c
SHA512 7546a2332e3d40e500f6fef5d1bd690cfa76285b72a345511821f811a31fe4557cef52586069a5dc52e8da3d33b00e1cd985acaaebc4741dc6253c07c5032e30
SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZo7wRGpj3:iLIHRWhyF9
TLSH
T1E3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bfda63148efee01f1ca3c0201fe3bfc027d4728cdc62c30c623fbb6b358c9f49
MD5 c54e66877ecccb487e249efd1c9ca645
SHA1 7055bf75ce479716a14ccb248f7925d7755568b3
SHA512 1a3ddeb443acc75e3324f9855254a63a1019082f78b4d18585465e7894c2eca52faf43825c729d5723eb65470facb3bb8c78c3728d614b66b4489b42d4e610cf
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3LNiXicJFFRGNzj3:mu6JmIxd2d37wRGpj3
TLSH
T152D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 535df327354233bc1f625a4a179bcf61e4aced7826acb06b8e2fb2b6836847c1
MD5 3127e24770633a8a1806d10c0e20d421
SHA1 370b964b73e9310de7ba74a7d17503d4c97229b7
SHA512 c197f63d2636728d038b8fcef61ebe30c059dbabeebcd56456acecc6dc11198d0b42402d6f275f0a0e0dbe6f3d481e10bed0b3e19b2876c749bdc7e89c447740
SSDEEP 49152:D1hpsNoJpF1A67U44CwH7R4xzLNiXicJFFRGNzj3:DmifPqRm7wRGpj3
TLSH
T1CBB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9b4e1b24773e6f8e72a61e3561b510867b1678fb246232baa9c85c41d4b00ff5
MD5 89a1ff9fb668b589b215503e7efff083
SHA1 d25d29321c7f61430824d9b3e6a1527214583ec3
SHA512 931746cd275056e4df5177511558cd09f4e7689ceaa4f7acf4ec700d2eb02e8ce708c584f2134f7355e96808fedfdb13f47bc228aa87987e2942c13bd217764f
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHq0LNiXicJFFRGNzj3:t5dKqi6107wRGpj3
TLSH
T102C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 60fb5f9599b729daa2be6f1e21b0edd84a419242f37162097d1cb4cac7abe651
MD5 f50da326c6010d6bec638a65ce3a8c32
SHA1 d01ebc5b9aff0531093fddfcb87d0ce3cf96e517
SHA512 464c94a2eb4ae52416c204c21c9d43a158900856b012938cbf744aef1a297ad644c9bfa8efd3e05a08da7d426b928b3659b344ec61014fc77d130f80a4e470ef
SSDEEP 49152:KhtSn8EApI0figjgiDn0AP5wfLNiXicJFFRGNzj3:rX2iWpha7wRGpj3
TLSH
T1AD95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 46b425f49d244a8e6f3a46d54115d59ed5f8f3000503fd104ec3608873d41fef
MD5 7668aba1c084aa9d437622eea81757be
SHA1 2c5e4d4eae76fbb615bcb2a8e8ef7152c20da510
SHA512 4ae9f161d630900496d0f79d01f2930812a099ee4666d849bd5847da3dd78d3de5ea025e4832f7accc81278339c9871d47a7a1ee56a26644b6887e15a40d7937
SSDEEP 12288:vmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A4523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 58cb023e85aabca68d300dd4bbcfdcba30e49c1e7720d99677c2dd267494d37e
MD5 15f134c52f7e5f3e2ff7d4d4015cf27d
SHA1 e802cee9c62bd97a459813bcdea2f44563356ea1
SHA512 df7f4c296a817d0f7b72b1b10229a71832db10463642fe6c4c5c8a33925dc8c9d47953102bcf5e0e76ded15b1671feb2b6683dc463a988e81ff3d2af47a7cf68
SSDEEP 12288:uxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B4523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 1a8b968507ae0b3a878137a8abfc26c46f3ea828f39ea7866aeb32f948332de0
MD5 42355b019f2f3b1fd8da95e7ea66f756
SHA1 818856e0850aa3eebcf0604f442fb107e4437819
SHA512 40a1163b773ae34ea5684af7c4f3b9a71d18266a8fade0b5bad8dc58e662c7e0d9b5b7cf681220751c2b15214b21fa7d5cc377c4a2a133323433960be166c1fb
SSDEEP 12288:CviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1904523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 df020ebff56bed80a14dbc2707a81570db5e921b86e197415eb8a6fac375095d
MD5 3bb96168ea22689ecb5cb6695e8c762c
SHA1 838647d85986bc330fa48fd5454414b589f6f75f
SHA512 569bdea9997f9cbc7c8ccf774129e3c7269fea69a8f82f363ee620729643c6569581eaa32b7620480bce86b83ea1ec76e17c6505d134257967df3cb80f9ce20c
SSDEEP 12288:KVciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F452392168901F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A74FEA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 ad5527ad6b6dde84c992f6bc26dea3511b99c2918242d3ed3ab449aad386b742
MD5 5244b030ad2d26726721b6b9a6e5fc38
SHA1 28bc3f1d706975fb056d31cf1fe6222b1836fc91
SHA512 7a4f862ca735ef15d3b071d7387bfade3386519f49194f80070511d4a0819b3329f1e3e7113cc616025124a75bb1c30bbf60d0d1328520ce3425ff2770d6c3f6
SSDEEP 12288:F0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1974523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 327be606eb083523e3d87c0031d85e03bcf9390cfc6e25c72a8b198e734f268a
MD5 9f1911ab9c6f047a660c9e257fc293e3
SHA1 fb060d05b07a7c9f0d4c28b9c5c9342077576a7b
SHA512 85acd6a25975917a414002b3361923ed03f8bcca92cf1c582b6a00b11802601203b95ec488064ce726fbfa06aa30e4fa2d29048f80529e9f8065008a3b7f45e4
SSDEEP 12288:hliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1714523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 a7a8a92ffcccb6573b23d1128a96b4de2ccad3587dfd5ac8e3ddbefcaed1a476
MD5 50add3ec3bd19f322af1ef90e857bd16
SHA1 90a153129d3821d1339a2c903c76c2d3804b9c96
SHA512 b94acd1217eb93fb9490871b7e43e07e67a7692f033299baf222a96b1cb968671f8da1980526134a66ac84b46a2a8b937010f530c977fb13a40d5876aac399a6
SSDEEP 12288:rJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF4523D3548955B1FABC003986754428F5882E2DEB5619E3E3083D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ee933a39046857922a73df33cec882087681ad595fabe540be12da75e407806e
MD5 98b9258fdffeb2dd208231d9df4ef32f
SHA1 7398d34250f97d6411cdf28a193f0a32149c6160
SHA512 42f0287a806f658295a7262ec4a345d17b86a78f71d753ddf023a99022a334d35319c58b8a24180f10c26e58560e3c254cd22cd9955b17a48498a8c169b5f7cc
SSDEEP 24576:ZZM+zFVSOd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZZM+zfZLNiXicJFFRGNzj3
TLSH
T1EB650295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 bf1aefe389ded977d894d5b21273acfcd397af068111be42ab1945f44e2a44d4
MD5 1f4b61c69fd8ce2d8a885113245f2426
SHA1 44b9cb0db8c6b7142b5abf3bd98076b8181be8cd
SHA512 2e10512891fa926dca23c45d5c1d79a0f4bfeced6acdbe8a40b928a6a347542c0e22da686f96ef0393371f096d052efe669b4409fa789b9f7382228df594e77d
SSDEEP 12288:YiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1254523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 bef274eab2e3d8d25b9b564ecbb6927db04b93b3ea7adf677b28c07dab81d451
MD5 f7653e138ccca00e7af1189183a4724e
SHA1 ceb54f695b354328073047fcd85cde6004282fbb
SHA512 13516593a537546671ba51f6bc7c3c525b5d11ef104915a59d2c524ca80d65063ebb9860ad70f3f1bd5787f4cc9010ad84c065bfa71417c63b79dd37081d7003
SSDEEP 12288:duiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D4523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 91dd7ad847179ed4a91385452dad6da0efbe8a22f1394c4ef0632e072d26eac0
MD5 cefea7d8c41be18914826b828068675c
SHA1 d4dcc508f1bb2faafc7225d97409e85b1f290f29
SHA512 dd3f18beab14d6c1c6c3e69e2329fe6c87f7f6b14529b89ab3d2f68a9af0e38ded6954605bc6b1895cf84410eaa73ed6b6e8bbc77c885992c67bb8be8f8348b5
SSDEEP 24576:QzyR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QaLNiXicJFFRGNzj3
TLSH
T179550247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 5220b2d1254082f2f7ecab9615044543442ba0b4377d750933783bb3d6021e97
MD5 30cfc2d57cd3b13e4fa48db4f34b074b
SHA1 464e4ac02239e6c37479f589e97c2a3d61fad032
SHA512 cd48b0a764c2b17d34ff5fea8e8d9838daa3fc8ba7a22c2ab42b148a0b97c46556884c047876d881a5ea7b303c2b8a4fe9e372e3fa9f3dfe94d251ec2cc87d26
SSDEEP 12288:fiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C44523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 55e6d280fa66c4fe31455af28f78a8b751838e4e9bbab39653782574a7524c77
MD5 e9d79c6b8dcecdb836308e690a80970d
SHA1 9e5838622df8fe3575711746db7d3a5af46b337b
SHA512 34d5cf595551c4886e8cc7dc848a72ffb4512f0e488552fcc9b63b9c26e5609a04c719634647cbdbce0166af373f25e08d17b1b4d4b9da7aceac883441514dec
SSDEEP 12288:YiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1754523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 230fda5f5b76ffc86d4ddb0e8151be900cfc7ab4ea59a1eb836e442b9792235a
MD5 97d4918cab609e5bfac639f8d9392951
SHA1 0978e34ba6a3e868eb1ffb6bb3d4c4e3516e6fb0
SHA512 385ba90dc180b3265ae9c2e8b857d5bc3743639a992362819275c4fb178d352eb124a4bfb200a43b8331ef2819bdb99b5d1b942351a7a63c393ea5e3c40c4867
SSDEEP 24576:hzyR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:haLNiXicJFFRGNzj3
TLSH
T17F550247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 0b99a726bb5cf05c20c5ee29efe815b39bcb08e62abf5104e9676405c4de72fd
MD5 2252657e296e3bc1af76dc4bc29daa39
SHA1 7474ed1d0458d5df488b7b75ca90da5ab8d3ab62
SHA512 2899f20a03cdc2e80f50936660b3b529ea7362a37d208b6268849f5a5502774d89c57a9bc609e3f23febeb1215e658b856c76c704050f021da6e6147fef86325
SSDEEP 24576:+TjaLl3z0zDr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+TOLljSLNiXicJFFRGNzj3
TLSH
T1B46502A5B39018F4EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6e156ead10eb3eebc8e773419cf4be34a1f81ae1c5d78b7486759ef4afed9666
MD5 35a760399f00a498469cf71e4a7fcee1
SHA1 067c9e30bbac2dce8b699ee04772af4e19bf888f
SHA512 1da454fa332588f854c3688e94af97193b546235b1ac55b94866724cc4f22279d6ceb42e96c977869c2c259c10689ecf6d54ef8ef42555f69fec6307e4e2bfe9
SSDEEP 24576:z3Yd9CHKy7GZn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TYd9CHKyaZLNiXicJFFRGNzj3
TLSH
T13975CF90F3E414E4F1B79A3589764511DAB67C5A5B31DE8F03A8261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 e53d7229fb84498418854f199ff159e38cde16f5bae8609368a6842bd24b6075
MD5 d968a66f7d6e1a1bef367b203f2fe658
SHA1 7788a4cea00c0bdb7380c00cdea1a5b31bbd246c
SHA512 b0883a8ab94d8fc2ad61dd2d5a55099fd5d44909ec947484a76883a83741bdf2671a545af166d9a00aa05120dd5b151c55667fb77e0fbac205b2cc1a85f583d8
SSDEEP 12288:fPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C4523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 f01a10af100958667b77f89aff26b902c7f0345fccc379c72462fd000067e715
MD5 3bfecd50ff4ad197b929b1c58157ca7f
SHA1 6d220864459d7268033a2286f69035f48d726d6e
SHA512 8e37478d9f9ff45f8346a5530f057ecf56d4960e2b233c34d1bc1534931dc7dde9cc7bea35660892c1e9514f52ef7ec61ce63bba573970d8afb5388f366833e9
SSDEEP 12288:ttiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1604523D2558955B1F6BC003986764428F5882E2DDB5619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 30f404c339cf7b096d4ff74a9cfbe83040eee6f74296e17ad4de495a503ad0a0
MD5 ed216dd3bf62ce67885f8e004d12dd5e
SHA1 257973f8967632940f1328e37d3a6618be211647
SHA512 9ab8af5cdc95dffb091cd08bad40180c508a1c76fbd696eb569088e8b4742772efa487e0822cdbf1b63bb4b0af4357648a7c311637754e08feed80f4d07c11fc
SSDEEP 12288:84iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE4523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 411802530806bb225744e0eeeedbb4e46d2af9d4f91429119a2320f2fad540a0
MD5 4731abb0b2537b9c3a4c523197636e1f
SHA1 57456da7d14939358676d320f3758f5ab97129bd
SHA512 13a17b59ff1da24a82fdd9df95da66ced9ac242b25b2a833fa9c87aad60427daacc84696dc46cd9f6c9a55e5f47d382d1027ad6c5c2f41026e41960829ce7ee8
SSDEEP 12288:siiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1434523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 862cd9bf31a1554a155fdd4a146b05a748a2130f5267b8ecf7df6ab7d2cce266
MD5 7051e4b3607fbf948211400cbe80dfb2
SHA1 796b6ec2fc191c69de42ce736a256f3e14c67257
SHA512 3210289b00eb349ffb58f3a381b2308e4ac7c8edf43697fe5b4f72780acdb1801dbf76023ca97794271a0fc31b2315661dc4c33d2cddbaaa4d40c4a5678a048d
SSDEEP 12288:JPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:J7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D4523D3548955B1F6FC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 46124f8f6566108df583262505d9fa13793a5d76c893f286929073641dfa6846
MD5 ed701ed9e38ca19617d0b20e98aabf0e
SHA1 87e0d1c94e077744c13e71be071e00b5310a821c
SHA512 77f79f08046ced8a6c907f649ebbfc379a90c33f2ea78a5544909d56c9f8ab4bd5aeb4d9bc247421c12269147b8a31ee080c82b1c6e812e73f11451e3cf79f6e
SSDEEP 12288:OaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1444523D3558955B1EABC0039C6754428F5882E2DEB5619E3E3083D1EE278FEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 3a1d646d21784081b00867c18df42e8423df5ab6c5063f930743dddecef91700
MD5 d7d50f72aa996c2373e1d503fdf75e19
SHA1 bced9da925e8b7268578821c79f2ca1557afd0c4
SHA512 d4d276c0e74a01cb01c9863e0b867de1aff78e27b3d07606aa9c924c3210db6a32d278d310bb67f151f9ede61f96bb997f9e94cd7484b2ac0810f110f29eae9f
SSDEEP 12288:K0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ke/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13F4523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 fe3bb1c8f4974971dbc1ed661e1ff899931bf9c5e2876b38b7c04e0e629eab3a
MD5 b088d0940386f81be9399a7b1f9e8d8c
SHA1 cc41d3a285885940d73e033814f39521b27930ab
SHA512 40e0f533958a7382ce4ff7e9523c48b9d1920b8ddd28b211ab31bb3767acf00e9a7c8281e0f5284dbc8c262509d25c15e5dc3ff5e0dcd70e935853dddff63279
SSDEEP 24576:Kfwv9k9RX6wkyAII/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fMnYIILNiXicJFFRGNzj3
TLSH
T12C75DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eab42f9941a9ffb58cdac7cdb91c9cb9de719145917fbf1b943763fe9768a868
MD5 7936113ca54a33a9ed9e203173f57c81
SHA1 45c17101f95ff59c80b8c5e701f36a9a93569109
SHA512 c2b00375db474e15c4dfb2bcaf5e52bf12b6d1fe0b70c6d2d74eee201734d757e9345386fbc0749d2df8667e3c05ed601c50869fd0184920b9c20c3c2368cb9b
SSDEEP 49152:cYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/LNiXicJFFRGN:TySzPn7wRGpj3
TLSH
T111066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7ee5682bc433722c9f50856c60fc3f80896fb105185dd07b27ce281e8255f098
MD5 93106cf018026a8ca438059a977a1570
SHA1 35825525049626a3f6017c36d14b75c1f60f6708
SHA512 b8be03e88c8a48acdfbf4a8e482ed9151402b78552b6dbd2802f21f3688dc7c95da1306d4bae5f59e9e3f7e7ea9b97ff7f5f72bec1a1fe0917f96ba2412caf5f
SSDEEP 24576:447Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:447JUQjqirIhCnDHUPfF/vLNiXicJFFS
TLSH
T1DF65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 15ca8a0bbd1723b28395a182df1b710e999136d46cc48cbdadfdf407041b75bd
MD5 a7dd18002ea67b09ba20f83074e91461
SHA1 d81dfaf659f03ad80481c876d67ef8d86296ea17
SHA512 1763856eb1eca65bf558a37193f09cd4dd50359dae5793deb8b7c1619a4f25c81495e6bc21d559a2271c43be536618de139753e441d9f227195311891ea06094
SSDEEP 12288:hYsfSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A655F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 04e8de2f4b0918cb80f6524bc227c1d415c63e6aa1abf2d7bea2448680752944
MD5 10d7491cd37b3b290d564a13c3a2e90f
SHA1 85f153fc8606cff8e8755f052624bc52a8de164f
SHA512 f481e30604e64ba0550923c392918caa88dab65c8e98258a179e8672c24996b0749fdd841801a060a7e7a07f00409a55d01281508d2adeca362d052709241343
SSDEEP 12288:dUhdJU3fvfapvaHPJhwU1yr6sOqtiykRMXMIIZH:dUhfUPQvi5a6sDtiy+MXMIy
TLSH
T1DF451640762AD78FC6A950325E36D2CCA7707D01FE05AF0773C8873F9476669B6B6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 034f0121cb440a3c1786022648d4a2539355e8ba438aacc8f89d31cd37743974
MD5 50f3619cd93ca8320daeb63d345e5b35
SHA1 23ecbbb85bfe3d5e5e0b843b9a6c8c7a818d592a
SHA512 2e2124a9d1ec33898cce58022009eda5df02ef3153529d2369bd0eb1ba2e324d72140ea20efa8a60169e0eb8dde8c5268d93f0e969d4452fee51a3c4e263b269
SSDEEP 12288:Nkf0CkeDPuy5J+oz3eo7QRI1KocMzQKnCga0Ol:Nkf7PdLFMecMFCgfOl
TLSH
T15C452B41A5B7E35FC9FD50330236C68DABB49C06BB463B0573408A3C987767EB5E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 173e279b7d3ba61d02d1ea1026469ff217294c8cd328ffce7d61d533ffcaa197
MD5 a90103124ab10da840d3a252ae7f2f2a
SHA1 edafbf51522429d3a4dbf711a79800651a2f404f
SHA512 79ebd71a181329b76f130f3663c44326511f3d09ae72e6a3348595ba50ec81e9d6f122597ef587450b8dbfc51f8f82c89bdbe6600aab8d9962a137ef7424a15b
SSDEEP 12288:w47KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1574523A3468D59B1FAFD1039857A8434B54C7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 51aec0158eba6e0a195743ddea60a5f2acd02086f72391789f6d60b2378f1839
MD5 17aaa5f7ba9a5ad75c37dbd6d6766962
SHA1 f7c698d5a4955adb1b783a74ee04737933215b1c
SHA512 98c8e8990d50b3cc59e687cf2e27b3f98a9c22cdbd2408b86c60a4ef68aad4779dfdb5a8dc2057b33223a08e345810c33e2069aed500b55709631d28a8e45123
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Rgb4mBIBhGFNLNiXicJFFRGNzj3
TLSH
T1A165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4cabe14db3d1d1fcb46427b9b2eb4596f2c648af12feb9bd3159a41c8d7c01ea
MD5 bbe332a183aab0dd3f3bcca43bd65640
SHA1 bec0355a97ded064da74b9bc9247b1384028ba4d
SHA512 80cec1a3147246454cc43d8ca0b4e7583532f04e4a7dacb99bbc8f53056dab46e3fc22462403f61382ff6686e65d5c300afeaa8b7c2ac3962b15f45a8002537a
SSDEEP 24576:3G88u8FpJqH18zria7/md/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:27ZFPqVba7/qLNiXicJFFRGNzj3
TLSH
T18085F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 50a96e80a88067c56aeb5989fb36ff5d46a6085394b26a729cc9847c2446754e
MD5 bd1012751c294acabbb24043307dd1d0
SHA1 33faec243e05d1874ec58ab2f72f7ee275dfaf7a
SHA512 2d09294f175973daf6105afd050c82f863c06809f6caee1c4fd86094b7381fc02efd6d4c1116cd09a4e5cebf2f684f5bb2ccea159a4325b05a52adbd07ab58b7
SSDEEP 24576:zPUr+NQZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zJQZLNiXicJFFRGNzj3
TLSH
T12D65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 00b25d45dc61e37504443adbebe941da63990cb6778cc418accfce31402eb9fb
MD5 196f366e995c08855d6fa4d685e92156
SHA1 ab313380aadcd6ebfd9e2e8c0093ef281cea44cc
SHA512 82f007223abe42c2caff685717e6fce5712a05859d34f9753144a2b108f8f54315cb129051309c1e818d03109b3f276b284db08ddc03d325c6ca0d2c5d6c8d72
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpLNiXicJFFRGNzj3:SG05lO43bA7wRGpj3
TLSH
T159D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 69329923adf5feeb1fadd344c15c4a9ac4b4ea439dc428a7f5f1b31d4fe11868
MD5 61831e7bdc8e8c8a903fa78f5cf6e5bf
SHA1 7cc5034d5b9cb36583f001fabf58ab80d5c5ab4d
SHA512 0788ddc8f7613a14a051bd11b25209baff7cf9844b1207c41d035b960e40baaa801e478a537cbb80e42ef0de4fc479b366b9504fde542fde4cf72f3f07637c6c
SSDEEP 24576:cfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn//TwSfVcYG3K/cJHlnFR+IGNe8jg:Ea5POZ3lJt2pasx2+mxLNiXicJFFRGNf
TLSH
T18B65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a46d5fcb96d5ce1185f25284e31a18f15f7e7e6259798776b15e1f1a1bb22e6e
MD5 41ceba62d2be9838620c9131ea3d3e5c
SHA1 593f540ceb242a02d5163f6222796272008d4ca9
SHA512 53d7f0c29eb7ae66a58416cd96b09a0d7fe4932d1e0a13e80d30f46ef809e5c95bdb451fe73f36091245fc647ecdf5e6ea87f9718dd99e3270e591230c723cee
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7Fkl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Nc/zEOVHFKLNiXicJFFRGNzj3
TLSH
T1B1858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7aab0dd9c51a81fb3850524a5e521a1868d9b29178781979056791a2554258da
MD5 50ea94c02dd1c6c5023bc1c3c938b5fd
SHA1 3e07939b5639a41f6460daebaa30a449763db459
SHA512 bcd8685d5389ce344f40a2e7b08708c12e4e8211864364d23654e6941bb5d0a999a594c650c1829f4830a431309b3ddb60bd197add94e91780297c225140b12a
SSDEEP 24576:UzkNvNnaFeYhJNtmZBmb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UzMwBtOmbLNiXicJFFRGNzj3
TLSH
T18E55AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 4b225583f70c790a6dea5623bd0100113671bc06a14b317297aa3b24220414dd
MD5 5b71217077f16f93e87995aa06421bd9
SHA1 52f2abc22f9f17c2ce73f15287e23b2bf4f70077
SHA512 cee950f4b77d926dd0fca9cbb2b69621ec1323cf947998db25dba8f1b6f196fba93d2455db68837105288ee19d085689f92dc56da252f419b708662ecd4cf3bf
SSDEEP 24576:9D3FHshBIYQgAw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9DVHeBIAAwLNiXicJFFRGNzj3
TLSH
T10A75E17EE69C04E4E57AC17CCA638906E77138AC032265DB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-96-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1052-331-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1052-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1052-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1052-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1052-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2020-85-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/2020-311-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2020-80-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/2020-79-0x0000000000400000-0x000000000052B000-memory.dmp

Download

memory/2508-116-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2508-114-0x0000000140000000-0x00000001401D2000-memory.dmp

Download

memory/2508-314-0x0000000140000000-0x00000001401D2000-memory.dmp

Download

memory/2508-122-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2612-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2612-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2612-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2612-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2612-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2820-1-0x0000000000C70000-0x0000000000CD6000-memory.dmp

Download

memory/2820-0-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2820-15-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2820-7-0x0000000000C70000-0x0000000000CD6000-memory.dmp

Download

memory/2820-6-0x0000000000C70000-0x0000000000CD6000-memory.dmp

Download

memory/2988-329-0x00000277958C0000-0x0000027795A8A000-memory.dmp

Download

memory/3464-128-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3464-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3464-134-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3464-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3464-139-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3736-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3736-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3736-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3736-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4268-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4268-23-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4268-17-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4268-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4284-75-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4284-69-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4284-67-0x0000000140000000-0x000000014015F000-memory.dmp

Download

memory/4284-309-0x0000000140000000-0x000000014015F000-memory.dmp

Download

memory/5356-103-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5356-109-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5356-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5356-315-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5356-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5356-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5400-51-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5400-53-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5400-48-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5400-41-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5400-42-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5428-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5428-63-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5428-62-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/5428-295-0x0000000140000000-0x0000000140163000-memory.dmp

Download