Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe
- Size 3.1MB
- Sample260916-henbpsgk4t
- SHA256 40197266a36d5f1633c4fa1a0b13a947a8d0c685692e007afada1fb2e01beec3
- MD5 20636b4a64d1b3dc016bbf16746aec7f
- SHA1 c9f73c28271d78995ae28f93a34c764b546ce4df
- SHA512 f6a1c8a8e674a52061272ecf7556d101abf1fcca2d9ec3019de78efd0dbd8cf0e1ac056b8851502089a15af053584caa1151ded623bee02057649dbc3fdf07c1
- SSDEEP 49152:RU2MotRHZy0trDhzAAwPjtpTwTzQtInKCbshwbpaNNakJBIs7sH2up:RjMov5y0trDaJPjtpGKuSakJByH
- TLSH T1E2E5BF90E7C4D1B3D1414670C1A66BB49AA4FC32FBF4899B65A13F2CAE712C3762D217
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 2308 elevation_service.exe 4764 elevation_service.exe 4348 maintenanceservice.exe 1324 OSE.EXE 2100 PerceptionSimulationService.exe 2132 perfhost.exe 5732 ReFsDedupSvc.exe 4316 SensorDataService.exe 4684 ssh-agent.exe 3240 AgentService.exe 916 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\242566ceb68fd3f0.bin elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da2d5360a645dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d83cd120a645dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6e8811fa645dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e90b31fa645dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006966cb20a645dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091ad5b60a645dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\TypeLib\Version = "1.0" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\TypeLib\Version = "1.0" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.clsEmpty 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\ProxyStubClsid 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142}\TypeLib\ = "{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\TypeLib 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\ProgID\ = "wPrime.Calculator" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}\1.0\0\win32 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\TypeLib 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}\1.0\ = "wPrime" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\TypeLib\ = "{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\VERSION 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\Programmable 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\ = "_clsEmpty" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}\1.0\FLAGS 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.clsEmpty\ = "wPrime.clsEmpty" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\ = "clsEmpty" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142}\ProxyStubClsid32 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.clsEmpty\Clsid\ = "{18C921A2-1602-47BA-BA79-DC5065DFDB36}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\Implemented Categories 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.Calculator\ = "wPrime.Calculator" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142}\ProxyStubClsid 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.clsEmpty\Clsid 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.clsEmpty\Clsid\ = "{18C921A2-1602-47BA-BA79-DC5065DFDB36}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.Calculator 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.Calculator\Clsid\ = "{C78A976E-DA6C-4ED6-876F-6060D822E4CA}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\ = "wPrime.clsEmpty" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.Calculator\Clsid 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\LocalServer32 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.Calculator\Clsid 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142}\TypeLib 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\TypeLib\ = "{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\VERSION\ = "1.0" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\Implemented Categories 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142}\ProxyStubClsid32 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\TypeLib 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\TypeLib\ = "{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C78A976E-DA6C-4ED6-876F-6060D822E4CA}\TypeLib 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0E21E7A-2A9E-4CC3-9BA2-762798021B4C}\ = "_clsEmpty" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\ = "wPrime.clsEmpty" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.clsEmpty\ = "wPrime.clsEmpty" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.Calculator\Clsid 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\ProgID\ = "wPrime.clsEmpty" 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142} 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\ProgID 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B3D74BE-7A60-453F-8618-3F12FA3B9142}\ProxyStubClsid 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B77B8C8-44B3-4AF4-9551-3F4EEFCFC44A}\1.0\0 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18C921A2-1602-47BA-BA79-DC5065DFDB36}\TypeLib 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wPrime.clsEmpty\Clsid 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2308 elevation_service.exe 2308 elevation_service.exe 2308 elevation_service.exe 2308 elevation_service.exe 2308 elevation_service.exe 2308 elevation_service.exe 2308 elevation_service.exe 4764 elevation_service.exe 4764 elevation_service.exe 4764 elevation_service.exe 4764 elevation_service.exe 4764 elevation_service.exe 4764 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2976 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe Token: SeAssignPrimaryTokenPrivilege 3240 AgentService.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: SeBackupPrivilege 5732 ReFsDedupSvc.exe Token: SeRestorePrivilege 5732 ReFsDedupSvc.exe Token: 33 916 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 916 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 916 SearchIndexer.exe Token: SeDebugPrivilege 2308 elevation_service.exe Token: SeDebugPrivilege 4764 elevation_service.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2976 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2976 wrote to memory of 5072 2976 2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe 90 PID 916 wrote to memory of 2884 916 SearchIndexer.exe 102 PID 916 wrote to memory of 2600 916 SearchIndexer.exe 103 PID 916 wrote to memory of 3372 916 SearchIndexer.exe 105 PID 916 wrote to memory of 6036 916 SearchIndexer.exe 106 PID 916 wrote to memory of 564 916 SearchIndexer.exe 108 PID 916 wrote to memory of 1656 916 SearchIndexer.exe 109 PID 916 wrote to memory of 5892 916 SearchIndexer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry.exe2026-09-16_20636b4a64d1b3dc016bbf16746aec7f_amadey_coinminer_elex_smoke-loader_stop_wannacry /regserver2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5072
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4348
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1324
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2100
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2132
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5732
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4316
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4684
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2884
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2600
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2616 2712 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3372
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2756 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:6036
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:564
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2616 2712 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1656
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2756 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5892
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4808
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d4f4b1c5a6f17971250b6aaf8c61f25d752d5a254c776640996cb33d8dddd2eb
- MD5 46cd9797b650b99a492a545f43965b3a
- SHA1 21fb115f597bbb4b74e3aa595b45e7bc7139757b
- SHA512 1f45bc66f4b86b1da2d86413079fe28400f670a2c403e2a506e15e84f6db7cbd1a2bf35e378f2c2d590d5e767c5fdd165a21c21705b3a6db6fe0dd06cebf8b87
- SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnUaNNakJBIs7sH2up:i3q6HjBpSakJByH
- TLSH T1F0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 1272e50dd758895929a6b02b45b5186610cf97ec9eb9b353b8f6cc1e66f80aff
- MD5 f754cac97c5147f6c2f2d1fcab259426
- SHA1 9cdb3fad124b3724b3fd47f3aaf844924f0fe26b
- SHA512 8c0c21f145145e9f6dedcf4c2f7c9db92c5ce4f44c08ed068950123f51f0ab71af34322f69dfc460e365c859fc2324c57aab649c79a0626d430a90d28b6f8a17
- SSDEEP 24576:fXYfDtczAptRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:qtc6aNNakJBIs7sH2up
- TLSH T13A05F12963D408F9ED27C27DC9A28511EA337C4547A0E78B03E4A9265F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 cdf92024cdf702c08bafa266633b8569249928476b623ae6f5200e358ca9c9f9
- MD5 f585cff654e64df06d7e83d3abc3648d
- SHA1 4862f81beb64e684d238b7a570f445bb676b3faa
- SHA512 f92e920dceb126724572dbb4b095676b4d07178b31ccde133c1960c52e880b7afd33090f0f4a477858e64eeeb347473df5a3a0fddc59ebee49f85a8bac8d06a6
- SSDEEP 24576:B0Le5ji0hmxirM8tRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:BPji0Ac3aNNakJBIs7sH2up
- TLSH T15435AE16F6748331D073C0B9C5D2A69AED72308657308ACB4286D77C6F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 43c19e92f865a199b6c6826ec7493debd76cdf92b22884803e526b9806f47ce7
- MD5 22da6f83939b2e583e85cb30232ba2f1
- SHA1 b62d2ecae7e1fea5aae0ba56e9bc203042336125
- SHA512 7f62b794c2a51855ebff6cce887ff48a36dcca993776724a4c5e7ec62e840c181a354293597a936aa5781fc6fcf5326082b8901ec6973303072c820e04d29e5b
- SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyu6tRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:q/ezSC6vUzPvxHjy7aNNakJBIs7sH2up
- TLSH T13E755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 372c502cd9aa405899f67adfa75ca071bf26e2dde1db8b8d6185159bb7fd9f13
- MD5 65caab8198a7a7a9806f279ddc4408a8
- SHA1 39fc5b93b0eba5a9aa5e78c619deb873c1cc9c08
- SHA512 454675d3d22250c3328a883ead023e6da3f30ff05df67e97408baf198c81570d8798d6ba4a285a33185556a0c100ed017502307a1360524adb0d8aa6a6c96d05
- SSDEEP 24576:9VbqPb88hv/l+6ttRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:9VO88hXl+gaNNakJBIs7sH2up
- TLSH T1E855AE66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D72C2E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 175d91b506bbdf32ca3910a30c07ecc0a2053da423feddbcdd134151df108adb
- MD5 0f1a301cfac5aee3592c9871dfe9b532
- SHA1 83f1106ce9fbe49e3c9b535c0b858c26457d59f6
- SHA512 5855444cefca315c14906eaa18e01c35827c60e2489cc17c76f93cc5be9d4724b33a2a26db7a847789f8627827e2ffdfdf821c1472b0d320ab655d1acbbc6147
- SSDEEP 12288:zRw57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:zRwtRRRaN3IGNhe49y3zkJBAlR27CgwZ
- TLSH T1ACC42387431844C9F32FC7F9F2C60522AD235D89A9C5630B93E8BD274174BD2EABA157
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 e3e964064eed48d55cf89a41fbcde8580f930d7681a94b3103baae44ae934c26
- MD5 aa688783f36fef3cf21fc1e8008161c5
- SHA1 d4d8848fbd1dd1fa8b574f0096dd2d653806dc3d
- SHA512 59851ad38981bc49fd8677c57d5532bdf8f9dc4df02ee2860ffa6af366add80c99ac1a2abbbd29496d2c1ec0ce141618fc5a3042b771b8ada54810836abce264
- SSDEEP 24576:LJIUltRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:LJIUxaNNakJBIs7sH2up
- TLSH T18205CF3BAE28FCD2C27E8DB956918600E77278704F52A3CBD274920EDE235E15E79C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 0548538e15104957d3ce3bbc5177fa2227f7576cafac408ec84bb9d257954de1
- MD5 fcbcfc577d642e172cfb68072a2f58e5
- SHA1 7955acab43765a028e1ebb9fd1d88c0b363942ae
- SHA512 280e777f4a0c24d025fcb4dd34c188151069fac98721d7b65c846ae7b46f0bdffabf0755144190c4b50e004e888dbbf3b072df7f1015abc55e079899fa1b4cfd
- SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:LQvGAdlCEL8c/yRNw5CaSakJByH
- TLSH T1E1266C656BF880F5E0A7E178C97A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 80d360f80b27fec3733a641a2753dc9327d6867c163634c354443820ae224e0a
- MD5 5f2aad7b00a3b110e98b326892c125de
- SHA1 b2825bc3d89683204b144dd5347020c8b2337755
- SHA512 ee5643aa15a0f248c2ad69e40aee491f4ff37480ed467c188904979a3a11a5b47bcbf4402577142000b4315a781f3808bd8837e55f2aad6ec8b4bf5cbb420000
- SSDEEP 24576:JdewsAj7tRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:XljHaNNakJBIs7sH2up
- TLSH T1B415E031FA74E036C37F0DB66B66C716183D79204B912AC3E3E89D9E49302D26776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 0341ecb1ef4004905b38982bbbdff55a1e7152136a95048302c270470b91c219
- MD5 de298c15f55cd413ce1f34a4a77cc8d1
- SHA1 3e503f3cc924591f9d823afd83b4714e8eb53051
- SHA512 3678ef9d6cc2ce505b22091de5f462e8738f69baa6175061c6298d83da310444a3ac2f76e7bd47eb3e2750cfd87304a0971dd77aa4f45f86892175d19ee7c6af
- SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwS:gUEtQevvqc2W1cpV2EI32w
- TLSH T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 23c6e95b576ae15730c1c7e2b4ea15a16090be7c24fe19bda4732d4f190da811
- MD5 c261bf55198e050965da1cbb436ba991
- SHA1 6c5ab73bdda83711a556b4c2ddf6cfdcfa4b02c8
- SHA512 5a35b4755ae398fa4a4fb5f76fe8aa6cd67e766fdf47a7050f28ec6b861d1e1d4f9c2a19110c5fd4f23089aeba09e66d127dca890c4714587e1fe2e0c5b941b6
- SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/znaNNakJBIs7sH2up:SoqtVjnmuSakJByH
- TLSH T127D58D0976B882E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 6ffd6ceba0910b05425e1f83641a73461b4586c5432750e531315a8721cd9a5b
- MD5 17cb3d3a708559f0f13f48b63a2d651b
- SHA1 668451c72f8e1cf1f128bc6592c0994ae6ebd922
- SHA512 615e78e487ffa7286a66c58155c920ba22a76efb66acb797ac16bfc33a122f0d9fcfd180b197c7d2d5e58f49831517e52b738880e710811f7069168ae13083ec
- SSDEEP 24576:hAhGLJIFoiwtA5l7S53WtRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:hAMyFoiq5+aNNakJBIs7sH2up
- TLSH T189359E81E7F945D4F5B3AAB899B68171EA76BCA65E31D20F2250D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 dc96df60667a6975f1b473801dde5b2d8608b1370ef33235b7a718ea954fa72d
- MD5 0646363865fc2d3da2b33a74cc66f527
- SHA1 0362652b36b08ddedd2087cdd4235929045a1ea5
- SHA512 6e14c40b5837e22dcb328b9f7cf661713d29b4b83d3d636d961bbca4f5f6d2a833445f28100c25e61cfdb93544a0efd0029782f854f273c5734447828be500e2
- SSDEEP 24576:3wuoOWXtRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:3wDOiaNNakJBIs7sH2up
- TLSH T11B05F14663A80CF9E5678679C5878132FBB3BC062A65D71F13A0CA1B5F33361AD2D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 9648a279f75d307c6442404fe24ed5875065b6834fa08034b29aa2b66b7435c1
- MD5 bbe971d419bf3acb43b8c3227da2e228
- SHA1 95f9a8dcad03ddfaec713c5c476c8b7f061c306c
- SHA512 074ffd9473a0de149455814e9d666dd235746e11078ad72335d669ca548fd5991fb78513535a1a2fa2356bed2cb4e5cd05b4a36bea473f123b99fd6ab99a5db1
- SSDEEP 12288:jBZ1IyL57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmY:NZu0tRRRaN3IGNhe49y3zkJBAlR27CgU
- TLSH T1C1E4128A239820F9E267C2BDD9D14601EB737C5667B253CF136469265F32BC25E39323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 570746cac34ff5f254a724f6052b0e4e9f4f05572e4dec91f8f95fd71de447ca
- MD5 2a2f2ecf73e1384b737480731b2e2f62
- SHA1 4e1ce8ee6b847b49877e1811fd814a8a0d9eda0b
- SHA512 feca148984a497e9b2d931cd1d0c0c1319987f0220cda3d273fe7600ad0b5443c0d5fcc92e01d38ec5e3c30238fb72aadbdfa1f3e55e8220f380cea5b698364d
- SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN3lSakJByH:NQyiKayX+PNaS
- TLSH T178667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 3d4fff8c2ba39d37f29d8551eaa5306ba84fad5b1e2a3fce24f8cfd7bc36e42e
- MD5 222e317a7f8ba73dce213dec8a620fc6
- SHA1 1a7c0e2f21431d888fe2447ca8a019cd551d47ea
- SHA512 a2d19bf50a44b3610a4aeceb0dde8f3885de463e1d9e9d55718d0f0979f1af16c617f0c2ef2f8e2411041f3f004b101a5151d6fcbb70c75ec164cc37d899abd6
- SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN3lSakJByH:NQyiKayX+PNaS
- TLSH T1D7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 5f1bba29dfcbbfd0f087c0d2c3aada49437ebfd00fa78ed93d852dd9f97eff15
- MD5 d6822f69f4aad69e28949f957317f4a9
- SHA1 53f4df737f4ab97d4387c665ed7621187d10449b
- SHA512 bdc313a0971de65e535fcaeae23849b345b8af5b373d894d8e3e54ddae0d19f37edbc9391be8eb6ed56c85454a1434ebde47797dacfeea3150dc45a5868dc1db
- SSDEEP 49152:g68Qg55nhheWu7PNU3/3aNNakJBIs7sH2up:athWRc/3SakJByH
- TLSH T118B55933B2F60099C04DE1769F4A873196D27C758FE0E3DB825572161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 1c5690bf5d6ccac0cb4fd14e04db1432d45fa770fbe693afdc6ff0fafccdd647
- MD5 670e912cf1cead38fdfe8294d13aa134
- SHA1 ff9ec70f881c20ff7dde0f4c385f62baeed2b970
- SHA512 8b47ad95a5ced997b250973284668b05a7aff57ddc19019599754bfbdbc242cf063ec420f2a8e8022ad64d0e8bbadf2ec4ba1e6d664abc1106da3f7e95813c80
- SSDEEP 98304:ky5112gYy5azzVvL69nLKnhZoSakJByH:lLIHmWhtS
- TLSH T193167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 9010d32d5d20bf2f856efe8ab71dbed73f3039efbe8735bcaf3137378147d6fb
- MD5 3e7b2edb64a52e712dae6dfdb30eead9
- SHA1 ae6b338f993cc0e8543f456643dc96ae2f45e360
- SHA512 a7a933d840f934b3ee49edd831ab6525a261d30e76db024acea82ffc59e9cd74b8c389be315b604828efe883a3b384fb6f8263ce5972acbd7e87a4b26864b233
- SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl9aNNakJBIs7sH2up:Vu6JmVxd2d9SakJByH
- TLSH T15AD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 a821d049bd968e794fddd4dfc68805473e1473426bc0cbd8a8fa89bfe44cb84e
- MD5 e5b329b15dfbf1aa7a56971de86f047b
- SHA1 fe9ce9281056d4bd7cdf2e834dfa3e47f712164e
- SHA512 c505cd2c2a81bbf665a8fba4b38d3f45f5d28215210ca1866f9e34d483543a98a8c1bba8ca8f4fedc95519e60c2b60fa35b80001b498cb4e4373c677a2929805
- SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xRaNNakJBIs7sH2up:WmifPbRuSakJByH
- TLSH T179B5BE13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 2f062543782078dde5ca79e32972e200794118257512801df892094897beb13b
- MD5 2a8620a9663fe24879f953fda4a4822f
- SHA1 39a397a423e3ed2dabed0070f9742ed69577d113
- SHA512 7bd4abc0c156b9f93b67d43d42866b0bd77e77b4f0f2a4001e7428786dfa777671a2aee903a7c6d6cedcff7cb66df4b8c4be177d5d9164a2c5c1118991d80618
- SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHqkaNNakJBIs7sH2up:95dKTi61kSakJByH
- TLSH T194C5AE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 6f1857cc29eb058440bb88fea83718330a928e80300413bb186dc23ab4b22ccc
- MD5 d440ce6872c880674d1a2b90d5c7aa87
- SHA1 4d3655f2f9bad6000a922479b05a9588b088af6b
- SHA512 1f4df32288f4d0cec69f6bea3b3567ca99b5729ecf4a9f5c3056f3db82461dea647e92d6807b88ab89204d419a322dfea46195406c66832469a5cbdb573a277b
- SSDEEP 49152:bhtSn8EApI0figngiDn0AP5wNaNNakJBIs7sH2up:6X2iyphCSakJByH
- TLSH T1C195BE13F2D900E8D05ED1B9C7468632E962BC160B35B6EF0A90B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 1cfae7bcb7a17268887579c89292f6468bd4414745c4d52e5b68d2cc3f724bd4
- MD5 24446965c5848dd6d42d5d9cfc81a7e7
- SHA1 d1f264ff83680be2b9808659d20d124ec6cecf57
- SHA512 98ef2a54bec5e3500bb234748fd7f7abf8c3e903bfc67d370b77b28c106eb4705a1799761b5520fa4d785b9772efc13b69268741dc500668c05345d30fb1c56e
- SSDEEP 12288:Oo57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:OotRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T112C42347421D49C9F31BC7F5E2C60122BD632D8EB6C6224F63ECBC235270BD1AA69597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 530486042b621a712b96d5a420a3385bf61d0263b11cb61cd4c02f3dd6d3a0f7
- MD5 1b66556c639a4839e724560af4af67d6
- SHA1 95f8ea94ba6ed92a8b5a6897ddbea96c91b46ab9
- SHA512 2c085bdad2b4fac22ac2ebc62604367866c7b29c20762574aae1f8c3c171e3bdea0cf75b74fc582ff501baabb407c1c2d900fcc62a4db945430a60211db7c5a2
- SSDEEP 12288:u/57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:u/tRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T194C42347421948C9F31BC7F5E2C60122AD636D4FB6C6234F63ECBC239270BD1AA69597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 07f87f50eb484e424e81ad12dc6c84e9442711984849bc7c4db26d0ec905cefe
- MD5 f38faf12eb34a55ab48047eefa60b3fa
- SHA1 877855188ab73644ca89bf4a0c571a9fc4e094ff
- SHA512 bbc2ffd24247d3438ccfa021379d3309870805b7a17f43b42529cda072b85e028d7b4d5c4e761e611e854a1ce11ac504854da3d08a813aecb2548aa8daa88248
- SSDEEP 12288:nd57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:ndtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T119C42347421D48C9F31BC7F5E2C60162AD632D8EB6C6224FA3DCBC235270BD1AA69597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 39b62c5a28de818a85d90ada7c2a69f11c42ff3f7eee34a8e4a95eb19298d22b
- MD5 31fb118e2bdd2d7c4b509e5b15d38093
- SHA1 c80d27da4bd13f99102a332584f5caff1ad5479a
- SHA512 86cbd4df782306704b2df9d0801237258671f96b7f2a7b0bc3390b86369d8aca0afaf297acafa66a7a68d77d6354db812ee906ebed76cdbcbaac1d2d7cabcee1
- SSDEEP 12288:yV257nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:XtRRRaN3IGNhe49y3zkJBAlR27Cgway5
- TLSH T1CBD42347132904C5E22BC3F9D6C24122FE737C8AA792638F93947C174A70BD1AA79657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 f23b48beb49adcb136fff9abad1d19500572d519152363acad4683f10a56b16d
- MD5 cefa9a0ed6dca7a162f44a8302f771d0
- SHA1 f545f27441b0547cb8f1a26673907293faa06449
- SHA512 712afe0db11520e8228dad9b1ad3f208ea081fc643026d1feebcc31f4a0a14625ff4ada869dab0dc2c20bbf91b6232bad0fced5718aa027bc9c1e8acc60aaff8
- SSDEEP 12288:z+57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:z+tRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T13DC42347421944C9F31BC7F5E2C60162AD632D8EB6C6224F63ECBC235270BD1AA79597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 dbaed07b45fec7951233acbed6fd4ce1d82c88e04ab1cd2c5f4a0affddf5ad58
- MD5 9532d5e119679b29f8a8f713ca9b267d
- SHA1 e1ed5b2e46687fad2adf0e8ca7a9584b9bf309ad
- SHA512 a4792e2bcbf92d3d4a67ea42a29b1add60aa95593c3493cbe596b12a46375804bf172c5941b89e4d7e2ccb2d476193a2a5bbb75d67b0efedf1fb0e50f71f7ebc
- SSDEEP 12288:7T57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:7TtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T1B1C42347421D48C9F31BC7F5E2C60122AD636D4EB6C6234F63DCBC235270BD1AA69597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 14770e80924202dfade21339ec31f9efa7a05c2a8038c1689e64c8a2e055d5de
- MD5 6fc7dc69f2787a0bbafc7105c36a6bf9
- SHA1 a2c441407de651307f18fd50d49c937232d6852b
- SHA512 c5ac4f21594510ac05d469006fd3b42b4b24c7068a271ff913e3c7e968ea649509a487a719228a4f52f2df6c10c3d907d8a839f4c1462f6d3a79de69d690f42d
- SSDEEP 12288:7H57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:7HtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T194C42347421948C9F31BC7F5E2C64121AD632D8EB6C6234FA3ECBC235270BD1AA69597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 b1b4c45b9802209986664379a6cd4614c781f067051b30c261def476122e1b72
- MD5 0f04d3c1563d2a1673c9c7255730a7b1
- SHA1 c7715bdfd613ea4060fd1e6eb164ddd0b1ae6126
- SHA512 ba106a7b8b042bc0ca39393ed081a13c54c27c0eb581c60b08b194a3d6ae72b20bcbebb29f06f2ded252a09f3150386755e5bc6f4889aa1abfc66f8354845b5d
- SSDEEP 24576:5ZMSzFVSOftRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:5ZMSzfPaNNakJBIs7sH2up
- TLSH T17F050195735008F8ED67827EC9558912DAB27C5A0BA0C61F13F83A275F333A11D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 326b6b5819078f4bbd6eba718eaabf54ea72b94f9536aaa0748cae2480a59957
- MD5 173c77e4e374805b118b60812e8557d8
- SHA1 74bdeb0623ce0c295a260fc24eb2f5177bc49c61
- SHA512 5fff3ae4d9cc330d8821533c5bda039571beef26f721683d8f4ab803c215b8c0e20e88a63fef1dbccd8912884564e05460d6b36ac3abcdc35fb6ebcc7bc4ad02
- SSDEEP 12288:UE57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:UEtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T136C42347421948C9F31BC7F9E2C60122AD636D8EB6C6234FA3DCBC235270BD1A669597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 b986947e6b4442b3eece0ad221706f9b823a1387099ef519d1fba81e55baefc7
- MD5 c3ca4df3b988bffc5f40e4c74265d44c
- SHA1 76ee9da2e614b1c8194fc7784ccb203c9fc093e3
- SHA512 e3325d737f2721538efeb951c1c7ebe39e0b55b27b5f41bf46d94553f608c98016dc270425376f7125c0089a99f1c19d523a4563b12de86b7bd5939ed0be8baf
- SSDEEP 12288:LA57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:LAtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T18BC42347421948C9F31BC7F5E2C60122AD636D8FB6C6234F63ECBC235270BD1AA69597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 bddb511762e045fa5f6ff40b92291e9f2805c37a291f81e7b78a577e1a50e187
- MD5 43a55070e22254269fe8b386ffb5d0ed
- SHA1 d3688819b90caa0226b269c96923e5430f8f7b35
- SHA512 aa77c171149e62d9aaa4c0c0f5b26649706e60d65b6609e0fb4ecd702b28c0369d1ec1c5ff73bc3828339b6c3b309c997af3eea0529fc0bde6fb473db28da54d
- SSDEEP 12288:9yPz5L8L57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERp:0zyLtRRRaN3IGNhe49y3zkJBAlR27CgU
- TLSH T1E6F40247236520E9E127C279C9920A02FB727C3657509B9F13A46A371F337D1AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 2ef9902a80ce95ad32955799505f1a30c4e8f025ac5d8a6912f1e39c14c739e2
- MD5 dfccba724177d03806f3baa98a6128bf
- SHA1 3b00596292675a763870cb0468e8a24ac6eb3b11
- SHA512 7bbb7be9eb097142955e2b557d68e3b21c754c79c815e0639b9060bfe60c7404f3fc54f7c34a7a6cb93cc73ff2d415b73022829073d0000c4076dcc9ec044862
- SSDEEP 12288:eE57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:eEtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T180C42347421948C9F31BC7F9E2C60122AD636D8EB6C6234FA3DCBC235270FD1A669597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 ed76e76a84f626539d5937f8f297f90059c8360d80a2a455534c381256d41180
- MD5 8350fbb0a05ac21f3997323b3b3eef96
- SHA1 3e99f28f97859e477535e24692218cb5b35e91de
- SHA512 8c8866628d74bbe0f28377d4bb89b1c1078cdefe13defadd28e0bfca0998a0e11052163eed043b90e1735b85fe7c7c9c4ad3f8556fe5f19ef2d9160666fce3f5
- SSDEEP 12288:yE57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:yEtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T10EC42347421948C9F31BC7F9E2C60122AD636D8FB6C6234FA3DCBC235270BD1A669597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 95dc9a0cb802bfc3a8947aa9cf92330cdd5e2017fb4463aeb246d2410b01b0f0
- MD5 fa2be890219e6f7e2c0944daa6be7a18
- SHA1 3943ca33cb7bd430005a7df3806c34a293e27cb0
- SHA512 e0e88e65a3b7b4b6e39cc70a90eb4bab3f7f65e9935093822ebf67539a6de284fd4b0d97d938bf8d0cdf27bab8a0c7a22f5404e65be7dbbf9c8ba20e40bfae9d
- SSDEEP 12288:9yPz5L8L57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERp:0zyLtRRRaN3IGNhe49y3zkJBAlR27CgU
- TLSH T1EFF40247236520E9E127C279C9920A02FB727C3657509B9F13A46A371F337D1AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 b370ed3f2d3720474bfa91151b8c3257477ca9ce7d710882d1708841919cda59
- MD5 6f773dd4f44d748436b8aee24a9b6724
- SHA1 cab951fc7145f9cf1eeba8fa992965893c90b783
- SHA512 a6c9308a284f8a88ecba0c13eb7b077e1fab68d5b1f4ffe8ddde8ba3d4b39d6bec51e6f4af9498b04507851f44b4294ccd764bb9fe6b447280a1ce358aeb8ddd
- SSDEEP 24576:+THaLl3z0zDNtRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:+T6LljKaNNakJBIs7sH2up
- TLSH T1BE050195B35018F8ED27827EC9564912D6B27C5A07A0C61F03F83A275F333A15D3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 287792d4d6eb90241cfc69db003505193c32d572581283d4fcd00c071dd378fb
- MD5 2f0044aa78b1f7b45118482c6bd870bf
- SHA1 5adde67975f47e99e72a34fca62c7926a89dab0b
- SHA512 bf16075dd65895fb1a15c89a9848dd744ad225af58f0d01c5a8a7a1f4cc47adb68e8ba8e10af5e6d0dd3eb42102a48b8377bf4645a2eedb62b53cfadac97c066
- SSDEEP 24576:b37d9CHKy7GZBtRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:77d9CHKyaPaNNakJBIs7sH2up
- TLSH T1CF25DF90F3E810E8F177CA75C9764512DAB67C5A1B61DA8F03A8251A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 df6ab10f4cf7a76464453d8f8f9338cd8c2af1909c8e16ad3297d95ffce9ce96
- MD5 08a6ec0faa164c343f842db037dfc383
- SHA1 524ba024846505772b955685c4bc6476afa1703f
- SHA512 b279fb240ce4880426789b9fb9b43b86ab54b80e0d9bb1f8a0452302cf3d7fad89891f3a28c47e178a679f34e062b396e58540f677d3759520450e7a1c1efe3d
- SSDEEP 12288:W957nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:W9tRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T1C2C42347421D48C9F31BC7F5E2C60162AD632D8EB6C6224FA3DCBC235270BD1AA79597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 abc5beb448dd908af0c188f2aaaa4eb5f8505d9d71865d7172ef68c8a0a5c94d
- MD5 c871e3da721cb9a32a98870b796810ef
- SHA1 0083645d6dcdf3fd1c7a189ffa32f8b93071b9e9
- SHA512 a55e99dbfe6c43a66d37e821ac90cc24d30f626711d77b5cba9722d5cda53dad2a5850abc749df1413a622f79947cac6e66415eab51017214c6333e00cf81842
- SSDEEP 12288:cr57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:crtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T1F3C42357421948C9F31FC7F5E2C64122AD632D8EB6C6234F63ECBC234270BD2AA69557
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 eb35a2c87e4fa418a925eb01cd5f6a7e4c7d7a202268e707a23e320d69510c77
- MD5 906defc94ca6b92f668f9eb1844dae40
- SHA1 6095f7adbf7098338237e3ccf5996c7c9f3e36bc
- SHA512 a0d97dd0052f9861d432aa6fa8f7e43f6b32b8ccf4b6cc124357cd4ccbf5d8d391eca3af712bbf5c3e50da95e7e28e7fd273136fe71d8b27b80b193770f27314
- SSDEEP 12288:Ki57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:KitRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T1A4C42347421948C9F31BC7F9E2C60122AD632D8EB6C6234FA3DCBC235270FD1A669597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 f285f858ab31a4b9739cd8d73636ec7000422eb3b3a3450d95df3f5eb4e4d838
- MD5 8c21d5ea6494995c2f92d965f4463622
- SHA1 c08519a11ad64ad20750c3e59c0c65f96bcbd0ea
- SHA512 6fed087b0e2215bd14e6541fb842e2d71fc5145e554c7c56da4c1e3515a78040f12a0da713bb4093f35c6e3ab872799ed5cf2e7c68f2b103cd502c4e4af2a285
- SSDEEP 12288:PE57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:PEtRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T1D9C42347421948C9F31BC7F9E2C60122AD636D8FB6C6234FA3DCBC235270BD1A669597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 8745e66039e830eaeea64449380758db87b0231282832041dac5fcac8173a8f9
- MD5 e915d2de6fb3ebf4de6a86b494c5e73e
- SHA1 79da9af7897b1b9a5ead41b8214bdd80a185df99
- SHA512 e6fc0e15009fe56c18c48d820728e211ee37761ee2665ad00b6e827a8b733ad7cf9e2c6fb01234b4b53e936a341ae631b0533e354058eef7f6668e31b90557bf
- SSDEEP 12288:6957nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:69tRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T1AEC42347421D48C9F31BC7F5E2C60162AD632D8FB6C6224F63DCBC235270BD1AA69597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 4e58da01d96309bb2485e0ecd6e9a6931fa3e93b393719f3e3d94f9f25778827
- MD5 7200be060514612826614642169c0c01
- SHA1 341ceed7823674f5e9c770f3dc5307e4ab2e4372
- SHA512 c2a77b3ddb1a7fb5a6dfa86bf75c8c369ed8f1885795faa2f2b97aadb4f9c3bc7bd89c24a302391ccd94bdf521742d0e5477fcf6091915f4729ea90adcfe26da
- SSDEEP 12288:1s57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:1stRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T181C42347421949C9F31BC7F9E2C60122AD672D8EB6C6234FA3ECBC134270FD2A669557
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 451877de1dae381cc221e647314597ff8001c2c2e8fd02d209349725529090da
- MD5 d710c60daccedcad326828cf3daa765c
- SHA1 050a4baef328c4a8074cbf6ef0851d792e1baa35
- SHA512 73895363eaca5cd1ea369860841d3356e242ae9551e530403d5623a4dcd3da8a30e6431f5774ba29d6e9b8553c99fc575e0e9f84a711ecc52fbb1351f0f882b5
- SSDEEP 12288:7+57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:7+tRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T177C42347421948C9F31BC7F5E2C60162AD632D8FB6C6224FA3DCBC235270BD1AA69597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 581KB
- SHA256 3fb38e390a733660001588d384f694b71913268bf6be45fd82eb2b18320dd9b1
- MD5 be90c50ee4effc83797320a45ac3971d
- SHA1 ee0ef6d4f26729f384a55c8b4dc126dd0b70b286
- SHA512 5cddf1aad495d328380cc6929538208e2feb851b57e4159457171b522e8bcb2367cb4a9dc6b7033c294b42873e070fc54369753261536d1f4066690e04587a47
- SSDEEP 12288:M157nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:M1tRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T16CC42347421949C9F31BC7F5E2C60122AD672D8EB6C6234FA3ECBC234270FD2A669557
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 581KB
- SHA256 ffd7173236cab95dac23a66a958940ae456947317d53a92fde4c9b1a9285dae8
- MD5 9e92b53ea94f22cb728e17e8054e0e62
- SHA1 8b837538eb270d1728ce48b90600594ec4df6ae9
- SHA512 2d55ff72f882ca5eadf27c9c711f3e63d6c18fadd07d134ef94381303892acfd5a42b0b437a73cf2b1e167fe7f45daf1aed9f5336b027add3149e6e494c34978
- SSDEEP 12288:w+57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:w+tRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T19CC42347421948C9F31BC7F5E2C60162AD632D8FB6C6224FA3DCBC235270BD1AA79597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 c700794fdd3773440780081718213c5c1e26ef2dd6b6adbac6f6c87387fa6e06
- MD5 d504bf41e313696df97abec3c3c3edf2
- SHA1 955c8ded18b0ccc95fe262f19fe26f6bb1d7b1a8
- SHA512 5df8e454e31f39cf24d35915b1f316ab7d15ef907a912a9903488c846a170df567cff57ec41cc141386bed7fe1a97fbf85cec597f9b89fa8c1346c5304fbcde8
- SSDEEP 24576:Efwvok9RX6wkyAIQtRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:kMnYIIaNNakJBIs7sH2up
- TLSH T16335DF29EBDC04E5E177D27C99A34606F6B178591B31C2CF029A536E0E33ED4AE39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 a226d101cce94eb3075238f49e5055289a877912c277d7113d63fd64c9c8d4a7
- MD5 8f51bd5f49168b14ddd43986ae03bfad
- SHA1 49b2333b805506b5a672eb57c0b531e0bb22d4d9
- SHA512 783f4eff831e0b65cc53c627dd06524446a9a2954c82227cc590d6b83ce3d90589b7ac853e5498654832b57a896ec6c4cfd35e22bb5336ddbf56a0e3e788132e
- SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0taNNakJBIs7sZ:dySzPFSakJByH
- TLSH T1A5066C96A16801D5C1B9C1B98B0BCC17FBB134490335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 4bf8ede75a32387ef4effa7347031f1a2260294cedd7d746570f99ea7c776109
- MD5 5c858690dbdf92b6de2bc5d2ba2032c1
- SHA1 b8cf426cfc189439a27dce18ab89f96e8377e18d
- SHA512 7df6afa2124d13667115fc4c45f3f8abe5cdaecc0bf7db826f6601412c4ae72d4caa9f5b7c89c3fd580b1bf391e0154b743aeea3b165fb127ff78041d232b658
- SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYvtRRRaN3IGNhe49y3zkJBAlR27CgwZ:l47JUQj1irIhCnDHUPfF/9aNNakJBIsk
- TLSH T15765AD1EA3EC01D5E17AC27885554A1AEA71782E1B31CACF12B0937D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 b5440a87f6c06146c78f2284e787bb0bc671cfc0bb138a8728f4694b1bd498e2
- MD5 000225374235c7b95c84a4903878ef2c
- SHA1 606555b9a372584c979ecb4d7f66224f71e61e1f
- SHA512 f4dd38c46901848b2032e0af23a5180cb4e92e72135b9938e0d51b10b95b0977c76a662e0725af0eea9f6539515197a4f2d5358af35490bc562e2ab29faf234b
- SSDEEP 12288:iNsf057nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIo:70tRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T1ABE4F14AD25801D8D12E92B9C7864641BB333C6597E1A3CB53D0F93E0F75AD0AEEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 2f6075062729634f1e7992939bbeb0f6bb85de336ff2a96bb8015f3afddcf6ec
- MD5 4bdf375196cd90cf9fd5a334d5ed4edd
- SHA1 91e1ebbfc7595d34e164bae64f6e9370793d9b60
- SHA512 c54d8ab212b6b1ddd9c9a7c087581d6270e5ded6ae12b47fca97dc794d60d232032cf1eb3d6585f2c8b9a051255e174f5632af1507e6b12e7c3b5d076f156e84
- SSDEEP 12288:6MVLe27uwEE+uIFKraUaz4dFs8Yp2iVvky0CtGA:6MMNwaFKrad4dFvYp2gky7J
- TLSH T16C3518117666CB4FC66980321E32D2CCAB707D11EE45AF0773C98B3FD576658BAE2281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 77a95f02eabee8943ecaa0d2f015605b032d4e57c8dcbe102708fdb3364928f0
- MD5 ecb0d055fb5fafa3f80c228fa3a42b2c
- SHA1 d8aa4f258b16d455325dbd10efa5d97db3532f8f
- SHA512 c863ec8eeda5f9a4286f37147dee90043c176d914ad7e666a35798f5102c749ec3ad267f50637746d6d035b0c5b1c3fc53f749973ac77da93ae4876308911341
- SSDEEP 6144:pb989TgNga4mJgr4TICuONT7+JBpAQuC6y5P+atMxAIA3Z1SfgatMxAMiMx3pBfB:pJ+qCONT8Ey5Yc9GtG4m
- TLSH T12F6509816137E7CFD1B72032072A5B4C6B64EC07B7495F66B38A453ED86AB51A0F93C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 a443a34a7dd1684800b013e45e408899195c147cadab5c33864a69a75ce1361a
- MD5 6dd40eb74be6122462b0d31953cd1302
- SHA1 0805adbd82e9ebe71052a4d7add121bf1b23fd5b
- SHA512 8b5f387ebfed898e5733208245d0d496e9e3b93068465609170534bbcf0231a9244cece149f64ab660fbe0f8a246fb7c9c07842c07347ada30f292052dd5917c
- SSDEEP 12288:xM7c57nRRRaN3IGNhibHYDBy3zL22PwJBAUVWlrAbA270YGaWgw3bWy2NERmIIZK:qctRRRaN3IGNhe49y3zkJBAlR27Cgwa8
- TLSH T107D42353431C4889F23BC7F4E1CA41217D277D89AB8162CBB398BD265170FC1AE7A64B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 81c679989b1fa6afcf6f01114afd90c8ee25d7710b0e0dbb0eb7e70a347d8743
- MD5 b150f6cce6d6c08a052375da4ef8e66a
- SHA1 940897663dfa0451e11fb161b80bf2902f12ed61
- SHA512 5fa4bf079478805734297a457a2c66ce6708fee08d391eea2a399622fd38f76720ddb4f5153f17145bc785c2ea15f9696c59dd573c5214e9414f106d6530de1b
- SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bY6tRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:5gb4mBIBhGFTaNNakJBIs7sH2up
- TLSH T16C65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 5e15b50d0b00911be87bb63d0839df8114c7f5b0003b51a11b1867c491fbd450
- MD5 38cc313c7146889b34c3b5f9465a31a5
- SHA1 568e97ddd00b22ed5416ab54e43223808d71fdbf
- SHA512 22218d4d6d287a71de2458f2d4e5588a27626494545ae49f308b027236587e420cb91482d171575324510e73043d6d28836be95bfd16e01566cd80a20f41fd06
- SSDEEP 24576:ZG88u8FpJqH1bzria7/mftRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:M7ZFPqVea7/yaNNakJBIs7sH2up
- TLSH T12035F16567E101F0D07BD138CA824663FAB2B8151364EBDF07AC8A521F23BD54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 f56e201227f1b51895a59737acaeb8c929bf051521257d2eb28fd8135625b618
- MD5 c2bf42039077ce3f1515325bbab889cd
- SHA1 f5628160bbeedf8b20042acc5d1b2473af5d4152
- SHA512 e6e31bd25a18475778996f777857350dbbd79f19c17d3efc55c5eb841a294d40294f0141b45cb4421198721ab04a5825f6c1f6c1cba1390aa25a8f8462ec9927
- SSDEEP 24576:nPUr+NQjtRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:nJQPaNNakJBIs7sH2up
- TLSH T17705E11F22AC18D5E67AE17DC5824619F77278521752A2CF03E0913E4B63EE8BD3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 bdcb48cd31ff1a348fda82642f4cf324b2b444b28a29aa7e65bdf63b92257d81
- MD5 b0655e54d8ec36b074a43de4a533a089
- SHA1 2324df81ec8dd2183961259c7d3dabd27d831b00
- SHA512 0472ee18e5f86b8157bbd4f03f86dc99cbe36c9583093de373aaa3f91565a863eb8d7f3177944f068bbd467418fde1b5b901b1812eec1d1850165a6b4532bc1e
- SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/aNNakJBIs7sH2up:bG05lO43bwSakJByH
- TLSH T16AD5C06E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4957E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 60c0b7333b0cb6d603736dc3bc8b0302c4d37af183211b657aa93ef9e0f5e519
- MD5 410097e0daaf8e5cb412db68a20e16b4
- SHA1 7f0546e7eb9e4c34698a2c2495812c17abaaa4b0
- SHA512 45e548b57c53e3dd4adb54f54101857405623165a19d23d0e6e41fd54883ff005430a5027e1ba15e94ec849559d76af4f11bd2d6e20ba311f8352aa188748c4c
- SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnJtRRRaN3IGNhe49y3zkJBAlR27CR:5a5POZ3+Jt2pasx2+m3aNNakJBIs7sH5
- TLSH T1FC65AF5EA6FC01D5D179D17DC583461AF5B2342653329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 c06b51ce9d395b12612f56fd31327e4858bf55a23c66682a2fa3d5d6aba41cbc
- MD5 cffb337eb804768a6ad8a2deedb0ac44
- SHA1 6f0475c0ed14e1dfffb89125badd5ee5a9eb562b
- SHA512 768ee491278e473dec3e18c34375d7451da24a857c79540e2933fdd8151597f1b4becb8f1354322dbc779da14dc63f1227d75d6191d12545595dcd946f445d22
- SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7Fk3tRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:LNc/zEOVHFSaNNakJBIs7sH2up
- TLSH T170858B1623E901E4F1BBE1BE89679546FA717869533086CF0291851F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 9849d51216792dac636f3a69d443ffc54dc9dd146f01bd2868467ec2e4634ac4
- MD5 3cd99bbc648c0c9f01d2d115f751a0fd
- SHA1 53ac42f6338a9fadcfe7d94147b3148ab0cf0771
- SHA512 82db03207ba3eab3ceb483b01872f67f843d2c3d64851c81f553c7aa0e1e61ebb3a1923cd598d2f5b4ed20c78f23278dc67389715cbba7defdf202bbe902ce36
- SSDEEP 24576:a8kNvNnaFeYhJNtmZBm1tRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:a8MwBtOmBaNNakJBIs7sH2up
- TLSH T18C55AF6EA6B806E4D1BEC6B5CD238512FA727851173253CB5390C13F0E279D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 d7a8f69b9c5f7a0690d3a5b6bf90a8c29c5a9eb2e6f130308c8628039d3bb747
- MD5 7e1c637a810193ec271adeb6217160e1
- SHA1 e5bc6af2c113753bc102a047f77272cbc47c711f
- SHA512 e61d4ad8cfaf0fc4fb6d0675b652f180ad46d7d1756cfb2457239e403191ba01342fe549e190ee4f29894bf01970debe0efaab81a2ab6beadd9d1e37ebeb38c0
- SSDEEP 24576:0D3FHshBIYQgAItRRRaN3IGNhe49y3zkJBAlR27Cgway2uZIo:0DVHeBIAAAaNNakJBIs7sH2up
- TLSH T18625E17EE65C04E4E57BC2BCD6938606E67238A9032266CB02D491761F6BFE47D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH