2aa1927c0896b51c125b131817d3c8db73dca2fa4167f4b6ee21601bddd50ee0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
Size 940KB
Sample260928-pff3catarh
SHA256 2aa1927c0896b51c125b131817d3c8db73dca2fa4167f4b6ee21601bddd50ee0
MD5 c01d40f5eeb76b51475393f1df94ae97
SHA1 66515a47eb09327af395c0ad46486314c30884a2
SHA512 a967729e04038e5fdfc2f139b95a2175e1e122765182b59cee3581c89a3af0b40427d590943e18aa79b75719d6292dcd1c8461239d4853f01d6311b0c74c994c
SSDEEP 24576:Np7oJgqmibTfmgXe4i7ojhsP5Lgrk1TWb4AN5:7kJgy/fpe30jaNf1TWbdz
TLSH
T1C3251251FBC3C4F2E89601F944F287B68E726A95133154F36BE02E898C646F1AB77349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4124	elevation_service.exe
2488	elevation_service.exe
5132	maintenanceservice.exe
5812	OSE.EXE
2820	PerceptionSimulationService.exe
1836	perfhost.exe
1352	ReFsDedupSvc.exe
3312	SensorDataService.exe
5524	ssh-agent.exe
4668	AgentService.exe
5500	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34ecce3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000672b616f434fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ae3f62e434fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc4feb2c434fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032e40e2d434fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006872c12f434fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000998e002d434fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f05746f434fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe
2488	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1272	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	4124	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4668	AgentService.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: 33	5500	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeDebugPrivilege	4124	elevation_service.exe
Token: SeDebugPrivilege	2488	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2900	1272	2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe	92
PID 5500 wrote to memory of 4040	5500	SearchIndexer.exe	102
PID 5500 wrote to memory of 4680	5500	SearchIndexer.exe	103
PID 5500 wrote to memory of 5332	5500	SearchIndexer.exe	104
PID 5500 wrote to memory of 6024	5500	SearchIndexer.exe	105
PID 5500 wrote to memory of 1404	5500	SearchIndexer.exe	107
PID 5500 wrote to memory of 2668	5500	SearchIndexer.exe	108
PID 5500 wrote to memory of 2464	5500	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop.exe" --Restarted
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3312

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5524

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 30deb16d1640ccd5876711e92dd7df4b43927e19ec9f409e2fb55000082bc153
MD5 188624484a2c2c710d08f8d565410be8
SHA1 f80e1e1414e04720ada5a367a8adbc81e2da20d2
SHA512 8a592c0d4273fede5eff97707d03e1d71dd1478ea7db727010b41147bdf92dba33720f3dd078cf46c7c5780ea1c89a9a664b1ef04dd281d13e2a27050b13640c
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOe30jaNf1TWbdz:D3q6HjBzU023W
TLSH
T1F4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 aff891e859a3e542c73700ece52345b870a0c5edd4da52fdaba21ab5259f090c
MD5 8b9e356bb2d33c92334602dd7de2c687
SHA1 af555478f858bf38d332fb8be560ace02a2a8489
SHA512 b27f656a1e5fc04d44fe96bc47667908b6e5b0c7f47f36bf8e802c38c7d8cf072bb3e0a5ea705605e0821d8d770d141e33420cb6d16d119894f3948f3b1452b5
SSDEEP 24576:OXYfDtczAYgXe4i7ojhsP5Lgrk1TWb4AN5:Ntc8e30jaNf1TWbdz
TLSH
T10C05F12877D409F9ED678278C8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 240fd89231a15f5995be3897f5b482c953cadfc65912a19e09a69433b851baa4
MD5 878f9529a39dc64cdc3f6c40a98ec03a
SHA1 cbddd32a019881222a7573dc8376d61056533e55
SHA512 40151b6b6a363975218a334e5b25fc1bb0cfdcfbc46ced0bae6d207f9cb7e920ac7f3d6808fde699753b64397cb41aab7afbe68d3387861f9895acdfc2f7864a
SSDEEP 24576:L0Le5ji0hmxirMHgXe4i7ojhsP5Lgrk1TWb4AN5:LPji0Ac5e30jaNf1TWbdz
TLSH
T15F35AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9d949f25ea1dc0c46de01338ea0efc2fef069c517bdc5d4a5010fddbc622bfdb
MD5 66ec09810d560369805957fc490c8de0
SHA1 ef4244cec5561872f113fc28dd1070b799b6b8e5
SHA512 ccfaa84a55f07e4d9573d114c5ed02f6ad137588d933c78f0e857c23b886468bc6950682f71fe693d321797a07f61205c522f3b1304a33a3d78eb4c0318bd62d
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuZgXe4i7ojhsP5Lgrk1TWb4AN5:D/ezSC6vUzPvxHjy1e30jaNf1TWbdz
TLSH
T115756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 65cffcc8686c8a9a071ad363d15de985d6c6c76f92e47071eeaac47c74926108
MD5 6ed79fb17a53858ab0a54c5031ec7cf2
SHA1 14fcc084bf2292b1f071223423e1ae0494d1872b
SHA512 21b18d78bb9a56e861ae040b0eab452e779b2b7ad5ed69f355b0ccb7dde878cd10a1c5f32fa0e44ad2118e055ff52c0bf730c48d13e75fc893142d95077686f7
SSDEEP 24576:WVbqPb88hv/l+6sgXe4i7ojhsP5Lgrk1TWb4AN5:WVO88hXl+ae30jaNf1TWbdz
TLSH
T150559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 d8e3f495799ca024f0bcf0295b8889c5c4f7b4fb59d67e33f074dcc8682a7e71
MD5 eeeb85fa0858fa722ac19ee7d0e306b1
SHA1 85fbb6ee85d0a1b7b68a77e7cd5dc5122d238bab
SHA512 e49ba10c2becb8c712b829a560c12d019b1d31602f590099ea6402897d28b9a480639b6e6e2e2394bb6328307b13954c863882c3ce3139260b640cf76e4a42a0
SSDEEP 12288:DRC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DRbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CDC423929F5409C6E38FC3F4A0F7CBD1E9A11EC061444E6B47E0BE931DBC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 63942bd9b9d1b2f6d4197ee5843457ec52a7cfe2afcc7aef9b9720e3c7c6ace4
MD5 dd2a17b764fb210d18d49c7aa7895185
SHA1 bbc0f5cd0665e1ec6a951e9010037e3f041444e4
SHA512 993ea71f57fbf571cf5059775beaeda7c7651f16c36d2694a2c8564697b238a5dbc0b9a44979bad873ee16f9ee48fef20a1a13e65f50ceff047a162e4605c9b5
SSDEEP 12288:2eBNUbTVO86Un0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2JIU0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19405CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a906782b52c03d896e505b895a99b0ad71d8db101e4669dfcbba017258b82092
MD5 9fdf8d3dee7747cdde8a93f73fe8eb4d
SHA1 40e2ba0106e97b2085a4136ebd8b1de9b43726fb
SHA512 7d1a7cc9a4c73df44adbc192d55b3e0538ae448e1634a2a838f3211bd748ffd506490fb5c04539e591d179ccc0d22ed66d996e2e31e15f886d8fdbd2be4bdd35
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:cQvGAdlCEL8c/yRNw5C0U023W
TLSH
T16E267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 16a500fc5725f4a29b1932db8e49a7d234f47842f18d0aa7960d4427316f7c0b
MD5 de137b8a131d1416602cda80cbf67f19
SHA1 7dcc4dcab6317f2d5ad8ecd1e1df16fa317b08c3
SHA512 5ac51e8db2310f167af04b9a4bcfa945904b4dd0a153a4d67d5455063a4ccec5e294b80143a04fc54653a0e36683ad875554f1f37923ce8ae930cec2b263a0a8
SSDEEP 24576:1dewsAjGgXe4i7ojhsP5Lgrk1TWb4AN5:7ljJe30jaNf1TWbdz
TLSH
T11115E031FE74E032C3BF0DB21B76C712586C6A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 73aa0b68fe7bcdcc169be9fd5b2b10cd220289a97498e147e427d38f6c9e1e6d
MD5 820f0cf75609e91de671744a38b728e1
SHA1 01c2cad0d852274f0e5458bfac03ab886bebc0f1
SHA512 a9b13fff20c31e3dda6f3b7e62af62064d8b0abeefa74565ee258ab9faccb6ffc45208bca46629ea7d01b44b1bedfea8ce87b72b3b821601b4ea3c7f87444c72
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRp4W:RUEtQevvqc2W1cpV2EI32T4W
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2c6e94d97ab9050758e77c7cd092f469eeb767a473039eefbab0a1a34ea49797
MD5 6967afdc6fbb9c88a8b275ac0ce569b4
SHA1 9e74cfb30931ad00bc2d3d93398e389ac6341d31
SHA512 342ebd99df08adfa52733434241682e1eaedd1fdedb96ee137a10aac219c5194a34a4d1a95d4ee76e3eaac490f5dd8d3ea7673d1f6af6e36cbad46a2b1035631
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zpe30jaNf1TWbdz:roqtVjnmQU023W
TLSH
T1C3D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 512ad4aeef362fa965f8336cb3162d0eacaebb03b4cc285aed4c9ecc454a3935
MD5 bc85d9ff765d4dbc637eeda1648f512b
SHA1 5594274f0dd7651dc7fd37d49e7c5e22021551fe
SHA512 e142157a120935f442fcbcdbbe3cf12154500b2abdc6f554f31cb0f51b22535c638150726a5e4b24a7b1cede16c86a19d2f09afce14b252c4f022f4304a43184
SSDEEP 24576:yAhGLJIFoiwtA5l7S53lgXe4i7ojhsP5Lgrk1TWb4AN5:yAMyFoiq5ge30jaNf1TWbdz
TLSH
T1D2359E81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 63a224074a8d3ef86cfa28815706410c521d6a8f4de398ea0f89474a063d51be
MD5 9cf75ab0b2c5a9ba172f72da9698f4f9
SHA1 bff3deabfb139061eb4083b8126c6815ec6ff40e
SHA512 639cd3775c3e0ee571be98e0e5b500a41c6d7e139bfa6d42605e547b197f495f7cd8cbbcea9cb2c60ad5aeb06b3d808d86aad0e1081ae7dbd89cc0eace4c1c05
SSDEEP 12288:dmw5HEjsChNVBFgl0WDm+C40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:YwuoOWCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15C05E14676A40CF9E5A78279C597C632F7F2BC412A21CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ef951a93ab034142d6ccde2d37e3110857da55a6df98811f0af3bb9e3d856b68
MD5 4d0bf298389504f78092813655405f62
SHA1 7d8fc6d7700b2f68d7b2af701eded3ecd968afb7
SHA512 f3e469f1670a81097dcbfe1d3d091b94a15bd742bdb488a7eacb62eccbae46a165b3228eb223392ede29695d8e62ae360810c497c487117b0ef921bc9eb8dfa5
SSDEEP 12288:MBZ1Iyp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aZuvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10BE4129637E421FAE2978278D4F28741E7B23892233147CF02A096A71F76DD65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8128b03a52c87693598de4721ca9a31e0d4dbf5e746d951784ec788ed78e4d7b
MD5 243d9a94b94c18a9e68687aa055e9b7c
SHA1 e84c352ae5b5e269e5ad7344e3ad2bd7944c148e
SHA512 fd1ee2049a48b63c5d845c86e0eb7538371278cbc8f4b595ded9574c1f673e64e12822eb82261c1f171c6ed760b4b3c77ee529f417903a29a79d31638fbf815b
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UZ:lQRQyi36YOcPQLvw2gAf+PN3HU023W
TLSH
T177667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f8c8a3429089946bc004996d6a66f7af49da8cad1913d16bc7b3e8fe8dc532a4
MD5 90e0ae2171175c6db3c4fef4d1a9b68d
SHA1 560953f0a9330acc357d4665c06c7bf020ec396c
SHA512 741ad85cc01d3057b62c0b57343ac2f2d3bf381fbc9f99be86354ed46a3905fcfe868c5c8762a1e88b09b426cc3998d7c434d287c63fa47a70cc558a62359b8b
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UZ:8QRQyi36YOcPQLvw2gAf+PN3HU023W
TLSH
T1E0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 79aa54672a3211f5fc8988ad203d1722b7c11ab97825a13b4f153d1307443ff1
MD5 92030e42033ce379d3760e75856cb811
SHA1 96852b3086c75926b6a486ae393480ba6c0b2bf0
SHA512 c4d57aa0cffb5b0ce95535c5714dd366f05139e22b1c7ffe78688bc84565a7217ced8b2447b8ce318fee0f7ad44d7738f1e9c44559de1f3b8d23c0b65b22591d
SSDEEP 49152:P68Qg55nhheWu7PNU3/5e30jaNf1TWbdz:JthWRc/5U023W
TLSH
T1C0B55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c8b86782e5adc04e529737441fab983143b026b5f24f23886085c79b6214f99d
MD5 e7d81911df108b540b174ba20e96326c
SHA1 746a8302b66b28afeef5271dd278964b4499bce3
SHA512 a26e8ee6531b23f322bb9c49dce600021038fd02465470bf14376481b2b20fecfaf012c9c2debafea76412f61c437139f0bc4d600e4e8b0e42c5c96445560b4e
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:My5112gYy5azzVvL69nLKnhZCU023W
TLSH
T1B1168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 eeb11642f5ae8ef2dbdd5a163499148431e3295718c8bde2dcfdc1ddae7fd208
MD5 24732ce305ffddd0d74a72ba40eadf73
SHA1 396e6f55876d617f6f1c3b3658574421aefa8bb1
SHA512 8ff7f62e7026edf4edc70641bd35ab76a80181a258225a7c783ad1a0156456f8152611836332afb633237f17796c1132b17fd205d97ccc74d946b60f8cc1ce9b
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfe30jaNf1TWbdz:Wu6JmVxd2dfU023W
TLSH
T163D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b11a773161a85b64ccc5bdbb1ab64a2b0e28af9d36a5bf7030c18dae1a08935c
MD5 efd2c90801a999c3323842afe28a3af7
SHA1 7b211c535287b034fa3644b45fdab8c0e9491433
SHA512 2781d5ce4e732175b191a0d326c29cfe08909a9283a6cc8a4d5e69974d0854c3bc1e5bb870c8d198aca5ccad420a63e31551abdcf795f3b7209176ba9d5827be
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xbe30jaNf1TWbdz:0mifPbRQU023W
TLSH
T133B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1010c2dbc8d216c8a7646bfd31a193fcc59720655706e6077487d19840251ba6
MD5 ab821b9d6a32206de5527c696c1480c1
SHA1 a9ff5b2c09ba4d22485f88ae9d99bcfc10fd2e8e
SHA512 e9a8746d32729f6ce3e0048f0a7b31711b08d2b09641a124dd6a6d05e388155055b0519eac647916a72c3299df382ce711fedb41105d68b6e9e49c63d9b57fd8
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqme30jaNf1TWbdz:R5dKTi61mU023W
TLSH
T124C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5133873f472b58e72d1fc601321aa9599d35c327b8582a4fc54caa981e2fc0cc
MD5 e7ac548698886d7bd1aff15ab45e27f7
SHA1 72d045b98a85d7dd209f0fec2fd908c17869a07c
SHA512 89adc3a76a5221fd77e85de1950794f957131163ed424fd155413cc27b8dd55a4b956750161e2e5916e0ee6a00153067b4259bc6e740c72cb918d7bb181967f6
SSDEEP 49152:8htSn8EApI0figngiDn0AP5wPe30jaNf1TWbdz:9X2iyph8U023W
TLSH
T10095BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 68834dbdff9d80d402c85d58663a688e4d81fa2e4d0e8dcabac5bb37f164d2eb
MD5 f83ce00d6a624e7ce0c5b9a0d3ae1b17
SHA1 b68a14b23af771b9c6689503a2109fd7f4c50697
SHA512 28a95d16f8c8581b0156051cd6db367d18e8e0f419ba1c4d89556981a4cd1498056068e776aad9528a3352d188dfe5788600b360a2a4b48389ceed383b48aab9
SSDEEP 12288:uq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ujgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16FC42391AE550ACAE34BC3F0D0F7C7D1E9E11EC272404D6B17E0B6635DBC8DA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9e3292dbb4f2d8fbce6b249c002a8ba1fafeb484c7f4e2041b97a91baf20d864
MD5 42afcc1c23aeb314031f608d245c641f
SHA1 3331ad710677dec19b34595330d10bc18cb973ec
SHA512 7237fc40a5da4853b242928893aa35f46328c81c1b1d69313a4233bb852876224040c4fcf7323f7968b2f52e0b38bea058a1c21a345fee37e860c1e75977060b
SSDEEP 12288:9N0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9agXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T127C42392AE550AC6E24BC3F0D0F7C7D1E9A11FC272404D6B17E0F9535DBC8DA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 47c40eeada2ab31d23d05e566321b99455e3d2c46f6776ebac13232f4d37b456
MD5 bf9d1336f1c0f9fcc0dcc1f2fe4fd613
SHA1 4cd031206a598ae3959106d8e0caf6ea4ab9662b
SHA512 de02e826ffc988edbc034e99f92ac81a30d391d3807d8ce4398fa50808885ad67d26cea9f01f3e299b27fe2d0a106c8d9bb9a94feaa3300fe8e6a4e2e7ff3200
SSDEEP 12288:5v0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:58gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F1C42391AE550ACAE34BC3F0D0F787D1E9E01EC272404D6B57E0B5531DBCCDA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6bbf45947018f0156d714c7d9efa29b2434de4aa3dc031273efa87a6cd8eef82
MD5 24b93da0786d07af52c5c722384e7d98
SHA1 aca0ac7ed822371882a908e8161bd37908deec4c
SHA512 0e81e5a6beb836b723e8aca9d63f344f1f83f21d3bdcaec13c862e35f9a55dada2a07a4eb104c2b6db86eb3bd262c8077a6f78db77e14214d2669c4d02bdfdb3
SSDEEP 12288:3VE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T114D423526F6905C6E18BC3F4C0F38791E6F13DC1B3114BAF47D069530EB4AD96EA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3e953b53ff6b3b5e1c68f076cb99585347718d257d52b19a49ab2de0ebffdb75
MD5 32be108ee3de66db094e98c3f1998532
SHA1 6ef5328b3f1ab1aef22cb1251ea50a9e78d489c4
SHA512 6faf5526ecbd7029a908aa20ad26b107157cc57f159b77ddb4ad26f7630f4d0069980cb45ccf062f6d736d1179bc9ac389d3fbd75757aa1dd348f97f99b67c49
SSDEEP 12288:480DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:49gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T190C42391AE550ACAE34BC3F0D0F787D1E9E11FC272404D6B57E0B5631DBC8DA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a25a784707a655f4a83417cc8831d3ed8ca5621ccdab4010ea61b433cdcfb6bb
MD5 b54f2585f8854cda81e47c39627afb7f
SHA1 1480c8cfd426eb3ea356c5eeacf9c820600cdbd0
SHA512 9c84118f123d2ab0cf59b414416c577ad20e0c01f59ffa0a7cbb196e0ad87e0839d2e3cbb25d91a600bd433019037e95e05a57d224c1a29b925ca205ff0697dc
SSDEEP 12288:KB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D6C42392AE550ACAE24BC3F0D0F787D1E9A11FC672404A6B17E0F5531DBC8DA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f17fe5e745b1e5e3571979184f6378123bc62dbabc3ee6cff2271ebb7414ec32
MD5 52a548d9250099bc49e1519bd77bbf45
SHA1 5a5d1c1a67eb17389b7e122d14dfd4462b7302fd
SHA512 fcc19e61800655057b4bbd821fa3fbc855109375bdb2993a2b4fb9dfbf6f1a2c7f7807cf202853a3432c9607057a60eb448d90c0443ef757bc1cac82076cecf1
SSDEEP 12288:ul0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:uSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11FC42391AE550AC6E34BC3F0D0E7C7D1E9E11FC672404E6B57E0F5531EBC89A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 2e90ea5bf52fb457f4e5decc4243797c8d795f323e6599f1e40b5f68d2191727
MD5 431d19234974383551b683d9e6c6539b
SHA1 9a762507e0c053809fa2b3be3749bbe61da69269
SHA512 1bd0ac77028195419e0cb799147382c74b392b6a23105c629d159e8e329c8305954bea8d7cb880adf229188205fb67bf9daf890e139021c921055789c35234ad
SSDEEP 24576:9ZMSzFVSO6gXe4i7ojhsP5Lgrk1TWb4AN5:9ZMSzfxe30jaNf1TWbdz
TLSH
T130050195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d9714f7c26125fb2fb444bba84f09dfd0932d7d7d6836de29dcedb3e9c6f7394
MD5 145ed0a7a6691e04f171ad7a7b34ded6
SHA1 37b73e4d70ff01fa9ba99929d86c55b648e21bcd
SHA512 976ebea0d6d7458f204276774a68fb94f03c02b9e7d83971a45bc2a88fc97b7c033761210ce94d05fd749cfca59ea648d264b9f0c3c113200c7dbf3483485f6e
SSDEEP 12288:cG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C2C42392AE5509CAE34BC3F0D0E7C7D1E9E01FC672404E6B57E0B9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9d27b312595d1989788efddf7b7175e430a954d2753201434911ab34e6ed2387
MD5 dcc15dc4fc5da128c7bbc19b962ad3a9
SHA1 aa50639f71ba2d62fd025c113b5dc93e9427fb05
SHA512 f8654e8a54ddee0ae4a81fcf24bf361847d83205c6b55072a203e7c1bfad172eefe190266d29a0e8ebb40a7b207fb278ecbff12461f5dde71f4435681cd86544
SSDEEP 12288:TS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DBC42392AE550AC6E34BC3F4D0E7C7D1E9A01FC672404E6B57E0F9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4e48e34be6c91105a3b0ff56f6a3e956cc0b13f4aef9236375939e8a25eb120f
MD5 efa8ee4752ece889e2919ce8cebeb770
SHA1 a6c5d550236ec2d65d2867eea1a4683e7326ba9c
SHA512 58dd3436eb583b2b10ac090f28315a3b9e89dac6446fddeead0e1fa5e935aff7a207060f8021c383a86282eb0d20b205c58d95fdae81be420932ef18d880d00b
SSDEEP 12288:LyPz5L8p0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mzy2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T106F4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 01dbaf415a4c0cf19b9983aad98fe2798b2903413d6a4e1af6cfd14aa23b4caa
MD5 350400f2a7fd85ecd0608a9c72710f34
SHA1 e9889d01e45d5a7dad0e777fceead2fd4f295e54
SHA512 1e31454d4d84fac30342b9007327b5389169d7d996de47fd3d40ccb98a4336f160fe895bf6b4734a17304c1c3ee5fcc19eab5b59b1df8eb1d49c36b05e439159
SSDEEP 12288:dG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T160C42392AE5509CAE34BC3F0D0E787D1E9E01FC672404D6B57E0BA531DBC8DA6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 dae2cebe7d8ce2ea6019d7df2f5882dab220f44573933a942197a8c22f8402c8
MD5 0092b961bbbcb47df8e65569727184ad
SHA1 33c2fc267acc1b8d81ecf1925f45e4277c5e9475
SHA512 23731535403be7a0bbc7ba88375087bd118542566427b12a782d77ccfb106fa088b1dcd7d9f7bdda6cabe0a4f2d534ad04f83440f12f907384faffd06ebb293e
SSDEEP 12288:3G0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3fgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17AC42392AE5509CAE34BC3F0D0E7C7D1E9E01FC672404D6B57E0BA531DBC8DA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2d4509e218d777e3e0cb3326db6fd25518c00b19c30d0a43d0a0369ba994946b
MD5 810e10a83ab47125d81682e10cae4987
SHA1 0a6e41841d034cabd321a5850ac13fbff1b73980
SHA512 65c830ede8003eb3a55fd0b4eb8895929db68bb2da5a24088778799937259a667cfc3d6a701ad38aa936e7e5794ee6da0ce66501519b3c2e0508c0b1e6e6a0f2
SSDEEP 12288:lyPz5L8p0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:szy2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FEF4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 2bd838b01c5d16493cbe5415e0ee7884b03a0d1ce5e7a78a9fba9d329896990d
MD5 c783b84d012d80ee1674a092bf4c99c1
SHA1 c34a4fb20bd83bdfc1a25347e6529ccb815bef84
SHA512 0b1da21539d4daf39031c3adcd0c05060030ad8199e2070f524d6f761df87a29d844a54b90bb31d798480f08d314e7e251b4f9f3aeb8266774f465e5721a4241
SSDEEP 24576:TTHaLl3z0zDMgXe4i7ojhsP5Lgrk1TWb4AN5:TT6Lljke30jaNf1TWbdz
TLSH
T1140502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 cb0656a18adb899e139a82754adc2ca736db42e79a750cdf9870c9015d954836
MD5 80ce163fb10a26a369be44101926d577
SHA1 cda8c3242f7b958a41cdea460d71f9b4eaaced5d
SHA512 195a621498eee5fe22f41b8ca6ab3d9d37b6c9b85faa7313e96fe3911f3e25e126efe6992d9719ef4dba8ea0468e9f25ff13ace1832ce5cee4dc8f4b2d995fb4
SSDEEP 24576:p37d9CHKy7GZggXe4i7ojhsP5Lgrk1TWb4AN5:57d9CHKyaxe30jaNf1TWbdz
TLSH
T15725C090F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2341bed634dde7d54dc8f8ea9a92ae81efcfd2d896d82cbb74c897e74c9041ac
MD5 5e015a18257b7ace8a572392a76f6cde
SHA1 d50b9402c8f8ad3e8d89b325622c46939058c263
SHA512 388bb8b529b8807d816ab98420226f2a93656f5eda78dc70b6de7c18b562129e16a64e59ab35a1dbc6c13043e6c318d399999567b0bd3bc679310848c71f5833
SSDEEP 12288:gP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T119C42392AE550ACAE24BC3F0D0E787D1E9E11EC272404D6B57E0B5531DBC8DA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 899ff92e891182e830ed055c15b799f7e528fe05899711e254dd6690b52d27f3
MD5 cefeb5cb3704dd0da2f3bd6c804bf7d4
SHA1 bd3c3bf2a1eeeb8cc8f6f505cac5c0807b4a0834
SHA512 9ca49bf3a683c41ce4945efc3ecf8a8d4beb726b930344e9aac8652819d73465e08fcfab0e15945ecb4cffdbba0fe99441456afafd13f96fd794840a06726f48
SSDEEP 12288:HJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BEC423A1AE5509CAE24FC3F0D0F7C7D1E9E01FC272404E6B57E1B9531DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 e444172a8d893f7d8578038123b5a739b8dd420d6de4251dcfcedb85098c63d2
MD5 a54d3a08695bd5a39042d3676d51f311
SHA1 d49ea5d1dd6294fc80932a872b8c77c20ef48353
SHA512 7ee592b822fec71a6edb2109aa150da4db400f578725474136bd04fc8fba9273d46b7aab0a5edf8971b4aae0d7cee4f56c290a8a0d0fb3c4349a1cc1e3b67e87
SSDEEP 12288:RQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A3C42392AE5509CAE24BC3F0D0E7C7D1E9E01FC272404D6B57E1BA531DBCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3964162dc41fd4bbe29f99c87455bbf905a99d9823b1674a89f0b621c6fc114e
MD5 d04807dfd6cdd71152e7af41321c1f65
SHA1 2807c492cf1f3ebdd5ea2db7c8df92d10e4c0e10
SHA512 ccf5399d9cad93549de5974251cbaaf2ac277d2a4fba7f7e078b085486481ece9b2d6e2aa22be5855a799eff7890ff9187b8d5cc526bdba7bd59367fe756dc31
SSDEEP 12288:aG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:afgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T124C42392AE5509CAE34BC3F0D0E7C7D1E9E01FC672404E6B57E0B9531DBC8DA6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 bb64ab52685ecabe856f4d3641c552a7808c9eb2e9abfb86c74bb230cf4e6bae
MD5 b3e3f40e0cc74381970d9b7b312a8ee0
SHA1 3abb2cae0ceba3cf334aa922e64c3f54d88c5d7c
SHA512 a73f7cb06a6a099bace292c4f54db167c1ff02f5aa1aa12ee87766ad5b225d6ff137e68a46db15fca8709d5e946041b915d35f113f457ab16cc7c3941a4f2f34
SSDEEP 12288:mP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C5C42392AE5509CAE24BC3F0D0F7C7D1E9E11EC272404D6B57E0B5531DBC8DA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 2587eed99c0d96402598d2c528103927b29ea4ecd84cf9e475c062d29b20e2ac
MD5 16aeef9bbfd137b86b40753542c3b8de
SHA1 e96f6e38fb27ba37c9c9d2f0fc3ce5016b045234
SHA512 507300fcfe2d45a148c43b3b5cf2dbe3113aac58fe95467ac0ec306760bfcfd8da0d37f079e3de7327c350ea4401eb1a092fea0266cf2d6317c93f2eb7d0190e
SSDEEP 12288:Me0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13CC42391AE550ACAE34BC3F0D0E7C7D1E9E01FC272414E6B57E1F6531EBC89A5AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 2d83e787ba9fd5441caf7d634a9a58957b78b580c8bfc4bf7b04c0011df3be7c
MD5 ce80e4624a9d7f08dd0be0e1b993cc9f
SHA1 2c60e06be7a8348586db06222fa44741d8062bf1
SHA512 a769c4ef220b80b886a249a0444b85b8efda6387e2b92c2a6de7fa40987103648d74ed7a93a5200687fd70b17855667e88828c1c6e7539c76b1d1d1d651948fd
SSDEEP 12288:M80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:M9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B3C42391AE550ACAE34BC3F0D0F7C7D1E9E11EC272404D6B57E0B5631DBC8DA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 2c535fa5d729be1f6479a2d5f212dadffa05b0695c49f4385f9955045a56775a
MD5 7403ec0898efed28938e7293c539ef0b
SHA1 189c083780c732f32991f0a7828dda2b037a0310
SHA512 46468d2fe132582cc08072687de9652e8b0e81b02b3c666e87e65c3978dab3dd7ac0dfc2562dac042cea3f244ff30770e8095b42b28757334c0b1fbe50a419ef
SSDEEP 24576:Yfwvok9RX6wkyAI7gXe4i7ojhsP5Lgrk1TWb4AN5:AMnYIie30jaNf1TWbdz
TLSH
T12335DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6e420b87a79cc770223db78dc710bbb0eb1d94da935c8bbae906066503944192
MD5 c27fa1bf66832bb0f976db3af6ebca9a
SHA1 7cf9f3948fb776f6ef47dfac7a225e0f2020638a
SHA512 16e5fcfce187ab3bbada7469d4d4edcc32b82bb7231a9a745a6c160475a85166a10982f9cd469afb93bdba7776e6fd408b9e9e9310f0b231656d4e8f8b90d814
SSDEEP 49152:oYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ve30jaNf1TWbp:2ySzPnU023W
TLSH
T160067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aed7a924e07601043255c413fcc9906e6928509118d4d8c9f5ede4db6f510b0f
MD5 3ec052205d0259c35b82f9b6869fd6e3
SHA1 4a4c81e84adb8dab8cc295f2f0d90fd3c60822a7
SHA512 76f31f0715e012a585c4b3b0b1b0c398371225e8569b9e700338f15c48406b41e29a0d105c4f9ce12dcf32d49dd83de9b9e98067f56d0d6e691e7769e82a10bd
SSDEEP 24576:747Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYqgXe4i7ojhsP5Lgrk1TWb4AN5:747JUQj1irIhCnDHUPfF//e30jaNf1Te
TLSH
T1FC65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 2982cdecfe683869454b910d1acbfc4b41fb6add527e6df40e71e83907995c90
MD5 6b6bdbb6d1fe9ae9584323466b024f99
SHA1 2949c9d9be3cdf139e60fa5e2c25286feeae6b93
SHA512 a2a8674269ba87d00ddd2584ea0d1dfbcb37ae99022b392e9d52dd43bbef3cd2ef51ed1fffedafb8c62cb96f534283cc69f8fab517ef1f68a401480c2e40d404
SSDEEP 12288:FNsf20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:avgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A2E4F15AD29802D8D06E92B5C3968A81F3733C5193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3d2bf3d7ae48776637af91848da03a375c9c7d8af75f1848f56d79a1873e68b2
MD5 3850a8064d9ec82e6a59d542403b0ede
SHA1 001434f4451bcc0bea4db8a95f684dcf167daa75
SHA512 0ac4dd17428a5a527ea47ad7d51f4b66ba5454793a5eb6a53d088feef8f8b5abe14c4c5dc83b5555f1779acb83b845d7bcddd0c8ce92c6185675b47a693dfe31
SSDEEP 12288:5cw5LBqEb8yqOPH+8MfLwcjmV0rwMyOT:53LvPH+8Mfrc0rv
TLSH
T1964506117666CB4FC6A940325E32C5CCAB707D41EE046F0773C98B3FD576A58BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 41f193d3e708e161d14674b7e41bc264d43dd2a95005bfe414ed54ba33a5fb13
MD5 e8723c25de4e91a2c1375b774d88470a
SHA1 c62cddc175ef480d3ff80bada8626c01a6fc5ec6
SHA512 1760726fe2e140fb9d7625a8144757a5ccfea8940181d794b0244c178ebfad4b64d87c20d13295a08ee5123adead0ae8eb1ce85e0e1e15012f70d17b2a69cd93
SSDEEP 12288:3+lSMfsMfpo7jvAlCkLvPE6EJiVWUD+o3dJVd:0SMfsMf0AJE8V1D93D/
TLSH
T19765E8805537E78FC1BA6032033A9B8DAB74EC02B7056F16B789053AD867B45B0F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3ea33a7e69c0849f45bb702e779818b571c93b5fc88a1aaf9d298c4d284a36d2
MD5 55003aafbb6969d2cf07f9cbbe9ae48f
SHA1 74e498ea6efce8c4bea24e6b409ed9ca98ec0b68
SHA512 c489ba33e66073fe4ab959a034af3a9f1cb30e08a52bbccd82102d7d151c3b2de891315ee4516927c80eaa751717f3d944196ecc30e746a818f2a2a5055c8803
SSDEEP 12288:dM7O0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12AD423629B580DC6F29FC3F090FBC760F5653EC0670089EBA6D0B69319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f2d12840b9951255fa725f7953cfbbb7e5dfa3c95ba0c82074bee718f78e61d5
MD5 e610f58fff56145ed2d53eac1b9f6fb3
SHA1 48807b1ec431b1a1d98457debe1bdd352e6115fb
SHA512 4d72c5ac7ee2d28d0fd743c18093780ef32681dd36ac8125e220f6480d528cdf7f1787c3a8441860aac07312a1a4e0b972b0b24c2c24b68cef9a13b2e15abb62
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYZgXe4i7ojhsP5Lgrk1TWb4AN5:Xgb4mBIBhGFNe30jaNf1TWbdz
TLSH
T12A65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 87a78e6e0fcbc6d3a8fbd47f21c3b39d3d1a4cbf3a5a6b3f9be178712ec3a0eb
MD5 ce67f9531063705a97d56ccfc7d53fa9
SHA1 4f14d06cdb9f67f6bd326f0fcdd60f78b07c646b
SHA512 62c8145742e1e72620f2e8f6a6f191a2f215b827decd700b089e5cd03bbe9a05580ec32503eefcd7c76971332f143616f77c02761578536db8521d46f2ababb6
SSDEEP 24576:qG88u8FpJqH1bzria7/m6gXe4i7ojhsP5Lgrk1TWb4AN5:R7ZFPqVea7/se30jaNf1TWbdz
TLSH
T17735F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ab757fff1baea07d1532114b0bd335155cdfe27c0422eded00acc9620f9ac874
MD5 85d712015687609deb35323750dffd2c
SHA1 3aca2257977f715e6ceb5c7a75ee4e75c398020e
SHA512 324c3935c925de56c75fef87ac89c3bcd3064a761ed6b0f229af945134da7d5d24ca26f3e7d5735fcac9de0a83fcc3930accbe490693baa7475dec6c1033de9f
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhe30jaNf1TWbdz:9G05lO43bqU023W
TLSH
T1D4D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fca1189bae162bfa51275145f88185a7940b739b1f3a6858475e542705fdabc7
MD5 20fbb2f1eb36208fed99070cbfce4493
SHA1 c2f960dd177cfcdde7e5ee841eb9f5b0c9860330
SHA512 49c602899e91e7684c6fbc248c09213ef100c5891d7b107821c059ac79f1939068fe1c08be3501f797c74aa32470bfbb5e9b18a7ed9976741a7252311ae9532e
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYgXe4i7ojhsP5Lgrk1TWb4AN5:6a5POZ3+Jt2pasx2+m5e30jaNf1TWbdz
TLSH
T1D965AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9da7e3df393e5122d13f680209c6010f360b081f73eb8b752e6d25a5c613db2a
MD5 670b944d293d5c0bbde494bb5dc455dd
SHA1 1f4cca121818c50648b5a21d5b3a89debfe606ac
SHA512 83de7e92f1b610e45f076d02eb50b1025f3503fe508725d783dcdfcfac53dd60726e3461b9b54bcb84f364c02d88606d2537f3204250d0ca5bd72081711bdf40
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkigXe4i7ojhsP5Lgrk1TWb4AN5:5Nc/zEOVHFMe30jaNf1TWbdz
TLSH
T15E858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 72c06574034bfc383a53f7b9dd3505f445ef39da9e4a801197bffeec8e286d8b
MD5 a236d2c45b5ff0df9bc42cc71829cd9e
SHA1 063f34f4391a89b8db9400fd126464d39e5c1a2c
SHA512 716a0bdfb5b4c9f940e550392e3ed27bc6dd5e97c3b65998500f9f8ce26d3135c72768a552cb1973408de44f79505041a290de6c3d07e804b9ccf977081dc5d0
SSDEEP 24576:a8kNvNnaFeYhJNtmZBmUgXe4i7ojhsP5Lgrk1TWb4AN5:a8MwBtOmbe30jaNf1TWbdz
TLSH
T18A55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e86c45293ee4f2b8568b2baccb8990c4db69368f83d840a65a53739a18c09ddc
MD5 2221f31db947ccd56e345cf80b0da1b4
SHA1 965da7e331a70084a55b2a215d9a9e38d9836323
SHA512 6669d5bf5b9715a6d4a28e8585dd9fdc98e146208ce8aaf535be4545b3c9cd4ccb8f2a53038fd15928d495dbff58b54d33b139b290e6741c912e2e40ff6c2783
SSDEEP 24576:RPUr+NQegXe4i7ojhsP5Lgrk1TWb4AN5:RJQxe30jaNf1TWbdz
TLSH
T10F05E12F66A81CE5E27AE17C85828719F7717852131196DF02E0817E4F67EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d46a8f6a3a66487d42076dd19320552d970997bd3e5f90cd03f23eac60d8d609
MD5 20d99fb1ee29b94dcbe08aff5bfea4a5
SHA1 315be98b09de897a60923808d716a1e2a6d08e63
SHA512 0db8d15846459324d3af464bed9932e729f56fd70365fc8ffd809a9964dc7712ff69b1bdf479289235b73b345f13c59504e48a5bb9617cfbb731b9c57b9a82d3
SSDEEP 24576:3D3FHshBIYQgADgXe4i7ojhsP5Lgrk1TWb4AN5:3DVHeBIAA6e30jaNf1TWbdz
TLSH
T13125E17DEA5C04E4E57BC2BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1272-0-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/1272-2-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/1272-7-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/1272-6-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/1272-50-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/1352-343-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1352-345-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1352-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1352-97-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1352-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1352-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1836-92-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/1836-87-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/1836-324-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1836-86-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2488-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2488-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2488-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2488-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2488-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2820-74-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2820-76-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2820-322-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2820-82-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2900-42-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/2900-65-0x00000000022A0000-0x0000000002307000-memory.dmp

Download

memory/2900-137-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/2900-131-0x00000000022A0000-0x0000000002307000-memory.dmp

Download

memory/3312-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3312-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3312-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3312-329-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3312-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3312-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4124-20-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4124-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4124-14-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4124-21-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4124-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4668-152-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4668-147-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4668-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4668-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4668-141-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5132-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5132-51-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5132-55-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5132-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5132-43-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5500-331-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5500-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5500-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5500-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5524-121-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5524-129-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5524-327-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5812-70-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5812-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5812-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5812-300-0x0000000140000000-0x00000001400CF000-memory.dmp

Download