6907343285ce8b3f06eabe2ac443d0c582cfb860a6aca0859b2de2374aeb4a74

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
Size 4.5MB
Sample260929-2c73wawcmd
SHA256 6907343285ce8b3f06eabe2ac443d0c582cfb860a6aca0859b2de2374aeb4a74
MD5 721cd1fc1829c99e2a06761309124a1c
SHA1 79374c20e57f20e0b29c2e2d82a3795cd121f530
SHA512 fc60ceb857ab95c2cdab8f2a274592b6f87afdbeb7959ae043e2abeaa6b80e133edea6cf41d76ccf2bdd59b6643df2028597bcbc1a317010778d8c80e0ff84db
SSDEEP 98304:IfuVKZpKOK++M4FHXu5Tk0AnMA+M4FHX:Sug74Q5TfWM84
TLSH
T154269D04A3FBE829E5F3EDB07D6C22B9B9DE3C970939C4A64BA83C5C6D745A44464331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2992	elevation_service.exe
3524	elevation_service.exe
4524	maintenanceservice.exe
5980	OSE.EXE
2580	PerceptionSimulationService.exe
5540	perfhost.exe
4684	ReFsDedupSvc.exe
1572	SensorDataService.exe
1048	ssh-agent.exe
5720	AgentService.exe
1316	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e070a9d33a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000934f-109.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8cb6b006250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005afaf0bc6150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c63884be6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001c2894be6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000077480bf6150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000488de5c06150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	248	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	2992	elevation_service.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4684	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4684	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5720	AgentService.exe
Token: 33	1316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1316	SearchIndexer.exe
Token: SeDebugPrivilege	2992	elevation_service.exe
Token: SeDebugPrivilege	3524	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
248	2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 692	1316	SearchIndexer.exe	100
PID 1316 wrote to memory of 4912	1316	SearchIndexer.exe	101
PID 1316 wrote to memory of 1444	1316	SearchIndexer.exe	102
PID 1316 wrote to memory of 300	1316	SearchIndexer.exe	103
PID 1316 wrote to memory of 4364	1316	SearchIndexer.exe	107
PID 1316 wrote to memory of 6112	1316	SearchIndexer.exe	108
PID 1316 wrote to memory of 1960	1316	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_721cd1fc1829c99e2a06761309124a1c_amadey_elex_emotet_icedid_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5540

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1572

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f341bd77a03c659f8fdbe39b01dfd6bee6553f5c051d7437ecdb56b02a9734e6
MD5 27adfee06a2f1594f8fb4ae4620b618d
SHA1 c826bb524fbdfe666b0fe71ce3ce8c0095758124
SHA512 83dbbbbddba8082857bf3f4020bac48ca290cdaffb5591035558a410f3898012d87917aced650df8c6037109b3c6cbe0471db84929b8475fa043fa0f0dfd0480
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnphxSMmT8oWgBCaX:33q6HjBk+M4FHX
TLSH
T11AD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 26434f981f3c99124d924b32ab17377865e7ab17ff923f9dd8db7bbba18bf718
MD5 54d5648bdb64a8d0ba4e791c201c7c09
SHA1 a3355abd920f6a2080ea82d39979ab1ea397bde9
SHA512 6345cb638e814482f9c3ab429e7392fc7572b669521a4cfe93b3c1d7b4943868731d534e163a2e1992bae376a8450a8413e08df130b95920fe0a4437dd0a2b52
SSDEEP 24576:lXYfDtczAhrKhxr+EHNmT8oW4ll1JCrLKXI:wtcDhxSMmT8oWgBCaX
TLSH
T1CA85F12877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 dcc64482afaf344db3771839c644e9fde9aa3f126be7e850cbdfc108cf32b48f
MD5 1bb2967902d7477c0d4d821e01b3a3d8
SHA1 5bed13002fe9911e8ef50b7b9d9b42a1c73299ea
SHA512 a4bc31096096f3c82a163f133dbbf7f770bc70cdf1faeee9fdafe8c9854ae0094c66f96fe44ca347c571382439f0b40d06592b311413cbf42ab49e309fb7f161
SSDEEP 24576:40Le5ji0hmxYrMGrKhxr+EHNmT8oW4ll1JCrLKXI:4Pji0A2ihxSMmT8oWgBCaX
TLSH
T17195AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cc993de170e36c0c46c1fb56104e316dfdaa3a1fb372784a7e97c07bd7c6deec
MD5 984b239e60e9ef43f13f6e22f0e457d1
SHA1 03e608f7ace24f7b3f7e8332c1fd3d8d9c60bc85
SHA512 2e914e9f913d878f88302ef973b617144214921cffb15b97656651b1be3aa339fa6c7ef7cb8287231ed4292aa08d92563f382aa794646bf3ab56b222f7f3136f
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyuorKhxr+EHNmT8oW4ll1JCrLKXI:y/ezSC6vUzPvxHjyuhxSMmT8oWgBCaX
TLSH
T105756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cf0b606fd6de95eefa13cbd0e3bb04bbf5fdbea3c26fd1d572bfbbfc2047c8ca
MD5 d3ce055a0f5801a3c35d8dcffe7ba216
SHA1 f29a1112fa0924b31ca1ae6b940e84fb62245c2a
SHA512 437320271b5d5906dd9a73700fb21be47c334c9153c03d1271cf201bb7ebe0da7a4072e5b7df464a7cb2b656ea6253570f5113e13450dd4ec6d39e99b38018e7
SSDEEP 24576:8VbqPb88hv/l+6JrKhxr+EHNmT8oW4ll1JCrLKXI:8VO88hXl+1hxSMmT8oWgBCaX
TLSH
T161559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 421324780d4ff7e1191ac88899870062512e0350b05a75834dc9ed7acc9d8cc2
MD5 ab48f38edf236b8c45b5c60f69798b95
SHA1 dae20aab8506fc7d47d66251e661e40ed67a00e1
SHA512 204bab0241ebdef23e93f78018d96db0596b79bc581eaf43b1ef0af8205126481c012102c15ef30bbb1c21c5cf916732fdc70757385413f1b3e7297ce176cb5d
SSDEEP 12288:IHqJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:IHarKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EE6523759F0D64ABEE3B8335F872571299990DDCE1412E3B8F3A3FAC3934C5A9452212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 38fac8639a60af32c384d3fed723dd0561b785912540dbdd21050353dd5c79e4
MD5 29758317e9baae4ed5a253aa7bbe8670
SHA1 258f25c4df77c09d8026bf1d48158d7a077a223e
SHA512 3687dc67bcf8a5bf3887335b20b190aa9e829b533b49cc82e3b71d14bbfc0c7d61e456ee0f10aff5fb3051823999d892d77267440c7cbcc1d0fca87e18e6078c
SSDEEP 12288:XeBNUbTVO86UPJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XJIUxrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19485CF3BEE28FCD2C67A8D785A918700D7B278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5d74093c19470246bd7de071dc9ddc5e163f0f89c807ac96ed9466be16de6975
MD5 d94cb234d5181d61cbdfe25f6c773f0d
SHA1 dd0bf5d02865d7187f5c6ca1463735f621dfc337
SHA512 c903c07150c6b8afbf41d9af95c55c348aba4fe5c67d7bcbb80baf77c2de76b276630bd427ed4553479c4eac8c71b655aed76f005915a2f6f3ae5c1f547e1858
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:kQvGAdlCEL8c/yRNw5CL+M4FHX
TLSH
T1D8266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 fc68ec01c2174eb57b2a62995f9ae62f2d9f62e814ce7f6b4cb5540b5c5d200d
MD5 9e1c5bbb5ce7f8314b6ac9052c76dbfc
SHA1 c3daed83e8523df1ea0a1d287eba1def9da9037e
SHA512 307db7fe772b55138419e34f761de6b16b18c562b3c20b1d6212852ba27d0ff025b57cab4c4dd37eeedbc27efabf93a4e828a071d3e12afc19e4ee46b11ee6ce
SSDEEP 24576:87ewsAjjrKhxr+EHNmT8oW4ll1JCrLKXI:+ljShxSMmT8oWgBCaX
TLSH
T11485E031FF74E036C67F0D766B36C716586C6A604B512AC3E3B88E9D59302D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 32c0dc5a89f3ddf2aee7aeb1c40e4a707b24e6bb54191a7386a28e8f4f75cdf1
MD5 fa7bb0db7b0b92b89dc48d3cd3ccb705
SHA1 2cc3dfcfd7eb7fc1922a7af80ab3eb9655af8060
SHA512 b691b8cbdb41157ae4f7e7f5a41edfbad3aca38efe4aae127c6817a6b4cb8971e461eca7bd045f645de5a5cd03a67a9d04197a16f95a75a0d69a8b523c0f4639
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHK4:OUEtQevvqc2W1cpV2EI32K4
TLSH
T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d7e1932eeed63f5d5d3bb4c6bc176811ed662f2feb494cda21ad3a54be5d28d0
MD5 7490f0ec212451abaa4067ea68d8f315
SHA1 b6844be5369ca4cac677a8801a52802698fdb71a
SHA512 7feaa475fde7e3bb0d4c38267f6c1b9035ea109961352f97200e8f8597cb62e9711c07ca245452d46399e9d4c2a7f87d7a9f458aaba2377d02492c5db6ddd55b
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zyhxSMmT8oWgBCaX:GoquVjnmH+M4FHX
TLSH
T12DD58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3fab421a6018725899cbfec5fd1c47fed3245daefe6d2d5c87dcac8975d50c2c
MD5 aa8fd62854319866420174ec2b907010
SHA1 4d99ab295bc040039568156f21f647f2c37915fa
SHA512 983e9e4b2926250008044933ce5cae0807e5959aff6c5e4af93bbfe759b7dd1ef556889a8a5c87702665ee47e8dd6ce6eaed26bded75e39ac1540e5412802f43
SSDEEP 24576:YAhGLJIFoiwtA5l7S53UrKhxr+EHNmT8oW4ll1JCrLKXI:YAMyFoiq53hxSMmT8oWgBCaX
TLSH
T17335AD80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 46c447d1531301edb705bebeeb5e13714499a933f8646df874349e6aadef981e
MD5 13cfd5736e1552d87e6c92995a925051
SHA1 000170aeea6e89153666796c49a9ae71fcf8b6a9
SHA512 042d4de7e9480bac9d8543a2cbb72a35f18d854136912a205ddae7c70685513f70ffe30fdf9ea4afc8639c69bfb2504b77f4e00c260f6d95e9467dbfc118de94
SSDEEP 24576:7wuSOW7rKhxr+EHNmT8oW4ll1JCrLKXI:7w9OrhxSMmT8oWgBCaX
TLSH
T11B85F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8d1b8f72bb99327f8d7e029f00e37342a3c59fd1edb8bd6e23a7d2fb23dc1bd2
MD5 d737a1bff3f88949712c04b5161ad282
SHA1 1909b73a174dd3c59a55ee2593484e5e87d14aac
SHA512 f886c1cbd4a9eea2d949099594c5f353e735bc0578ca694bb99efc70fcbe588e655dad6d6aeb437185eae648231bfaf9c355c81a287abeea6df38d26aaf361ed
SSDEEP 12288:RjZ1IydJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:tZuurKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14A75126A379860FAE967823CDCE14605D7B2389A633143DF1A3547A92F33DC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0e6a40a912276c17c5d1ef70bf6212d759bc45e57af19bee7a360597b339eb1d
MD5 b6aadd95df50d82a3987affde604107d
SHA1 5415f4a22cbdc71f067b40a77a7b6e4fdae0d0db
SHA512 95f767b7d8eb0dad849ecfae66ba68f799541e7754acca80a2962f37d0050a7b13a052f64f53996d4c883203fde85cec50784251c8c85cdf29e441a36bde4e80
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:SQRQyi36YOcPQLvw2gAf+PN3U+M4FHX
TLSH
T17D667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2a75ddd395db0f5338f1f27f398a88c1a7555aa23e9fb63abd1793d8b611f8c3
MD5 c8cc3a7ab4070a1d99cdd04cc027a8df
SHA1 a6d5301678ba8db0ef4c41c6e6cd3e554fa017f5
SHA512 d4de0f882617e39256e128118d7eb0b584e1c557615a396e05e3502d535979bc375621c796f4f3757c00bdbb26e2b1b43f5128b81108de224d8ead1236859313
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:UQRQyi36YOcPQLvw2gAf+PN3U+M4FHX
TLSH
T185667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7e67515d90f73e959bc084aa8f936c4c5018d7a70dd75a2ff215491c30af6377
MD5 3f19c9b16cb39aaa045f80d4530f3a45
SHA1 ecb9eea555b061b863ca8b9d6ec2b72dc86b039f
SHA512 d3de062ca76da0de0e5ae415cb24ef6d116a2c4411ddb27396b92a256130be50935310241a18ce94a0258b9fc84f5b5dc45a7648df257ae71982ffa6caba1816
SSDEEP 49152:V68Qg55nhheWu7PNU3/ihxSMmT8oWgBCaX:jthWRc/i+M4FHX
TLSH
T122B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fb905a0e430d837d7d1e1314f176642a7965632477499810db43fbe3b5d820bb
MD5 9fd6a60fe23414ad40bf2351e1a77dae
SHA1 de590da075282f1b801e31b03b7b570e368c24ca
SHA512 eb7ddbd1083cc97078839f66e0d41caa77b051506b712e7642647903dcff427aa2370f4195bea2e328181f297f593aba8ea2b4a11ab5ad8c731e5d67efb2b7ec
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:+y5112gYy5azzVvL69nLKnhZN+M4FHX
TLSH
T17E167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5aeb30d996ef04851418faf8c1872d67847b8c610b6e2c888b5d424b044531c7
MD5 7767a2156f8214fc7c1b208aee3f32e9
SHA1 fdf613d364a27da4ce375f307315b06fc7f638cf
SHA512 f1a72145ef4dd0d8aa3152b070911abe0b32f2f72f9fd4ea275200d9d643bd1e6bf719af3074c5ba942fe7c1eb8fd07e692ba7c6faf9db09fde4f6d6ddf68861
SSDEEP 49152:+B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glYhxSMmT8oWgBCaX:su6JmVxd2dY+M4FHX
TLSH
T138D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 13a02aed716db19165974656bb1b4e2fb7e48f7cb5710003a35bd87b2122c8de
MD5 169b0aeccbebe59576ff388b1cb07567
SHA1 1a994f365f6f48a4d7ada0ea0490e5e1971bbfee
SHA512 de7c82b682e9d28bb0d8c61fd4e83b53ffb7d94526caaa05f0034aa0d1ea2ff390f78b2fb792328e3e48890414ee294f443d0a19f87e5e40591c0eb99ddbabe6
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4x4hxSMmT8oWgBCaX:nmifPbRH+M4FHX
TLSH
T151B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d720ed220a1ad1b0c0b7ef4bd858e894d6be03a3e2318a5dc466020960a89142
MD5 f5fd96cf275624801f634ff4154e92cf
SHA1 3b6d7b4d330076d590d96ff73bb8d81b497fd852
SHA512 06f158ea4edee7a09e14ce34660878e760bd1388232f9d776a3f9810929d965da17028629615a3a941a418bb9d130ef647444fc6fdeec4b98b86181f91f5617c
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqRhxSMmT8oWgBCaX:a5dKTi61R+M4FHX
TLSH
T1E3C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 98a743c1460b6ae870ad7faeecc7854ed32755193f82bd266c25e581f7498470
MD5 bbe7a7a154fade5960946976e1258697
SHA1 f419dad837ceffd4b3781742de9eb56f538905e9
SHA512 ae840a165cc0f465fbe76d7d6522f0ca2854f57a4336a1f543743a43c5782fe8ee8216251a7a5107a5f2dda50cae6f3a2ccdde4b11b169947bce34c10c7f914a
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wshxSMmT8oWgBCaX:+X2iyphD+M4FHX
TLSH
T1F395BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a6115e8d2b349b5aed8658b89516dcf8450a1c2998a4c857c5264b8e9607acca
MD5 fe2a73e44f569e9960fed3e3e10a8b1f
SHA1 79bfeb4d2c474fe7baafbe1e5d0bf6d78abf694f
SHA512 270b22fc191f81d6d2a88432573cf00c0722206e0d33074f37b910458522850d2760694ebd86d8980084d99abf02da6f4403926eebdb06618f9eb91096c13454
SSDEEP 12288:bSJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:bCrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T157652375AF0F94EBED2AC335E8624716D9DC0DDDF202163BAF3E2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 059a2c5fd21724fd8b3ba9b0bf45095497d2269ea0995d8ff965c4804adc4ab3
MD5 0ef214aad1ae22ed79f65357c9422d51
SHA1 d9191f4ebe5f9899f7708ca56315891c33449545
SHA512 c37037facb8a18c06ffc70bc8574d612fbcac595ac37e3e9984c0bf8edd6c003f4b32352099b9fe892905cbcce7721765af31e5f49edb90d0ff354c6af08815c
SSDEEP 12288:yxJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:yHrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F2652375AF0F54EBED2AC335E8620716D99C0DDDF201163BAF3E2E683B31C5A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 44fda9340a27e84fd821b514932cf5cf7e324c7cddb6df8f4cfa59ba5bf814dc
MD5 99e436ab3421a442625d59831c589b1d
SHA1 25c1867849cb8dac619ffd334e8b711e25adf1e4
SHA512 affc5c230bf53b24bd1753b20da1a955112a35134c0adcd699d96a3842d5b524de04a95231ef34a122af81ca6109b4b6a9375a6dacf455b8fe412f2a7065dffb
SSDEEP 12288:q3JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:q5rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CD652375AF0F54DBED2AC339E8620716D9DC0DDDF201263BAF3E2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 514bd6c6419fdbe81f512c97f06e0545c07256c2e14a566f7e37792820958c7c
MD5 07ef0f23ea52903a4732cbfecf589850
SHA1 3536ee0e5aa11587dd4625f2249d350d232db967
SHA512 a24724115526bafdf0711aaf3cf60ebfe972e484170400e714eb674e5e612465806052d2dc4664228f9139d39f331dc4142804924847492f87e1adf5e81f223e
SSDEEP 12288:pVYJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:wrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D96523656B0E50DBEC27C338D8724612D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 7a0ba86c6ccfc7d0f68c40599e2d3aca5cf15ac3affcaa9ef14ce12713bed1f3
MD5 ec3fbe1ed35e8935968630a2d24d65a2
SHA1 f8ba3c14669ae4da7bd68fd4e89a561ba6dbc0b5
SHA512 f468c065161046c20e5c0afd8d606f2405ffa2e6e6a7f04a8ff9839dd390fc777825217c8bb83eeb5f1ebfcdfea320b88bb93da5bc1a1adcc53911e2e48f770b
SSDEEP 12288:9QJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:9MrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A8652375AF0F949BED2AC339E8620716D9DC0DDDF201263BAF3E2E683B31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 35240130ea296b66fec9f4c1cc310c35e10b4f68f8b86330ffce73e2fe211658
MD5 29d0831fb20dc16c2783bc5550535a5b
SHA1 5bad55b9dd34251a43de9bcdbc5934e7f02f0831
SHA512 128fe6b0145ed771d401715bdf33af20cdef5e3bb29c1c3d82a98995ea0cd4d2e554114033ca84b0fe4e4943efe9a26908ebbd78234df99c0559b1567e5e8be6
SSDEEP 12288:f1JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:frrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11D652375AF0F54ABED2AC335EC620716D99C0DDDF201263BAF3E2E683B31C5A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 568093f051a61d71bcdeafc786102b153cd67e97cfac335b52fe4b3a66c8dafa
MD5 3ec98aa4774756f9605254838f2c00eb
SHA1 ea50b87436926d2a4524b01e8a4272bc42c53f57
SHA512 0d130aed8e5217368bbd3a4190514e0112e4cd696eb04f2903d273f679ad27f4e0cbe361291d8c78fd58969c8888ddde0f6c24a1cae725c0cdad3a47e2f96f0e
SSDEEP 12288:1JJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:1frKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T114652375AF0F54ABED2AC339E9624716C99C0DDDF201163BAF3E2E683B35C1A1452621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4851c5cb75b8f6dbab91edb932c595377c000a67f7b2dc41094c01ba3617cf80
MD5 29c23020f770e349a2429cfc59e3a823
SHA1 49fd09f73654080828804e5d048a038a5b734708
SHA512 12118133d69566bcd86fb7bb058e82b0c7a86f8b5444407d27c70def2906fa3c281b715e0eb237a04e3846aa1d3c32b8b777eddce0fd10a0955ec5e615e94b93
SSDEEP 24576:KZMEzFVSOnrKhxr+EHNmT8oW4ll1JCrLKXI:KZMEzfqhxSMmT8oWgBCaX
TLSH
T1308502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0f489ab1cdc608aad1f144471ff91859ee60c78146eef2b24eff5bc32c8348f2
MD5 c6e198a8fe8fdeac38646b802f5d79f8
SHA1 af0152ea0c457471dfaf6195ee4e99bf0adb15e4
SHA512 d64cba44c516b7b93f9966108fe41ea344f1d289ccf70f511a824d442f089f716cd7a666188c6b1b6047c49a5d237452396eee65ec4f11bc58075034d8e724b7
SSDEEP 12288:xeJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:x+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T175652375AF0F54DBED2A8339E8620716C9DC0DDDF202263BAF3E2E683B35C5A1556211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 b90ced2fd060db044e738a992557094cca4fc08aa416017c2be3925e114cfb48
MD5 3b940ddf0e9f8d9a40f6f5be55a6f7d6
SHA1 ca471b12675de7bb38185f86c61d2dae4c695ed9
SHA512 29468bd143f0ac4f1bcb981316e2ca78876af1975282c68d8c0da636b56f8545fb925733d9c764d5e7f800fd9ef43ad6c3c34c4fc31528dee4914817e3d23cda
SSDEEP 12288:IaJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:IqrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D5652375AF0F54DBED2AC335E9620716C99C0DDDF202263BAF3E2E683B35C1A1556221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 f077602a20ea89705948856f4fe2327755bb60792942c84143820b34112831b1
MD5 1758b9d7287812b322611348486a82ea
SHA1 6397e5e883306eb2d9640d73185a003282cc7e71
SHA512 ff8134ef444fb1cfee7835d2090db44c1905b6aa1616803eaa055c317bd51e7810e4ada412ddd47f6b4fd8c2028ce5c633ad66ea1872bbcad8abed0cfeea81e6
SSDEEP 12288:EyPz5L8dJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:dzyzrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C5751257779630F9D5378238C8620A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 7a730db3e78c81bf98158ae89b0781c00fc260063529740be1989679ef8d4c43
MD5 fd2f30b5be1263d938929abb1f86e8e4
SHA1 d9e05a4c3ee253ea8f5cf71befed3e56b62bde1c
SHA512 0f3583c3a672579a84b71774fbdb0ab086c08211a8fbcd478ac1b2d33e3f5fb74903e1add5389511181f2b51de4ec8fd229cc35d00d297eb433079f863ab8a6c
SSDEEP 12288:LeJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:L+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C8652375AF0F54DBED2A8339E8620716C9DC0DDDF202263BAF3E2E683B35C5A1556211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 da4375b99099fba2988c444725d915be8ad7028f7cafc5b770313bd61eaeea43
MD5 d269178578c46e6c5f03092de75d97b1
SHA1 479469366b678e3748d850218ebbb65a9b816ae0
SHA512 bb07ea8161860f0ef71698e3806840c782e4e7a5eec86c8eaef71208822bd40999ca7fd1367928db4ed89967e64abda1fa5531271cdf7c81d4a09c7322bf8881
SSDEEP 12288:eeJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:e+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T159652375AF0F54DBED2A8339E8620716D99C0DDDF202263BAF3E2E683B35C5A1156211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 048aa8b91321fa3f26caa7ebca3ee95ee7c9265c97710249ed574fca91d2c0f0
MD5 2b6790aedfcdb8524d1604c0f4068cbe
SHA1 58ddf49b2f9390f047893f4d73b549b59472de2a
SHA512 8ed7f98171ac7ca9073e5972fe9357e48fe09cc5c013bada182ed142a26070dd4121ed6bb60bcdca2952b79761241a89170115608deaa6505095d355c3b08be6
SSDEEP 12288:AyPz5L8dJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xzyzrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19A751257779630F9D5378238C8620A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d23fa2cd0c339b14a2bf2602ebc5759293f002740df03e0f9007a0a9f00892e7
MD5 92f32ac83c377327aa48b8c67177612f
SHA1 af438a741efd3d6c76aa1f565ee064fe871db740
SHA512 0857c73383213b4b7a92feb0625fd8940967b43bc3ea9de13f1e99e16a6fa9317dfff261e0eb1d49dac18ef56faca2ebcdfccf2e386cb403cba73dba538058fa
SSDEEP 24576:UTdaLl3z0zDprKhxr+EHNmT8oW4ll1JCrLKXI:UTwLljbhxSMmT8oWgBCaX
TLSH
T1FE8502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 5868341b59e0bdc2c798e1612c090c605822204bcc3a7eefb25aeef5a27236c3
MD5 7f65fbdcb6544b82f15c476f31b12203
SHA1 3fc662fc31a67ae9c14ada4d035790aeba9b74b0
SHA512 12a3f4469c736b43934efdc7b7fb4b509373aa76799ace03dca1c5dbcf1a23313ee9ba97465bb7c0a773f8612f9393f6fdd9f03ce550323f604e28adc1574bc0
SSDEEP 24576:035d9CHKy7GZNrKhxr+EHNmT8oW4ll1JCrLKXI:+5d9CHKyaqhxSMmT8oWgBCaX
TLSH
T14195CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7a1cf5545ead13df8b41a92feadaea1b806a16c6aca02cbc26834153cc681158
MD5 d60e3acfa1ef36acbdafedfcd2daf0e3
SHA1 b9da4851f4b3eb02a7cdcce65a0c7b09dd4a9c33
SHA512 31f4f329af065f07637c68c2033839319623925a065eae82cb2355996ff421c61be63b8c22654174ea5f1a99fb3fca7abd871dcb6d8edc6bae099b6c55209938
SSDEEP 12288:BXJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:BZrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T175652375AF0F54DBED2A8339E8620716D9DC0DDDF202263BAF3E2E683B31C5A1556211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 83c93f35fe16b0342aafa764846adb9788f07eec8badfb1c872185fcfcf1affe
MD5 0312ef3231d4f1179fabf33e978187e2
SHA1 470a27d39e134bb5583b59a3f470fddef5327192
SHA512 5e6e521ed09f7da8638b7db831e115424cdf3b831c946cc5f55c01f6da2e6d238196487ef70bc22af373b592c2977d97eb7d0d3f9475b7cfd12986697d884895
SSDEEP 12288:d9JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:dTrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T155652375AF0E54EBED2AC339E8624712D9DC0DDDF1011A3BAF3E2E683B35C5A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 79baee1fa7c4151f9533123351cab0573ca0fd722a7ede09b5a1099b73e944be
MD5 e4bf4ad33b1e4a6854dd36fb7823371e
SHA1 463134a8369706ca7c758cdabdc755dd5e154bdd
SHA512 9b5f0b195214e28aeb5f40765dcd89cd25d237f0bac10844d71c4294a9db1945b38e9686265f291e99bab161b6f587dac9d69104ab8d05ca07ff3cc0bae82bf1
SSDEEP 12288:W0JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:WArKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D0652375AF0F549BED2A8339E9620716D9DC0DDDF202263BAF3E2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 d3469065ea7c568f5739bf9a2355d8aea87aef85b1b26b05da5d86267de57fa2
MD5 e6445772d2715bb4845b19078dff624b
SHA1 810a47ea6356fb90ba24dbcaa63c86b45f1f5429
SHA512 2e3bababde5181c82a0b1a97bc87f3bff46ee66005184a49402e2e77da6c5e15b009026e779045a85f5a1fd87a13ec94e23f2915f739d7bd0268e8d3440dc9a0
SSDEEP 12288:0eJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:0+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A4652375AF0F54DBED2A8339E9620716C9DC0DDDF202263BAF3E2E683B35C5A1156211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 90c01c360f78fb20278b0eb29f4e5a4800d71436ce67ec2fbacf47bcaf8a6c4c
MD5 6de86acf4761ac98ccf487802121f6a7
SHA1 cf07a72136c09375e1d5f65ff4a4cfde715d8c51
SHA512 323a3efb46a295eadbcef2a5b835cd1b66afcffdfc5b40653cd94d58a17c8ff22a0a0c0fb57e75daef40aa9118e3587200acd1f7f9bee41b70d3a231909e3103
SSDEEP 12288:YXJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:YZrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15D652375AF0F54DBED2A8339E8620716D9DC0DDDF2012A3BAF3E2E683B31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 59c9c79e93d74576f59723f07151340882f6a41c2596c50918ddd953ee4d8447
MD5 63b13d648a2a72a6c423cc2e716b49a6
SHA1 33dcaf19bb9a5563e21f20734c4f0ef2161c6700
SHA512 4a270f7a3420f4c8e220cbb765891316e03cb20855c3058cc8508c482c0ac68f6376468847389f03e11bf27d442e956d022882a9b6db5c041cc3eba66faa2899
SSDEEP 12288:l2JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:l2rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C4652375AF0F54DBED2AC339E962071289DC0DDDF142263BAF3E2E683B35C5A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 ef56e7be2d22c2d349cc98fb4599863eca9717d3e9aceb17a5b5a1f998ad842b
MD5 3f1ce441e92242316ade2400c718f825
SHA1 10c5dd1f4fd3b21a59b14cc90be8b35c15e557f8
SHA512 d1762666d42c3d367662fef4215efda65dbed8438ff90b34ba62d4d37ef7878889c081b670a0038573369ad088ce764cfdeda6dd7930510fb4d86e5edae104c2
SSDEEP 24576:sfwv+k9RX6wkyAI6rKhxr+EHNmT8oW4ll1JCrLKXI:iMnYIthxSMmT8oWgBCaX
TLSH
T1F195DF29EBDC44E5E177923C99B3460AF6B178691B31C6CF026A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cf9c3107fc5999b4b683b257c8b83d9a12b051564fc81cf4814f1eed42ede500
MD5 888c734c407d23e4e1ad69c0f376e125
SHA1 36f32f14901ba04483abb4bc5d475e71b6f9cc6c
SHA512 a0e4c41b6274781883c9ae0f25bc29fc579536b6b70a7c506af91bc5d7a0d246b83f8f02c2707987e98db4e9ae2750fe0f8cd9fd2ca4f43fd49a27383e28459c
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MhxSMmT8oWgB3:zySzP0+M4FHX
TLSH
T1F0066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8f0606be31132872059b1d5e2ae3271a11ffbec594c1ef3617e08792fcb3ebdb
MD5 fbf4ec7455b085b12613d2c983fac434
SHA1 6ce274d543f84c90a8018ae5e6c6f43e766eeca5
SHA512 5548eba09bc95ad575c2dedab5f62fcbf92460945447382aab13990c39764458c6251a58f9d87df491d7cf76968a5d3d8a972864bc6472f0190a334cf7756db8
SSDEEP 24576:X47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY3rKhxr+EHNmT8oW4ll1JCrLKXI:X47JUQj1irIhCnDHUPfF/8hxSMmT8oWM
TLSH
T1AF65AE1EA3EC01E5E1BAD23885154A1AEA71782E5B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 75940149358ca3cec14eefd336b411a968fd40eb224b53fb8c4a84b946ad3dc0
MD5 460238ff50316f8cb48cbccc02fbfd19
SHA1 14d1819928e0ca5c55601ff8e7f24a83d45489fc
SHA512 91ac082c298491c868d059df75afa14abb9c64b65f74c3784a06b5fe06daf5f01069f1e5174289b1dbe69700aed366089743eb05c818418bbed32b76cc4d7ee4
SSDEEP 12288:EzsfuJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:jurKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19275F11AD24801E9C46E9239CB524A01F7773C6993E193CB5BE0F93D2F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7ce99fe297d4c307e08db3040f94b464c22f86e9f7947f7a3aec55bc049efd82
MD5 e81c3ed414d769d409f436ec1c56aec3
SHA1 3f04923e54e0497ac5d689d813309373a1f2e1c3
SHA512 9a504325ce8a83ec67cc5de77bf83c224f7a1ae0ae188e8d16f33df0c3f48468ee5cb3fa2c79b1478267d11a1ec9d06f8ebd32c1a06cf76bc1b15b3e5dfeccf6
SSDEEP 12288:McvUfBqCht1KIt4i7atNJgxajdp8Bo72m10aRMz:Mvftt4vtNJgxajdpyo7H10aRMz
TLSH
T1C64518107666CB4FC66940325E32D2CCAB707D41EE05AF0373C98B3FD576A59BAB2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 7872828d8685186370431f7fcb161acece3dbdfae202db82dad0babfde25bfb4
MD5 6b25d9082b76d86318fe46bad2820ad0
SHA1 64a573fd43e8c20dbb95f9ed3535adfb85a25ed2
SHA512 6c15bd897968fdffc02ce8f19eda3561d5242770b8a923cc47ad5898cb288ef89879b5da7590af0302ad58ffc2495984b4dcb09ea1dd32d8614905b749753503
SSDEEP 49152:FgxajHgxajnY1agxajRY1P115gxajR5l5J2b2Mqz81:85l5J2b2I
TLSH
T1E1750A41A136A78FC1B7503203365F8DAB74EC03B7096F26B3C9457AD86AB45B4B93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 148ae544e62a9381ca214dbdc098c0e13c68ac2140f8d9d45531818fefdbd904
MD5 58b2c48a39c8dcfe9aa79ed9fc647ead
SHA1 84ee71e9e46db0c5bc401bf14cff0c188ca518e4
SHA512 43bb4d8d3473c58d6a9607f0669dfc449150c5a9c9309523bf5caacff20fea50b5e66ea56a17fb4dd8a562c231c4d2ad2273b5afb6c2702ae7f1933d04876728
SSDEEP 12288:NO7+JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:AerKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1996523719B0E989BFC3A8334E8664321665D2DACD30055FBEF2E2BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b61ac2b06edad156bab2abcb82ed0b03142f7c9146134ee39597c84ce0838afd
MD5 50b5169395c5c9ea69b717641fd1fe7d
SHA1 0939760d3de6e1b4d858b856c8b0af4c807c5b73
SHA512 b839ab9d208bb53bf048a543565b549fbf744b7c86810fcfde1e47752f53c2adb13c3a36666def5885ab287c62cd0bf7f787393b1b0865bfe6eac985498ca124
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYorKhxr+EHNmT8oW4ll1JCrLKXI:Ngb4mBIBhGF2hxSMmT8oWgBCaX
TLSH
T1AF659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 e123c536bb0927e841933a3a28dd497e59457b3629525a1fce822a6cc16f3bd9
MD5 d2ed9140ff56e570028ba8543628774b
SHA1 1443c126a870b83c390153daa10d8c24913d0a05
SHA512 cf14e457e7d70c43a9d7551ed831b6c37a5375ac72a84ac9d4d2c05fdc14a26108062c92e9af72dd15eefe6608a2305d9e3edcc02b7d03be287eed0399455275
SSDEEP 24576:aG88u8FpJqH1hzria7/mnrKhxr+EHNmT8oW4ll1JCrLKXI:h7ZFPqVoa7/ThxSMmT8oWgBCaX
TLSH
T14E95F16577E101F1D47BD138C9824663F6B2B8251360EBDF0BA88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5215ada2f6de99440cccab22febb5b2725635b6ed257090189ad0168d29a7724
MD5 632b66a3a8e09bac11d7e28860de7602
SHA1 62fbe0ebd4b70c3a328c5a6f74497689579ddd59
SHA512 f52ac638932574af49ac06361935d8c9099585c229a955c7ed558e8549f5517890f11294851474fec26888377ac5decf05e9606859146980e6c76fff69d91995
SSDEEP 24576:6PUr+NQfrKhxr+EHNmT8oW4ll1JCrLKXI:6JQehxSMmT8oWgBCaX
TLSH
T10E85F12F269D18E5E67AE13DC9828719F7717866131292DF02A1817E5F33DE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e81b1adcdbef316857b0a2f524355a043b98b45d997e678055801078fe7e5b71
MD5 0452346174b7bce409f8d218a5e20229
SHA1 1b6d08106af3cbc98440d29dba17a66c70445573
SHA512 730b521efa5d22e2846d5959952b9162c62e6ae1696c5ee09dca84bb711c287b8296e429f8feeb3469a0fbc07564b0f57f08e510e28ec71d43a68b93be5fbc1c
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6hxSMmT8oWgBCaX:nG05lO43bl+M4FHX
TLSH
T1E2D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 644c8a3e99d69ef82a04b04c2591a227eb52ee48480e3a18ce7c18fd7c3da8be
MD5 6fd694bcdef86ace05d3158996168886
SHA1 5be794115d85a383971f084231bf141adb3a40e2
SHA512 31951ab82271577d8c48c50ee4aa46ec44e9e58bd1c2508b9d9a58e920beb72a3528e651c3d7a81d0b9abff02c5d883adc5bec392921c85b6bf30e7099663861
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnFrKhxr+EHNmT8oW4ll1JCrLKXI:Ca5POZ3+Jt2pasx2+mihxSMmT8oWgBC8
TLSH
T12A65AE5EA7EC00D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 618a44ef2759ccd96133057c23c528cd1b39dab5108c7ea28e27022f6f441ff3
MD5 bc32e97f74bfe9fd55e1ccee2bdc77f8
SHA1 5af25dca9e72b45901151b6e1576c12089905b86
SHA512 96b07ec8ba10d8898fe2ff976d72688bcf9100d4ae769823c961415a586ede6792afbaee32519bfb8920042ddc8d347d7724853360bcc213e2cffeacd84c7672
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkPrKhxr+EHNmT8oW4ll1JCrLKXI:SNc/zEOVHFzhxSMmT8oWgBCaX
TLSH
T1E9858B2623E900E4E5BBE1BE89779546FA717869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 aa81a8c4ebf9b5558a4194d00684183d9b44538347f2bfe2002f3923064a3a39
MD5 e96c3910245eb0eb45c0d04461a74573
SHA1 202f5503bc1607815d71eb25d18d1e6d134f9cab
SHA512 9332c9fce54f970dcff0c679516b0cc7be4489702997762b735b1f94867526b7e71eb9326a8423b731072090e096fc2d9f84ffe9a260d75b4ebb96598b9969cf
SSDEEP 24576:96DI5lZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:96DIfZt5TkFyAnh1EVRh
TLSH
T16625011D73BB10B5D06BD03DC6924546D2B3B03187926AEF0688C5B95F93ED9BA3CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 159708bef1d39eaaec984400f5b4fdfabf826dcc662e843ac74a9970f6d720f8
MD5 83de9b613953df55cbd92f53a9823f04
SHA1 3b6d0861cde0d2b1f6ad38da0763df306998585a
SHA512 074b53df558e07c82ec6407ab2cb69db6b072a30c0b999adae9f2b419c0c3adb54bda3b8ce2a4bfd5e2d49826849fe9d9a0780f898e6a18ecd9e9d306d48db52
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBm1rKhxr+EHNmT8oW4ll1JCrLKXI:Q8MwBtOmchxSMmT8oWgBCaX
TLSH
T12855AF6EBAB845E4D1FEC674CD238512EA727861133293CB5390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 506e4044982d6dd35ca216a55edc99e4ab61cf566129d15aec9fcdf538a6c78a
MD5 711abea7fde37b3c20595949f2f91fae
SHA1 3dd8e10693ff928521597f0c934176543a236bef
SHA512 6e7912f57a3c684080161aa3cf06521b5b96f1c399a8803640184ab3883c314030d3ae34f5a03d525ad81486a6834889ba79248502831144793f675e73e207a0
SSDEEP 24576:zD3FHshBIYQgAirKhxr+EHNmT8oW4ll1JCrLKXI:zDVHeBIAAVhxSMmT8oWgBCaX
TLSH
T11C95E17DEB5C04E4E57BC17CDA638A06E77138AD032266DB069481B91F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-97-0x00000000040D0000-0x0000000004137000-memory.dmp

Download

memory/248-9-0x0000000002E40000-0x0000000002F89000-memory.dmp

Download

memory/248-1-0x0000000002770000-0x00000000027D7000-memory.dmp

Download

memory/248-92-0x00000000040D0000-0x0000000004137000-memory.dmp

Download

memory/248-17-0x0000000003110000-0x0000000003195000-memory.dmp

Download

memory/248-0-0x0000000000400000-0x000000000088F000-memory.dmp

Download

memory/248-113-0x0000000000400000-0x000000000088F000-memory.dmp

Download

memory/248-8-0x0000000002770000-0x00000000027D7000-memory.dmp

Download

memory/248-10-0x0000000003110000-0x0000000003195000-memory.dmp

Download

memory/248-62-0x0000000000400000-0x000000000088F000-memory.dmp

Download

memory/1048-148-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1048-339-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1048-141-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1048-142-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1316-343-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1316-169-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1316-176-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1572-129-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1572-342-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1572-338-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1572-340-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1572-128-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1572-135-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2580-89-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2580-322-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2580-83-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2580-81-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2992-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2992-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2992-23-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2992-31-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3524-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3524-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3524-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3524-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4524-54-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4524-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4524-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4524-48-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4524-58-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4684-122-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4684-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4684-116-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4684-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4684-355-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4684-115-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5540-336-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5540-100-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5720-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5720-164-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5720-162-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5720-160-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5720-154-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5980-74-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/5980-282-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5980-63-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5980-68-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download