7b043a85a019d027f82722aba80fd80bc55698d33dc24887d1064c96ff2ac141

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Size 8.3MB
Sample261024-aptmgagy5p
SHA256 7b043a85a019d027f82722aba80fd80bc55698d33dc24887d1064c96ff2ac141
MD5 afe462a542ce32765ae913534527a911
SHA1 475f89249157ceeb360e070aef41adde1d75ee6b
SHA512 928e0b1a8c68a7f950924db5e755d6db8087abe2e45f6d77da3494db5c9613319eb143b2f63c8fa113662e263e1209e4f53b533c815d5e984e3556ffc9e8c2f5
SSDEEP 49152:xv/s9HH2SymctA5cdiTj9syuJRVIgXP2qrX4nwFu2Q7iChrK/e9m+tgauhwbR3P+:xSn2So8j9syjnwF16hrK6gaPJrJTy
TLSH
T19F96C251A113A81AC56730F56BACA33805480FB9432747D774B4FAAAE7722D3FE3194E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery macro ransomware spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x000300000000072d-650.dat
behavioral1/files/0x000300000000072b-651.dat

Executes dropped EXE 19 IoCs

pid	Process
2244	elevation_service.exe
4376	elevation_service.exe
3804	maintenanceservice.exe
3740	msdtc.exe
2288	OSE.EXE
4484	PerceptionSimulationService.exe
2592	perfhost.exe
3944	locator.exe
4124	SensorDataService.exe
4888	snmptrap.exe
952	spectrum.exe
2728	ssh-agent.exe
3928	TieringEngineService.exe
2832	AgentService.exe
2508	vds.exe
3140	vssvc.exe
4908	wbengine.exe
3512	WmiApSrv.exe
4828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e224536c665fbf6.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000023463-317.dat	upx
behavioral1/files/0x0001000000016794-642.dat	upx
behavioral1/files/0x000100000001704b-641.dat	upx
behavioral1/files/0x0001000000017815-640.dat	upx
behavioral1/files/0x000100000000c538-638.dat	upx
behavioral1/files/0x0001000000017430-636.dat	upx
behavioral1/files/0x0001000000017bd3-635.dat	upx
behavioral1/files/0x0001000000017066-634.dat	upx
behavioral1/files/0x0001000000017010-633.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeacce094e63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006066e7004e63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8cb32024e63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a41371ff4d63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000654283004e63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004396bb014e63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fec7e9004e63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2244	elevation_service.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeRestorePrivilege	3928	TieringEngineService.exe
Token: SeManageVolumePrivilege	3928	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2832	AgentService.exe
Token: SeBackupPrivilege	3140	vssvc.exe
Token: SeRestorePrivilege	3140	vssvc.exe
Token: SeAuditPrivilege	3140	vssvc.exe
Token: SeBackupPrivilege	4908	wbengine.exe
Token: SeRestorePrivilege	4908	wbengine.exe
Token: SeSecurityPrivilege	4908	wbengine.exe
Token: 33	4828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2244	elevation_service.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
2184	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 5016	4828	SearchIndexer.exe	112
PID 4828 wrote to memory of 4820	4828	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4124

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4888

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:952

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2728

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4740

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3512

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5016
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 83e77247b8b73ebeaebe797e36a024fef700dd6c327a2a13b153d19768af5d88
MD5 704f6d5c54087ea87dcd5d19b34c8e58
SHA1 147d2640f748400cc059d3c43e3b72ac9d2825ba
SHA512 46025f477953f19386cec466d8aaca6b06305fdbabe5f59ad2ad964ee49334607a064a8e3344f85b8144bf2c87dbb10f8dbb7b1ba5248062e343a507e87ddadb
SSDEEP 49152:mb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn5+tgauhwbR3P8wT8:Y3q6mjBNgaPJ
TLSH
T127D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 e47500810eb947f3cbf755078a1b05032977e0d82e5c18025a97ccded1b8d9d2
MD5 c02329fcc9b423f4c02a11067ceb5831
SHA1 5aae8b5ee4963faaaa26bfc22f1138485ec1ac60
SHA512 0e37929c972e7b56a61296f0ba72cb6216e16a281b8875c8070ed2dd8398e212f85fdd4289c8fd15206cf5f2c3272686295aab8ab3c64fdcb49f7f05731c591c
SSDEEP 24576:lXYsptczAG+4ZAgayjhwbmY3MaReFeDvSP3blaKngL2jdshRTdG1YxITqvfPkbIp:XtcP+tgauhwbR3P8wT8larSj8RoTCCW
TLSH
T12CC51229A3C409F8DC6B4338CEA28901EA737C954755E74F43E4AA694E737D84E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c5b7bb2ac56c1e4c499649bcb4be79085f0a6f9a2db767d418f40cf591896661
MD5 8db25d4073d60e1f7f1b3a2326d208ef
SHA1 f19c8436e20e931df00f791c1136426fc7f44c13
SHA512 822c09c7b7503956239f73bf7555fd5ba128617a846d41dd3e08dc0c2ee08c23973a43086c957401aa6fe41988a2475fa95fb8fcf1fa1441adf11f9f145081b2
SSDEEP 24576:fXYfDtczAG+4ZAgayjhwbmY3MaReFeDvSP3b:qtcP+tgauhwbR3P8wT8
TLSH
T10D85F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 4d14374b1f0944f972555d9b17075a62b39d5bc5a1922b7da0b37dfca5f7f942
MD5 9aaa836d243bad3855d6bd1945381a8f
SHA1 510b9ca89505b280f49f0a5d3c752a1356a767ae
SHA512 a9a383690b77cb7eddb6e1936e1c5e9e8150ae6c89b5f64a7b342180e305a8cf979bc2cc35294ebe7b63adf0452689682b64d0a78f1e9f1c3951ae7aca5d0045
SSDEEP 24576:/wuROWU+4ZAgayjhwbmY3MaReFeDvSP3b:/wSOH+tgauhwbR3P8wT8
TLSH
T19685F14673A80CF9E9674238C6978532F7F2BC022A21DB1F57A0C75B5F73661AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6749072d709f40c553ec0f22a2e98fb59ffde20ca132baf31c87f870722473fe
MD5 0c348b9570a332a638d938a05945bff7
SHA1 4a6357e015eb779713d66e63c7730cf96856346e
SHA512 df6e24f6550e3787b0f6657b38d86f102377ae2570a8059225068bd0458fbbc1740068070bd169e4602b293ea4d6bcc800bb40e6d686d8ad568f707c772f7935
SSDEEP 49152:4B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl2+tgauhwbR3P8wT8:Su6JmIxd2d5gaPJ
TLSH
T1F5D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 0089c24e3f0423f4f8d0acd2450e06840334f8886be01bb1ed3cfb5b4b0a7a3e
MD5 d95038568168e13cbf549e7619d6c36b
SHA1 18eb218443cc698b1566ac13146474b0b5bf78a2
SHA512 d44bf44e99290b2856a48ff91619d9422756f3c4c6ba0ea8595f355e6f19d132e79c20c915bc95bac5cc30c3055ba38860db2da19fba62b6a0ce50b142625b34
SSDEEP 49152:AP4m4IpOO6708Kv+tgauhwbR3P8wT8KarSj8RoTCCW:YppOO1YgaPJrJTy
TLSH
T192B5DF2DABDC0095D0BB927486658A49FAB1782E1F3286CF1160933C6F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 fdd6f351e67c3a2c70cf4608f3c6f3963ee968eeecf030af89888fe9a9d6ce8a
MD5 a67b07484aa0ecb89ee9d278cecc690f
SHA1 aac80ed7c24904b692fd9d32c0febbfc1f7eb00d
SHA512 9975f554dea9cf2162c4ffa5fe318f3f5f9f74664c9d7fbe88c511329ab5f4245841e3e239c2805b8a09f3859a98f81b056deb5afedebb01e8beb4e6996288e7
SSDEEP 49152:KP4m4IpOO6708Kv+tgauhwbR3P8wT8KarSj8RoTCCW:yppOO1YgaPJrJTy
TLSH
T1C3B5DF2DABDC0095D0BB927486658A49FAB1782E1F3286CF1160933C6F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeRestart.docm

Path C:\Users\Admin\Desktop\ResumeRestart.docm
Size 776KB
SHA256 ed96bd6514e9dd5adbc6825b91b84aa47636ae63868ce6b101c5bfe30e6f5d94
MD5 7eaadfaefbead4b82bf69eab4a18ef5c
SHA1 ec10b2f46daa4e94c00ac0825305a407eb0510e7
SHA512 fd8bbb444425991010d566ea635b7db12b5baf1af3a20ab79deb9e4f5e09e3d80eb137035c1ce857c82bfa9c435938f18dea80ef06fe6215c5b7a5a03d374c2c
SSDEEP 24576:Qz4zH7jd6vqDMDag5gdCpdISrsDyxvXJYHzPAC:QzCbj8SMZqdujADyNXJSV
TLSH
T1DD0523581E81D8F5E6154775B0FDE85960EF07771AE29AA5B728E3730AB80E34B23133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockGrant.docm

Path C:\Users\Admin\Documents\BlockGrant.docm
Size 778KB
SHA256 ec36aeeb770f89ffa13194a5370b46fa82b8abd4a2a8658945e899527964e9d4
MD5 fdff00251678dbb301df28f2684446b7
SHA1 135580e2c65f4d7e94af5e7d0305b0449199cfbb
SHA512 61913de39e0ed75eada2747d3eabcc9fa24cb130d61990c8d18c3811880529efad46e41be8377d0d7d550c6596e4874a760db3f76ddb1125af453e7357f4932d
SSDEEP 24576:eX4zm7jm6o/Zugo0aI8NUSuBFSOXJxHI3Ou:eXCajf+ZJo3IXSu7FXJu+u
TLSH
T18305331818C68EF9FA684B30F4C9A6C370EE574299D0EB73D31C8A7B19765AB8343157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.9MB
SHA256 969fa26feeb41e48cb2378559fd416e77cd1a2962d60fd6f36f791eabacb3b78
MD5 6df42a498b40cbb3ad393324df6b5fd8
SHA1 e04d390ce8d222ff3128c024a2996173fa26bf1e
SHA512 93bb8dce9aa3da6dc5b5de4e9d000dbd1194c971996e1a514d342929cfc9e2435bcb859a82144496e4b2a5c53ebba65b8603043e27bcb644b44048f985e73487
SSDEEP 24576:F3n3i63il+4ZAgayjhwbmY3MaReFeDvSP3b:FX3iMa+tgauhwbR3P8wT8
TLSH
T10995BF02B3E99135F2F31B31AFB592615A7ABC729D35D20E23C42A0D4DB0990DA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 6b4f9eadac800b0f40093e86ecb7990c444762ee18a2d1830f394282e99948b7
MD5 5540ae9b2bc0c776feefb7ca6a44ab02
SHA1 93530e6f2e397e5aee2837a8a5076751251dd411
SHA512 1152aaa3d4d3bc66fbd4c2173406f0a6c0bcbe5181ce0b57db4ccacb889a135f6b119b3ad65ed73b39e0b4dfa90ad8eb04bbc6b20d9aaa52521125f12c068369
SSDEEP 12288:aYeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:ap+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T151652341D34C988AC57B0B304B3A4930365EBFE62F41A14AF98977998CF0DF98EB1359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 48a537ee1416a85e4d7bee86a6e49a170e6a4923b35da7e5b8da35f6bf100301
MD5 79d85871a59d16c4807b56dff680103e
SHA1 0cc559fb5e59dbd1121f78796875991be49cee9d
SHA512 464fe2a5528109c5e05a2e0a944314d30b125dc1b05b1e10e988fe578d93082d716546863d636c654b37f803153af67ba586919d53b9ec466f03ecccb33a958f
SSDEEP 49152:8a0h2GEkuAe73q3pp46zwwQT+tgauhwbR3P8wT8:8a0hNYG4JwDgaPJ
TLSH
T12885AF1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.5MB
SHA256 0d18fa78df47d5818a5b9a8050f091c4831782c83fdeb876bb5a6476b073269d
MD5 ed600d2dac412ba0512682ed935aa6dd
SHA1 4ae616a6b21ee6dc643c143090962e6cfc4c2c16
SHA512 0e9589211dfae4c6731e12ad5a5ba3c89f782b7f7e7e0cff11b5a016855662f26fe5f2cb87a544db1550b6537621d1d59785c795f96337def255edcb3eefe1fb
SSDEEP 49152:8a0h2GEkuAe73q3ppj6zwwQT+tgauhwbR3P8wT8harSj8RoTCCW:8a0hNYGjJwDgaPJkJTy
TLSH
T1FAC5C01E67DC82B5D0BAD278C9A6854AE6F2B4260B3156CF1190853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 3176a64f57832f177634b0a663bc72c32fd683c53fdfeb4b3e09a9ff3d77365f
MD5 0d4ae01fb2e7a4958c59c62f7e5d0e47
SHA1 02c97a07288e16a20511433aa18658feaf1e5066
SHA512 8ba686941de2d4337774ebca8bddfa3f94b64510beb8884363eb98830d1afe8953ed6f928eb0940a2f8884b7a19009eca6c36e569cf9d211093d3c6c97ba32f4
SSDEEP 12288:G0eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:GV+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T186652380D20C98CEC56B07748B6B09206699BF962F4662C6F8CD7795CDF0DFD8AB1394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 64cf0a6e59f4cafb80e70a9019f5eaae9052821fb08d5816489e6909779654e9
MD5 a315c2d86acee689d9fd2abbfa7b4fa6
SHA1 354299ed48717c6ce6034efd9dead6bd0a4606de
SHA512 b695021974e111b9f612c4b877f62ec582a7b97cdfbee50c024c1408c4e1e98650735018ef5772817ddff588098a1387a7c88a0593a2d6f4a80098be3ab2dbe1
SSDEEP 24576:MAL3UTG+4ZAgayjhwbmY3MaReFeDvSP3b:MAL3Uy+tgauhwbR3P8wT8
TLSH
T10C950144E79800F9D97B823CCA668A12E272B89D0760E7DF43A84B651F737E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 64af8387de93331e51252abe5181d257150c2e7403a96d00e9423cb029c14fa0
MD5 92e8f18f35ac83dad0081788b69c867d
SHA1 70df7eef65a3d5364f7753b4d5f7c675c8db7f12
SHA512 f405af03948d3e0e26ee98f2f3c358919b7ae316149afb9a4e7f7f2b544127af4acb60b442e171829b9db6be7125fe7cf8538ee932d69adbd98294ed2b97954f
SSDEEP 12288:3pFtvO7eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:hOS+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T182750219339C10E9D57A523C8A974205E3B1BCA61B1253DF86D092BE4FB3EF89C36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 236a35abb789678dba540343256d9b6be05877493784fe58892eaf6836d295f9
MD5 570528ed8f07b5c6fbfd69946738bbae
SHA1 aee147c611f999d4566a2930a67853ce11b80c8a
SHA512 aa13a902b9b505c516c457701603f83d4d6ed9f5d89ebeedf99b84baab839a85080b7f9466391ec9ea833d03d79e9b2beb7a86dfff561ff5ce12296c825a3f8c
SSDEEP 24576:m7NM9YqZqmWMUkPjZM48Mv6bEhsZ+4ZAgayjhwbmY3MaReFeDvSP3b:m7cBWMpPjN8DbEh8+tgauhwbR3P8wT8
TLSH
T16165AE2E6BAC81D5D477D13DC9A28205F6F2B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b85e8bf7fe23e25f5b9cb87707d6b0211997f6db7fb80ac189d26c192aaf0cf7
MD5 1ac6f6e230b37589f86c36409ffa8779
SHA1 f744d6b727b228f5d4e2e37f47ec8e39b9ee27b2
SHA512 eed315d531ef09914657799fcf44d6b11a3b94222f892ea2d362807813b7ea9d75ca3aafb3a49f3bf04fc9b1fcab3c21c99d5f8c776f69b0a8fc95898fcc8375
SSDEEP 49152:jF2YuHNETovAvNYf8km5+tgauhwbR3P8wT8:S6BCf8kVgaPJ
TLSH
T1B0858E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 2.5MB
SHA256 024423590b05d8cf9d7213c30000168a7bc9bae76a5b1194556e875ecbd1c467
MD5 a61e446d88bf6970c8a4665ffa348cbd
SHA1 21f9987b1c31552c3722eb607d109645112d046e
SHA512 0c52fdc34ce8af183472f58702528fad86e1e69c07a01e5ee6ee7e87ba4176943f5d83ae460665139bbe661d5c6349c411b0e1a7444e36cde4240c3127141cf6
SSDEEP 49152:g0K+7mSLb+tgauhwbR3P8wT81arSj8RoTCCW:XOgaPJYJTy
TLSH
T118C5027EA39D14E4E47BD27C9A538906F9B23865031266CB46D0C1BD2FA7FE43939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9fe796e45749b6fa59f626e34ea398893d71a39d54a51530bbf5a4655a89c5f9
MD5 d9026cec432fe79f07f6fbcf4cd9bed8
SHA1 71914e67a20816dcdbf2faa84874d22995e1cc88
SHA512 fe08ceba707e39ea0654239cacb9d5018681d48ebf126dbe51416232cd37d8c7487e7ff05a9edabc1f643ed6e5a20700a9ceea1420adc8f28339d091f9a34523
SSDEEP 24576:AAFs06+Omlf8NXEbToO+4ZAgayjhwbmY3MaReFeDvSP3b:VFs060loXuz+tgauhwbR3P8wT8
TLSH
T1FB65BF2F62AC00D5D07ED17D8A97C916F6B1786307255ACB0160867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 8ed34408b3562a3cc0127f5ce4da456f3100b4fe20683e98513e278a9da68b03
MD5 815402d8799cb9cce8ee20ae7406d5fe
SHA1 e1ef790b181ecd6a144092220682ee3e17c87abf
SHA512 701f92c92a22be9e5fb10457fcede00dc3ab7fa3d862095bf073822411ccab80351e5a3bc4ce0fb38567d5670b126fe3ed9d4d616f559007fa3a9a4c2e7cf2f9
SSDEEP 24576:oJnJ5D3WXz+4ZAgayjhwbmY3MaReFeDvSP3b:oJnJ5DGXz+tgauhwbR3P8wT8
TLSH
T11385D02DD2A810E8D4B7C374825A1B51FF72386D2F226AC768B4D5357F22EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fe942f2f20110584aa31492b8c8ffa30f72915b843de3a597ba708132d2ccfbf
MD5 3f4df80125a70ec0a897fe11f96f0c07
SHA1 e6847a001091969468cfdead8cba29c0e84fc6c9
SHA512 f1f0298d49d57f4198571cbafe48c12388d459b38e22d36a10df4ce6bcd81bafc25d82c83ab3fafb1142185dabb0dce2f1ccd05a96e0464c2c47489f3ae5eefa
SSDEEP 49152:cg06DIKdwc+eQnSt65aV9+tgauhwbR3P8wT8:NqgaPJ
TLSH
T1BE956C16B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 75634d9b438d8931ade29baf5efe7cfd5e0429a3881d63aa4d722b87cadc43cf
MD5 c056fe8f49e7c35a270f75131efc70c2
SHA1 352a697d5c3a4058928b01dfc310e83921c83591
SHA512 12cc3b462545f07935c3ef4595d2af5caaa3992b0dcb59738b003bca5a056b834771fd4961ef68033e9e3aead5e910b88d049ead3375f2e0e06876cdecf76874
SSDEEP 24576:MiwaKngL2jdshRTdG1YxITqvfPkbIcbjLm:MiwarSj8RoTCCW
TLSH
T1CC05126EABCC61E4D12AA27C69A18549E7B3F178570317DF46E0827D0E77BE52D3CA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 fb9811c762ab4fe1ee840c88bc81d4a7aa106a98ca8eede1e06934e16d261e75
MD5 b69837c641993787ea0cc87f5054c352
SHA1 645fae0a7eacb33c9dd2dc1480962ba5fd4c2244
SHA512 6cfdd9e099b9cfbebb20eac1fd5bc722c4d4ee562e087ecd85470dd867a54203faab9d8e267eb749859d906c85ced2dd3c7324794fad0986590b126595705967
SSDEEP 12288:HjkyheH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:HIys+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BC751244A39894C9D67A0638CB7742A09A75BC612F1193DFA0C0F73E9EB1FE89D30B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 2.2MB
SHA256 623fef8b0d1deea903c293a7462542839454ff43e14aed39e0224dc2078ef8ef
MD5 b72cb2f729ed4b460e1bb6effa983e8c
SHA1 42593c2cd1df599ca9ad11096c3b694138eab924
SHA512 7cc65b8ec6e81f27f48bdf7602a41c148f41d88e7804ce647a976909fef946e6c1939e00b6595aefc23b0ea3265bfef4a3131503f16e67d822e5d0a09bcbb748
SSDEEP 24576:SG+4ZAgayjhwbmY3MaReFeDvSP3bSaKngL2jdshRTdG1YxITqvfPkbIcbjLm:SG+tgauhwbR3P8wT8SarSj8RoTCCW
TLSH
T179B5235D93CC25D4D43727748B7B494029B2BEAA170756DFA8D0EABD8FB2EE48538700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 e58294f466f41ff32e088c7e2d211c1f9e15aaa9a11db4be29ca1eb8d66eb654
MD5 2e3917d96e91ef03c6f466947278d3be
SHA1 9294f602cca027d5f146756669ba4e2fe8c9607d
SHA512 648b637ea6fec05d165846a4dcfd771adbc436df8ae368993fc1e7dd4640883bb9e3f5aaace5e3ef7a42fc9cb942b8c26de7027e2d10c025d7d59f02c5a140af
SSDEEP 12288:FyreH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:ki+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1E9652344921C64CEC92B0774873A0E606269BEA62F4271DFF4C9B7B5CDF0DE946B1784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b2275ba93e09c465e9ea819a4f3e85b3b2a053c4bfa5ff0c6dcac7f00872317a
MD5 a666d2f274fdb079e2e4f309c3066108
SHA1 770a7a303b3b910fe934820f3a5ce889c1d8d811
SHA512 875b43b99917706da3ff54bc2fd4f61f9abfd918aff6c06deacd8e2434539172ef11efeb13197b7b87217f981a9eb64921e5af77ff843df47fedabf04c197014
SSDEEP 24576:VQ9MxZKdcz9dw3B+4ZAgayjhwbmY3MaReFeDvSP3b:VVKZB+tgauhwbR3P8wT8
TLSH
T13E558D2DABE9058AE177D235D5A240C3A673B4311B31D6CF2448D13D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 e0cfd4313d3f012cfed3263ae619951b170987a94d0ff374e5a02c9bdb3cfe95
MD5 dc01a943bcf48cbf7473f1bd7b11d199
SHA1 00692651d2f16adc4003d4f79d9cdc1cd4964c0f
SHA512 928d296783cc1e00a6f399120772ccba4828ad98a6090d6551cf3c50ddce902ebdb37af1058932f3e3f396f98c5db67f5eb4c8ff6eec23ae17438bc77eed5a38
SSDEEP 24576:kyocDApY+4ZAgayjhwbmY3MaReFeDvSP3b:ZocDApY+tgauhwbR3P8wT8
TLSH
T19585E01FB76D40E2D176823C8A858641E7B3B4701B6263CBA591C33D8E73AE9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5bfe2824f3164d2b800b37303a86c72cf4389e612537b65e7fc672f2a549aa48
MD5 01607db4df32e3485aaa4de6cc90da06
SHA1 615edf56fd7d2f1cd0c84136615ec99c1c8d4ffb
SHA512 ab6eb337fa26da154a9c970a8ac44066f9e7d009decde5251708833324762f1ecf1765c69f447fed7840583f7e64a4354bf95f2e023f07c4166cea4de0015528
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKY+tgauhwbR3P8wT8:50zuNIJgaPJ
TLSH
T1BCA57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 dae8dbc57834175600db56109d060da704768c470d9971e36d3ace98bdcd11e7
MD5 e4f402c8b24d61593fbb610d387908bc
SHA1 e544c3285b6e8c04ab16562cd7f67a16b13d7f63
SHA512 e79d70f17848aac72d162536b63bf163bacd91182ebe8ae068c45a553337e2e4672eb32be4ee534896d9b369b9e284c4fa788d42cc2b0f76dc8ef2da35fe3baf
SSDEEP 49152:Za0h2GEkuAe73q3ppj6zwwQT+tgauhwbR3P8wT8harSj8RoTCCW:Za0hNYGjJwDgaPJkJTy
TLSH
T1C4C5C01E67DC82B5D0BAD278C9A6854AE6F2B4260B3156CF1190853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 bf76f24798acaada1c7f9e204d9fd427cb9b48c205aecebbbd5308f56a906357
MD5 a90b71e0aa789c5e6f0885697df0b541
SHA1 d8a58e4098bdf32023c1bceea12439814f692a96
SHA512 735ca1efb4f0578a69eab0d24ec2112b3df43ba653c57b35dd3ef44af0ee7af3586f4e2cd65a7f76f5b01fb8abbf427604bb36cc5ca7f25a836c446c8c12f6a0
SSDEEP 24576:P1QT7EcpfxR+N5AWAz3ooiYhjMqbwaKngL2jdshRTdG1YxITqvfPkbIcbjLm:yTDxR+N5YzTTjMxarSj8RoTCCW
TLSH
T14A75C12EA7F815E9D17E86799B23C506FA727821033193CF42A0C17E1E6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 7ce2bffdb64dc0f336d2e2691d7908c4bd73b01a0abe8b303a63d9319032cc6e
MD5 53e8d079826d38513e93115b27c21297
SHA1 4ba096c4c7bdb48a6c7fc1c112256b6ff02cbf3f
SHA512 f3dac39df64a6f5739e817af0f8a03d3b7b281e13e5c2888bf4b8a23e6285820b72a365e719a3bffb78ebd9634e98be34b84e99b1936678da765cef82d21a3a8
SSDEEP 24576:5hbHjPSaKngL2jdshRTdG1YxITqvfPkbIcbjLm:5hbHj6arSj8RoTCCW
TLSH
T1AB05127E5BDC12D4E176A37C6AA6894ADA727929170683DF46D0827D0F3BFE01D38B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.5MB
SHA256 de85ea6390b6de936ff5af9f39aa49cc85a7e8210ed69a82c9d4152982900c24
MD5 6b267657d9bef27999a04a02690a1a73
SHA1 47a041d8a2483281eefb6a0891f313a224f3f7fc
SHA512 e6192fd2f76127118319de0db1c7998cedc2732d90e6b62278273c4e41bb68e3a3ad8316b8b8f52211821df3b3fd3b385078c669df6ac0288b15832ff8da3e18
SSDEEP 49152:y0K+7mSLb+tgauhwbR3P8wT81arSj8RoTCCW:pOgaPJYJTy
TLSH
T11BC5027EA39D14E4E47BD27C9A538906F9B33865031266CB46D0C1B92FA7FE43939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 14c665a143570f6fe05e4ef36d3f16375253b09c23b83965193d270f83194841
MD5 bfae8fa0664b6547b6ba2054cc8403d4
SHA1 35c60dc0e3f7eb8292b99b5598b62ada2a2eb203
SHA512 0719475d449cacd6c76b0d5ca06ef2638a855d595f2e2baccba9a4dbec57f3c0c0b88b272d7d34d01ce61332cc5afa5942afa6a72b778b2ca1a03229a8aece28
SSDEEP 24576:iwYgnJcRTk4yti+R5dUR/yaKngL2jdshRTdG1YxITqvfPkbIcbjLm:iPgnaTk46pUR/yarSj8RoTCCW
TLSH
T1A565C02EF3B910B8D8A6D236450147B5BB71782D1F219ACB0170C538AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.2MB
SHA256 14f5e63d120203c9891eb0dc0827d2d51bb72edf28b66113d9e3c90f75311977
MD5 5bd2ee55cb1e616a3e775e98346259e8
SHA1 8fec489f6ec92eac3b8bb0d965ed23beb547af87
SHA512 250df028bcdc1e0a2f0f85cf3d8b1c7fc98b4f454e02577afe14194e944bdf25572eaa1628862f6ead16c9183312f1f90791475036793deceb5c3a60c7df9ca0
SSDEEP 24576:FG+4ZAgayjhwbmY3MaReFeDvSP3bSaKngL2jdshRTdG1YxITqvfPkbIcbjLm:FG+tgauhwbR3P8wT8SarSj8RoTCCW
TLSH
T1C4B5235D93CC25D4D43727748B7B494029B27EAA270756DFA8D0EABD8FB2EE48538700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-378-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/952-131-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/952-132-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/952-124-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2184-13-0x0000000004820000-0x0000000004886000-memory.dmp

Download

memory/2184-20-0x0000000004820000-0x0000000004886000-memory.dmp

Download

memory/2184-1-0x0000000003CC0000-0x0000000003D45000-memory.dmp

Download

memory/2184-67-0x0000000000400000-0x0000000001B6D000-memory.dmp

Download

memory/2184-6-0x0000000003CC0000-0x0000000003D45000-memory.dmp

Download

memory/2184-8-0x0000000000400000-0x0000000001B6D000-memory.dmp

Download

memory/2184-0-0x00000000039F0000-0x0000000003B9C000-memory.dmp

Download

memory/2244-42-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2244-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2244-33-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2244-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2288-78-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2288-157-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/2288-86-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/2288-84-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2508-427-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2508-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2592-105-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/2592-164-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/2592-100-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/2592-108-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/2728-422-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/2728-138-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2728-144-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2728-136-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/2832-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2832-154-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3140-161-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3140-428-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3512-430-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/3512-169-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/3740-76-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3740-151-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3804-64-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3804-72-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3804-58-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3804-70-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3804-69-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3928-149-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/3928-426-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/3944-114-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3944-168-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4124-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4124-405-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4124-173-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4376-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4376-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4376-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4376-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4376-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4484-160-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/4484-89-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4484-95-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4484-98-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/4820-466-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-465-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-442-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-445-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-446-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-444-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-443-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-452-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-455-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-456-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-454-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-459-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-447-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-472-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-471-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-478-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-477-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-476-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-475-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-474-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-473-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-470-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-469-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-468-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-467-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-441-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-464-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-463-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-462-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-461-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-460-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-458-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-457-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-453-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-451-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-450-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-449-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4820-448-0x0000014E6B360000-0x0000014E6B370000-memory.dmp

Download

memory/4828-440-0x000000000D810000-0x000000000D818000-memory.dmp

Download

memory/4828-439-0x000000000D810000-0x000000000D818000-memory.dmp

Download

memory/4828-435-0x000000000CF00000-0x000000000CF08000-memory.dmp

Download

memory/4828-431-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4828-193-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4828-251-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4828-209-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4828-174-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4888-320-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/4888-122-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/4908-429-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4908-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download