7b043a85a019d027f82722aba80fd80bc55698d33dc24887d1064c96ff2ac141

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Size 8.3MB
Sample261024-aptmgagy5p
SHA256 7b043a85a019d027f82722aba80fd80bc55698d33dc24887d1064c96ff2ac141
MD5 afe462a542ce32765ae913534527a911
SHA1 475f89249157ceeb360e070aef41adde1d75ee6b
SHA512 928e0b1a8c68a7f950924db5e755d6db8087abe2e45f6d77da3494db5c9613319eb143b2f63c8fa113662e263e1209e4f53b533c815d5e984e3556ffc9e8c2f5
SSDEEP 49152:xv/s9HH2SymctA5cdiTj9syuJRVIgXP2qrX4nwFu2Q7iChrK/e9m+tgauhwbR3P+:xSn2So8j9syjnwF16hrK6gaPJrJTy
TLSH
T19F96C251A113A81AC56730F56BACA33805480FB9432747D774B4FAAAE7722D3FE3194E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 3 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000300000001a3c2-424.dat
behavioral2/files/0x000300000001a3c1-425.dat
behavioral2/files/0x00080000000187ba-426.dat

Executes dropped EXE 11 IoCs

pid	Process
940	elevation_service.exe
2984	elevation_service.exe
4380	maintenanceservice.exe
4712	OSE.EXE
2640	PerceptionSimulationService.exe
3740	perfhost.exe
6088	ReFsDedupSvc.exe
5488	SensorDataService.exe
2876	ssh-agent.exe
1464	AgentService.exe
5024	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c40f71f267fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093c8-387.dat	upx
behavioral2/files/0x000100000000932b-386.dat	upx
behavioral2/files/0x000100000000994b-388.dat	upx
behavioral2/files/0x0001000000009b8c-393.dat	upx
behavioral2/files/0x000100000000936e-399.dat	upx
behavioral2/files/0x0001000000006279-405.dat	upx
behavioral2/files/0x000100000000bd49-404.dat	upx
behavioral2/files/0x0001000000006222-403.dat	upx
behavioral2/files/0x000100000000a313-402.dat	upx
behavioral2/files/0x000100000000a2fe-401.dat	upx
behavioral2/files/0x000100000000a2bb-400.dat	upx
behavioral2/files/0x000100000000a1ce-398.dat	upx
behavioral2/files/0x000100000000a0c8-397.dat	upx
behavioral2/files/0x000100000000ba39-396.dat	upx
behavioral2/files/0x0001000000006214-394.dat	upx
behavioral2/files/0x0001000000009cf8-391.dat	upx
behavioral2/files/0x0001000000009cd0-390.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008afa733d4e63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000982bcefd4d63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b51be5fd4d63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c0fc9004e63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
940	elevation_service.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	1464	AgentService.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6088	ReFsDedupSvc.exe
Token: 33	5024	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5024	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5024	SearchIndexer.exe
Token: SeDebugPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	940	elevation_service.exe
Token: SeDebugPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
4520	2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2904	5024	SearchIndexer.exe	100
PID 5024 wrote to memory of 4808	5024	SearchIndexer.exe	101
PID 5024 wrote to memory of 1008	5024	SearchIndexer.exe	102
PID 5024 wrote to memory of 4800	5024	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_afe462a542ce32765ae913534527a911_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4380

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5488

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2876

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 211f59cc4dac105f724a705ca4dd20569ba8bbdc6c859def33e8e4c2b841f56d
MD5 cd4ae07de90344567f3dace48216ccc1
SHA1 3282492602d6a47fc40c3ad5fa6849b5dbb23b21
SHA512 35378aed426a39882a46989a0712433e567f87dec333a501d0dc84f6b181bfa198b2ea4e4ab3542e66f6c34f335a57cdff4547cb9ee8cdfecf00ab1b8af0ac97
SSDEEP 49152:GSgouvAeFfenxyQHXS7uQ0NIn+tgauhwbR3P8wT8:GS1uxaxbS7uXgaPJ
TLSH
T1C8855A0267F94129F1F37B71EEB993645A77BCA1AE39C50E5280125E0DB0A90DE71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 266db0c3a7666e12f12e4ad02b7a2d3d5170fde7f0c477c34131454465655a86
MD5 04b89101039b79b5967a82cce03ccda5
SHA1 d8d2aa3dea1fdb50e5377e0a80076e0ef2bbefbe
SHA512 65c203038a8fd70ec3f99361efd4542885de8ddfe70031122c7235be5e8389ced15c55f3e379781bf6476373e8714330cfc845a6b23b6940fa9f68991b5e29ff
SSDEEP 24576:0ZTAbD+Ome5+4ZAgayjhwbmY3MaReFeDvSP3b:iTAGOme5+tgauhwbR3P8wT8
TLSH
T1C675D0107790C036F1B319768BBF9724556DBDA11F6981CFE3C8266E4DB0AE0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 1.7MB
SHA256 a25be59f85464eca5942cf57c4e236c7be12c36b93be522931d7ff0c234cf309
MD5 1ae18c2ebe43d142532da2146cde7746
SHA1 9774cb1b74dbf96eef8104b79a50549bc4b60007
SHA512 a10333ba2b978247c8593dada56bb455c0b984ec62e4377a5168a7b577a6696bf2f9db9b86bb3455faeeeb3c58f3de9d3f97d0265572b61b2bdecf43833d5cac
SSDEEP 24576:AJ7RK1jjg/PzNWyrb+4ZAgayjhwbmY3MaReFeDvSP3b:+6jiPDrb+tgauhwbR3P8wT8
TLSH
T1FD85F12075A4C072C17312314E6AD790677EFAB00E6245D7B7D4BFBD6E309C1EB24AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 1.5MB
SHA256 04f7392096237b6e031906961565abb27f81873bce8ca406b225c84000e41d4c
MD5 f26e342a9a51cd0010dc58dfd6e76f56
SHA1 5c8464c3061fdaf5fccf536eced2ec99697314aa
SHA512 b00f3a75f682e9728d46202931fa6d4626a35dc652a760ed4990dd98f93ebf1f28fc156990763eb132ef7717f828acb58bd7934751595a63557d5ee0849d218b
SSDEEP 24576:lZMBzFVSOm+4ZAgayjhwbmY3MaReFeDvSP3b:lZMBzfq+tgauhwbR3P8wT8
TLSH
T1FD650194B35408F8DC67423ECE664911E6B2BC5A0B60C60F53E837665F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
Size 1.5MB
SHA256 7ca88c0c8017b76473d671df536d39a7b632b7bb933cd2b2836020f3ec5cb43b
MD5 b9542c8e64c5359fd1f771ba29b3adec
SHA1 8f5bf07bfd21a934c5cfeb9d9d87dd5311e02d00
SHA512 dfc375aedccf218a216fadcd08f65948029fde9e592d5bab29d74d2b762c7981fcef3448832ab8b2e82ff8d45894cbb71c81fc717061efc10dc990d592b96dae
SSDEEP 24576:FTuaLl3z0zDY+4ZAgayjhwbmY3MaReFeDvSP3b:FTdLljh+tgauhwbR3P8wT8
TLSH
T11B650194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 1.6MB
SHA256 c3c8a03f5d3d2b88f55da3a1699e4b3ce9262f4df921dfbf04205859b9453518
MD5 e0d60623d32a4753a9ef1382793f22e5
SHA1 3f0a9787ed5d1c7fde7e99cdc27db8baaaed15bd
SHA512 7968871e0105fe6d46358463921140a2ec264ec27a0cfe453ef9f12dd4efd15e640acbc5296d77be3f9f772f86934215db4a6d053665a12792cac18297d00511
SSDEEP 24576:U3Fd9CHKy7GZ8+4ZAgayjhwbmY3MaReFeDvSP3b:eFd9CHKyaq+tgauhwbR3P8wT8
TLSH
T14375CF90F3E414E8F0B78A35CD764511DAB67C9A1B61DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 6.2MB
SHA256 f3d447b50f6ec6eebb60b2c98e8fe428d2025f2a9b695573b63c9e9c8256f8ac
MD5 4fc097a694e7264e838872c946bad39b
SHA1 bd1f21b44e33bd288b7213c2c8111f9ee2a9ef85
SHA512 6c637a389b9dfeedd550527078ab28d639c09ed42908a7dd5f2c89904485e258735720cb12ed6f27542168040220cb9b84b4b6ebb4e339c89855910f674287a9
SSDEEP 196608:zog1P9fIlOu/6IgF+I3m2MXP6HG8Qzcax:zognqOo6IgF+qbM/6HG8Qb
TLSH
T16F668C23A4E08034E5F733756D2C67395A327BA29F3145CB86946C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.2MB
SHA256 d05551dcf062a588d61b81cf3a3c1e21301c9c8958c7b12a615513384ac756dc
MD5 e6cfa9a06f0900c5665762ea00a6a46b
SHA1 9182cd117efb64ca61e725bf7dd78e18a275dc89
SHA512 e8e2228a05b170f5fcc330c9e3fc0c564b9cd499f332cb7dd5380d3732421f2335c8fd19b515099476eed35009a7964b79c598499f5f7d020b5c2348f3071bc7
SSDEEP 196608:Pog1P9fIlOu/6IgF+I3m2MXP6HG8Qzcax:PognqOo6IgF+qbM/6HG8Qb
TLSH
T11F668C23A4E08034E5F733756D2C67395A327BA29F3145CB86946C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 77f50a1e4c004c110cf50874a7bdad53cd6e1b624462c1948194de4161ff0bc6
MD5 4e378d05014d13bdfa376335fb027538
SHA1 f45d01f7b5aaa1eff54750ac4b4537ad04ab4a25
SHA512 11e51f9a02ec481833bceaf385b8c93325d8ea4d1222d4e05b6644d1285702d7e3928c3dfc7c4f7f027a2de5387edee3ffbf9f3b95f3bd71e354074e84d80fea
SSDEEP 49152:6b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnh+tgauhwbR3P8wT8:s3q6mjBhgaPJ
TLSH
T18CD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 60be6d2bce16bcd12210750d0ec8827f94b3dea90d0c32931ed4f90db229a135
MD5 09a09e161064156b7440c1d07189a9f5
SHA1 a704121940c322a9a7be3140aa605934917a49df
SHA512 b39a53edf4e11f83a7d6007c593b574fc30691cc4c298d52482daa3f2403b91559b51e9f6f181a687e95213a4c5d95854fb7dc5d0298b7a54b03ff008c7ece86
SSDEEP 24576:jXYfDtczAq/+4ZAgayjhwbmY3MaReFeDvSP3b:mtc/+tgauhwbR3P8wT8
TLSH
T16285F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 81542ee7529bfed4c0d01aadf357eb4245e035976076d609034462f16a7374a8
MD5 5be69415005316ea49ca423dfaaef24e
SHA1 d701fb187460a8a13cf52b8a1f95671628b62b8b
SHA512 02dfb3e72b575cbad674bd1bd16b21d1eba2973efc25f25fa0916952df6d4d2a5a12369a0aa5a057cf8605b0c6858560bf216c9f945eeaad19c51d7b2d5364e3
SSDEEP 24576:4wuROW4/+4ZAgayjhwbmY3MaReFeDvSP3b:4wSOH+tgauhwbR3P8wT8
TLSH
T10285F14673A80CF9E9674238C6978532F7F2BC022A21DB1F57A0C75B5F73661AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a8bd6fda2663d3fa0746c9676a283d8c88fceaf14e3b529eef3c25e0e0adaced
MD5 bb7e0af89e5acc7251a711971fa06566
SHA1 a5974a08feb097d3121e05b8253f53c8f4af9984
SHA512 da4ad22fd7a32efad922029bcd50cb78e6213c76e2cd900927214139f99c30ccf2d1df27ef055d8fe7b3572d4ee9d9cf5884c03751c27b7e1bc86f3f73f708ac
SSDEEP 49152:QB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gly+tgauhwbR3P8wT8:Ku6JmIxd2d1gaPJ
TLSH
T1FAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 b22c1f9664725193ffc123b6eb69cd140149eecd569cc26d1c3259d1a86b1785
MD5 01b99044d88584530947e0a5d4aa700c
SHA1 19b560e93ef6d9e1eecd2687279e8d7fd58660b8
SHA512 6433cb8ddca369c4c9b64e9c50e6ef102855472e7de9c19366035972e09a6c9fe4492006cdf050e16ebd0acf422f6e1a4f28a65de1cd1813a80ccb14f076c96d
SSDEEP 49152:EMnYIV+tgauhwbR3P8wT8yarSj8RoTCCW:P6gaPJPJTy
TLSH
T1F0D5F129EBCC48E5E177923C99B7460AF6B178591B32C2CF029A53AD0E37ED45E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 963dd8d6a1c51ac1cef6dcfc12d69008d6e35885bf284921b8a30ae0a6c255ba
MD5 0756d5200856d60549382105250248ab
SHA1 e1c41887cbeeef8de31a31ef1a0ef07f595dd18a
SHA512 ad44dc4eb79ddaa0f9d8b6ab8b7570a9b6bca35bdbb63bfe91c4a492621d54c24c9494951447b457ac263e8710298d3f8428e150b2a45fdc5c61607e58ba5c6a
SSDEEP 49152:0MnYIV+tgauhwbR3P8wT8yarSj8RoTCCW:/6gaPJPJTy
TLSH
T19BD5F129EBCC48E5E177923C99B7460AF6B178591B32C2CF029A53AD0E37ED45E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a49613b985cfb4af0fdadf54e7d873c5e9e5a05bdb2d807dfc0d92cbe8ea6455
MD5 8dc48762b4407d8455dabf594f37bffe
SHA1 33b262e15f01de0519d2dccd2f99d6badddd4d0c
SHA512 b464490993b573dae04e38c2af4155095179da1330d2d4eab9da0bfd099130a62ea7d4d76a82930a479f7cba58d81a630c22c005daa606f3d8e180fad4c56b26
SSDEEP 49152:xYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0i+tgauhwbR3P+:IySzPNgaPJ
TLSH
T1F5066C96A16801D9C1B9C1B98F1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 cd74458c9b170c9652cb5d1ac86a68b452d345554f1e6effabcba3af0e5c37f0
MD5 d519b7966afa310801505d868abfdefe
SHA1 92c9e34e19760ae75d39cd3f16db50cce11cf16b
SHA512 97523fb7a60eb904f43776ba199897b3660607f747da251c0a328bf6330b7aa216fbd21b32820202fd7d4eea2baa33454e8251a5f92e69415b9f3edd077ab2cc
SSDEEP 49152:xYLUNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0i+tgauhwbR3PA:pySzPNgaPJZJTy
TLSH
T1EF269E97A1A801D4C1B9C1B98F1BCC17FAB134490335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 013a94e94c7ba7fc4c57b133e246f0fadbfe65ea72200eec11307887d504fac3
MD5 125d7973e303609bcd636fa6e48a2d2e
SHA1 28f7ea6c40780955c9bae411b4f616a2529b2487
SHA512 9a23820d6c5daae5f4b4de45329bd28162830f8c35adf0beb57db532e871780adc210e3f8dff33838179b46f94970b971984ac888c1608cbc9d029c63d798cab
SSDEEP 24576:447Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYg/+4ZAgayjhwbmY3MaReFeDvSP3b:447JUQjqirIhCnDHUPfF/y+tgauhwbRG
TLSH
T19B65AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 fdee471b891e54b492f7e14594bec5b0517b5ebf09bb76c2478c529630583234
MD5 cad83cf29fd151929ae42d5e2da6bdf4
SHA1 7667563d9856132399d5b6ab9a4e5047560ef4da
SHA512 dbe2dbdd9a74024d92d5a723344db9df62c896accddb671cf5b5db89aaa506ce7371929695080764edcd3d3becaa754bc45ce796a118c560b162c8f0fc46ccee
SSDEEP 49152:Zi7JUQjAirIhCnDHUPfF/y+tgauhwbR3P8wT8narSj8RoTCCW:UJiglD0PbgaPJGJTy
TLSH
T1A1B5D01EA3DC01D5E1BA927886154A5AEA71782E1F32CACF12B0437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 79f47d6cb15bd4dd37187f51b0a346fffbba06618e224e0048a7a258fbd7a5ad
MD5 aaf556958cacdc20cc6700a28786c557
SHA1 a0dc046b7c73e17a56cb11077848f44b5b86b247
SHA512 8e34f59efd6eaf80af5f02444eb3ee9b5801403f9a8d54400bf741bec50d65cc66420b59bdc795ac45cb479f87d4ac46072c215c149a5f31d2b3c3e3211c3cf4
SSDEEP 12288:L+pLU3fgh97v2OMKkhASXkk3MLMb8eDy6Xlhdc:L+9UPMDRST4Mb8gy6XlLc
TLSH
T13F3517117666CB4FC5A940321E33D2CCAB707D05EE45AE0772C98B3FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 366KB
SHA256 6e81038ea1b76bf9208d8d205fe12c33786955c736d13da0ca602afa4443edae
MD5 d013f7895e0b5dbdf95fc6562f37c4a9
SHA1 f2f2e9ce627378795abd9e2b9c4fc11e21860138
SHA512 a7187f32e628927332235cf40fbaedbd8aa4c4fbb49b2cdb80f81493b40c2b8f9b143bd48b82950080fe0b52e7d7addfb53f6cd67116a1c1db3492b636d29fcd
SSDEEP 3072:/h3fjhSPqUjzuKCnvVz4Bimr1Irz2nduv/A9jzkzL3WwN2BY/mlJp3zgtvjzKgp6:a
TLSH
T1AB84D611BB64E72BC4B580374830D6DE9B797C229F121B033FC849A5D8F628676B2F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindRename.docm

Path C:\Users\Admin\Desktop\FindRename.docm
Size 776KB
SHA256 483189f2be04aa6a2e982a82c7509b5735b353f32b8c20d2b336b46f52820fbb
MD5 655a975e638ef20598125100e99e4d3d
SHA1 9797157f033882bc72712e142d199bde8163a778
SHA512 7c3c04c9af326088423445a3ce9ab92e8e956b98ddd3e6d1ed9f794c696a701ac98b75dcb7790b7ffb21438459ccf63ea1c30d4418fb87b12e2a73d774470690
SSDEEP 24576:SlIVf2QmpXcQtFaq2EMROj5g1C7d1LriuyC5eQpP:SCVZkciFan4q1EHuuyaeQx
TLSH
T1AEF4231616C828EADF166E755679D91DCC72153D1B27A7CE6833E3C12EEE2E80A01F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockEnable.docm

Path C:\Users\Admin\Desktop\LockEnable.docm
Size 774KB
SHA256 e6761e6f127030de426241bfbfb4e3d602bc7597b4392d3f28fadec64e524c30
MD5 239c5771359ae23a1638c1039fa15a56
SHA1 a15ac6dd0582cc88bf15d3fd5b2616c9e0875a26
SHA512 c6f1710eeff0f59e1520215151eec641fdcd7ea0484a0cd09068692949e0a1f81cccc75ad95f1e378a0f36eb7220d3a3c0a1ecd83f963c02b4cc7bea17c56b9f
SSDEEP 12288:Lh2MGzBdtX0a6YJNeyj+uSa1+TpiArDyxQHf4XF6j+h0YZu1qmTegO1N1JF:LIRzvf6Y3zKuuTppW0o29T05JF
TLSH
T1E5F423DF949609A5EE91153E9C7B90D57CCA8D02065BD2C65CD3F000C8EAA6B34EBDEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterSwitch.docm

Path C:\Users\Admin\Desktop\RegisterSwitch.docm
Size 776KB
SHA256 8770b8e3098bf15df824a1b5e03f168ad331ae804912ac618dda33a25eb1e023
MD5 a5772ef0f53f85f9258a68f9dc6f3a46
SHA1 bf90df70dad9183b3fef94248410b95c2a51012c
SHA512 9527cde975fae4024ce454b3d3d1f467e454275bb6f6c65f590725f2225d60442c403e32ea4a2f01ae67586eff60495fb2d8f91aa1f6534064c0bbfd797a5e0e
SSDEEP 12288:N5Lapw3wBiJpdj9T/jY6sf/st6ugo0xoE3TyZ+nw5N1De4FHNz5xcDT77x2B:jN7jm6o/Zugo0aEDyZZxr5xCv7gB
TLSH
T194F4333CC3824934D6326738F0B4D76BC9BA0425DD81DDB6C72D8BAA58DE926607374D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 15a1a01a3e211dd5fda92b369e8734efff4352ce301eb712ae988dac1d776327
MD5 59138152971f776520841905278876d4
SHA1 a9712c5c7ffc86479c383a87acc6ebe49c1ee544
SHA512 78794a8bb99d8638dcf33c3fcf1119ee4a2ef826d91d23c96148878c4f29ce2a0961330259ca5ee6dd32352817d13f706d1e6dadfeb9f77db2c812fd2d3bafa0
SSDEEP 24576:k3nVi63it+4ZAgayjhwbmY3MaReFeDvSP3b:kXViM++tgauhwbR3P8wT8
TLSH
T15975BF02B7E89135F2F31B31AFB592615A7ABC729D35D20E23C42A0D4DB0990DA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0831463d2a253ca23504d51e344dbc7d644e7e149bb9b60ae09326f0db95dfe0
MD5 c9475a8759a736356774bc11225b6ef7
SHA1 0d2d6ef3e4f31865140d55a782ed94ee1f2c426e
SHA512 6bf9fd2454f33ea89ba01163b2ff05c4216fb3d2f62da0d9d1c74232b7cd30ede66c80e5c8c88eca82fd5f381f87f41f331aeea1c588eaab52149b573f8387c7
SSDEEP 12288:xM7BqeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:qB/+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T136652351D34C888AD97B07708B6E0A30765EBF961F41A1C7F88977C58CB0DE88EB1399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4121b29c216ca37512e0f60d8cef6bbaecc1e55757041b1af214858e24193c36
MD5 9fbcffec7c48397fb97ac7cabd75deef
SHA1 5e8090a412749fe1ccb977a9aed75de434f6c67f
SHA512 0a5a19a5d49ac6b59a5bdfe5f0ac8cc2b77cd27f5e7a78216d4d55de7e34ebc26462babfe8b5d9da2beb2fda484d58cd80862d1f1908164b69d3d72cd47f1d63
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bY3/+4ZAgayjhwbmY3MaReFeDvSP3b:1gb4mBIBhGFQ+tgauhwbR3P8wT8
TLSH
T19D65AE1E22EC02F5E0FAD2B8CDAA4417D6B278161732D2DF1151426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 5c4596c859bc1f3d6aabc44c6d161f679cedd6eeb84ec36185e26b9505165b3e
MD5 cc9b73c801bac320c1269d45d3059b3c
SHA1 d9ad82e2d02aea3746107b550b94c7da5849acbf
SHA512 719690492ce45fed4e911dc5b2c0b54705fe0af122cacaae1aa3db62ca6fad4263bab7f72c66dda179e4f82648bd484c8d688bf864d025ea97496d326960d4c9
SSDEEP 24576:MGtaKngL2jdshRTdG1YxITqvfPkbIcbjLm:MGtarSj8RoTCCW
TLSH
T1CF05237EA7C556E4C43B977429B6A84A3CF23798870A46DF88E0957C5F6A7E0363CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 088b952ff1ffc0a1aa14ffe7c38bba93fac84e4740e4352d719f5d694652b83e
MD5 bcdd6f7d78ce92af53f07b446a8ac2b2
SHA1 5ec8c31d257e13c536b1f2e7226a261acd5fc58d
SHA512 8ba4f509cc5eab274c65f8cb1057701acae8c6c3951d9d6988d68ac410b167526532e3ae701824017b8319c8419431cd51106f10746bb1d4e78fde1acf357d70
SSDEEP 24576:BG88u8FpJqH1vzria7/mQ/+4ZAgayjhwbmY3MaReFeDvSP3b:E7ZFPqVya7/X+tgauhwbR3P8wT8
TLSH
T15C95F16573E401F1D47BD1388A864663F6B2B8250364EBDF06AC8B511F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c5b2465566a51a455b15959dd6cffda972acf6b9d3731ffafb3dbb7d8cb0f958
MD5 ba95d83de2342e7933d2e17b58bb2e5d
SHA1 003fd3e34d65a8bd118acf4ecdd0f2273d0ac6f6
SHA512 07dcc776a44cfcf0f03a1755e9eb03f08e591c3d7ac047b3ec5978487e6463afd3c5c706c465a8609cf43fbd4748683cddbb8ae8ba6481cc0ae3034148ba88e3
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjc+tgauhwbR3P8wT8:KG05lO43bQgaPJ
TLSH
T1D7D5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 167a65ce92037a5fa45bf605245b917ace53321e96067e54a20d8e930cc2999f
MD5 4914c44362d3917a5e0562f5472808f4
SHA1 e9a5527a822c24f412d37f584995b82114d6eb11
SHA512 380f459342752dd92024ba13a12be791772bb1bd565e5c642f697f9ba157e11a85ca56e079f0dd86a255cd5c9e9d967aca96c5423c746f9581025d797ca1767d
SSDEEP 24576:Ofa5POZ3dpyWVM50JicR2hG0lasx2+47eidnK/+4ZAgayjhwbmY3MaReFeDvSP3b:Wa5POZ3lJt2pasx2+mU+tgauhwbR3P8z
TLSH
T14765AE5EA6FC00D5D579D17DC6834616F5B1382253329ACB122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2c53315ab4b705392bfb0951e30e0438f5ef7a848ad9286615a9734dc64c0c65
MD5 a44f4075441194f1c0e03012d09132c7
SHA1 5d6f226a53860cb92d954b20828ddd4c4891d2d9
SHA512 c048b9953bf993e1d475a4a06a26cf7a9540679f4354074d08b7afaf074d4916ba8dbb6f9a4845119b08c2d10c588840ee32f2fdf6bc85b2c384c82796c7c421
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkY/+4ZAgayjhwbmY3MaReFeDvSP3b:/Nc/zEOVHF3+tgauhwbR3P8wT8
TLSH
T11D858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 a6816497288ce3181108b93e9b110bff61004462218ed1c47506ba0656eda452
MD5 c49e5754e5d5daf1b2d7a27364116354
SHA1 05b401eb12d2fda72ce4b20de81c947054baa555
SHA512 814086f77fb810be7f86793a31de9dc86273468eff9c42478cb4d053980e3f1e0240f7c7307e626120cac803acfc566a8988e2ffd3cb720d585cc52a3fb451f2
SSDEEP 49152:ZDVHeBIAAt+tgauhwbR3P8wT87arSj8RoTCCW:AgaPJeJTy
TLSH
T11AC5127EE79C04E4D47BD27C8A638906E6B23CAD032256CB45D491B95F7BEE42D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 05fc0c8974dc929c9fe7a05a0435c0e36f7a5702ee09c6b8bc632d1c0eba82bf
MD5 2d68337bfb477b1a1f1506af6f7ba928
SHA1 8b98045bd9144f1476a738431f50d0c036295ec0
SHA512 dc8afd543bfab75180e1cbffc1ea33551514662a9e329b8c176f5ca2f027fced1ae9389a1602a451cc46cc5254f7591565c9da3e2336ba9a042085850ca7a07b
SSDEEP 24576:T6DIJaKngL2jdshRTdG1YxITqvfPkbIcbjLm:T6DIJarSj8RoTCCW
TLSH
T18A25125D63AA01F4D06BE13D96934506E5B2B2B483174ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 b044194cdb1a580db26ce3bc04e148a4b032575b6b97d5d04dc0221202f59a31
MD5 53cf3f7f35bad848c711921b375306f7
SHA1 635f8a2864906758723edd899a3b386029edfa81
SHA512 6e5a90137f4950fd227bbf31b3d1b3d054284d15a0422effe0acac2f7901e897992ce0e595919121ef25937e9b3dffb4df9d17eebb583fe5f77466fb81e63b1e
SSDEEP 24576:DtyYkaKngL2jdshRTdG1YxITqvfPkbIcbjLm:DtyarSj8RoTCCW
TLSH
T15F15231AD7C456D4E57A27786EB385882D727E289B0783CF89E0E63D2F767D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 2251e221677b29514bcfab978888d77116ef6033fd79df791a34c66f2dbfb4ad
MD5 cc82edd99032846d742014e56863c534
SHA1 eb7566c125ee3b26895fb4679d09ba59554307ae
SHA512 212c5ad2f544fa664d1383d3eded71967efebdbb0576f1f16fd9635a90fe92c73514b02900802058ad75b0871e689d763fe37d1c8c35002b16d9076fb13f3b14
SSDEEP 24576:rZaKngL2jdshRTdG1YxITqvfPkbIcbjLm:rZarSj8RoTCCW
TLSH
T1DA05237EDBC45BA4D8167B743AAAA98D2CA3376C970B46CFCCE0557C5E7A7D01638800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 5c008ad5c9e6c31e265f7f2f40220fb9dca2341c65e0fc2d21a8a752d0bfeda1
MD5 dd20628ac6f911b4a0da7c2491a37b9e
SHA1 dce9279621139cb242b957ec29ee4ba668227d9b
SHA512 81ae13371766fe03cb478f828a53a8f8f5d84ad5f7e9d5e6854e9b6d7985357fdb72caba7008b4a1ccaee66059478173f0bf1f42f797d815479847bd5bf0c7ab
SSDEEP 24576:Mfg9LoTfaidZ7aKngL2jdshRTdG1YxITqvfPkbIcbjLm:egSTrZ7arSj8RoTCCW
TLSH
T1DE65AD1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 ebb14d844ace495d65bd85d30a68ee61255257d2798a05d50e92522b28f3490d
MD5 d47a5b40c2dd10aac0c25760760d2e70
SHA1 347998c15008adc68fa11050079e42ad3844ce43
SHA512 0e490082c4193428f0b2d08daba490d779cbfef55cb01d3625c2a6bba4569550eb163bfdb423094c051baddf455b552dd271e4d1f68708b36d9ea175eab1bb78
SSDEEP 49152:wgb4mBIBhGFQ+tgauhwbR3P8wT8GarSj8RoTCCW:wtagaPJ/JTy
TLSH
T1F2A5D01E22EC02F5E0FAD3B89DAA4417D6B278161732D2CF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 c56995668f8e78aba0e6f007e1fd7957164b83c4d8a92385869c71e7368c4a7f
MD5 30491823f4a66a771b4eca563c140a43
SHA1 33dd87f2eead2a5ab2d2d80ab8537b7719d160c8
SHA512 c95ca993ae7ac3560e8b9d9af9faa59c041218e00a5af2beaaa1d59b4d83740546f3e4bb788c75a91ec7946f68785afe9f04e156c14fcc3767d319e74b542f24
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmPaKngL2jdshRTdG1YxITqvfPkbIcbjLm:wTMwBtOmParSj8RoTCCW
TLSH
T17975B06EBBE846E4D1FEC6B49D238516EA727461073293CF4290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 ab1e848b437e9f2de32f58ff6098273d4ceee4349d3dc79d3f16be4a9abaa808
MD5 9b2eedb7d250a778abeab9c44f7e1677
SHA1 c1d506c767a95a137907ec4d0da28191c79a3f1f
SHA512 54530e902f04935209a38b6fca9aaa05fb665c003fb8b67dea92250c9212a62bd85e1bf55a29c70f21df8953d4aa71a262eaf6e40a2518a08a06c13151156bac
SSDEEP 24576:7PUr+NQM/+4ZAgayjhwbmY3MaReFeDvSP3b:7JQs+tgauhwbR3P8wT8
TLSH
T1BC85F11F62AC18E5E67BA17C8A864715F771BC621712D2CF02D0917E4E73EE8AD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 78189c5cf23d3a67cda39c102e4a5c5733e1e88773b184a45ff604f20f07cddf
MD5 5bcb1ec5165c58157f09b1c357fe4b83
SHA1 c49621a75805936280ec0a3989fcc0e802d83dce
SHA512 ef6cab6150da6b6bb3671d5c3f86db1b12d6d1e317fa7c1473667d9abc4f473e9b4acf56dc201d1e2d3eb3bfc40883a2f188f80fa88b52abe3040542e06b9bc8
SSDEEP 49152:/DVHeBIAAt+tgauhwbR3P8wT87arSj8RoTCCW:mgaPJeJTy
TLSH
T145C5127EE79C04E4D47BD27C8A638906E6B23CAD032256CB45D491B95F7BEE42D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 05bca3fef81facf67e1e9f4346cab448d71796371cc80e5692bae88ae680640d
MD5 fd97fb12bb11c541a314e828707196bc
SHA1 7197a66e802705a5314b322ad58c71053e26847a
SHA512 ac47b4e7d208e43987bf007b0e904c58fa2ee7ffebf391b6bf61463c7503491cb68999464ccf55673e8f075782b613499949a282b79d13e974521c07dc74cdbb
SSDEEP 24576:eJnJPbzB4SsaKngL2jdshRTdG1YxITqvfPkbIcbjLm:eJnJv6SsarSj8RoTCCW
TLSH
T19C35F13DD29810E8E4B7C2B4815A1B5ABE71387C2F1669CB59B4D5343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 4a7c29e64450fcb34f9da956b65d02f60121b217cb9f807df4b72dd97f6a0456
MD5 cd08cb0a4d5680136a1e7fb7ccf94cfe
SHA1 778c4819ade8b9f90ebec2aa7c3b70c365ad7084
SHA512 ba4f9a8a6b056d87659e4ab7f1b69b9ec124b094257debbfc204343f152b6f9c50163a5ad7c99422795eec65981351d316d1065b832ce56dde59260cbe76df72
SSDEEP 24576:zVaKngL2jdshRTdG1YxITqvfPkbIcbjLm:zVarSj8RoTCCW
TLSH
T1B80523AFDBC48B94D55A3B743AA7A84D3CA33B5D974B47CFC8E0159C19AA7E1263C400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 7ec919c58fbdadc3a0186b4b19a87e23416e462947f6c7d2b23c40247360a6b4
MD5 f9c43b4464c825d741ff1c00efa650a4
SHA1 7fa9ce3b4edf3801fd3b51cd2d85850e7d870f52
SHA512 4bb6e58fb64c497510182b0d34c2f647cc2aacf2bcc82ebbe53e821c0683487213520e1e8374d9c032627df6ceedfb0e829106ef2c18aa6f5771272e7ba9e6d0
SSDEEP 24576:K6UqjpAaKngL2jdshRTdG1YxITqvfPkbIcbjLm:K6UparSj8RoTCCW
TLSH
T18B15236F97C419E4E03A2334AAB6C10918B27E79035B86DFA5D4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 db0241d02c68fad21beba048c395d68488bc7d1f45e8a27d37fc2aa0cae851db
MD5 044fa9030901c68cab6c1ddea0177cd4
SHA1 47e9fc759c2a56a9be19003815ff4bcf3de56188
SHA512 338a2433fa58e33766e2f8e2267547ce6f5e23ce3d6b4f52cf69ce22eee3700512134fa6f7e9ef5608733c7bb975a27721e970729136202cf2c7657edbcac890
SSDEEP 24576:XCLHGL0MoeVtFumTijCmlKQWDkNaKngL2jdshRTdG1YxITqvfPkbIcbjLm:XCLHGeeV5ijCmlDWDkNarSj8RoTCCW
TLSH
T135A57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 2b00fe7a7d52b3ed0709647c896b5bb002e7aa8c19598741103e78770d4185bd
MD5 01218b3a707bf1b9021ce6b04eb33113
SHA1 dc8ce649b4f8ad3532fc18536115e0d122e7a71e
SHA512 b5916ce2739bcf2ef13fe816c1bb68251e5e0efd56ffc88993e33409ed39eba3b7d6d65e800cadcf5bf799fa9acc422762e1f0a1eca600eeedf16f6030b45509
SSDEEP 24576:YrcmR5aKngL2jdshRTdG1YxITqvfPkbIcbjLm:acmR5arSj8RoTCCW
TLSH
T1CD25015EB7AE00E5E1BB923C89828549FAB37534530257CF46E0877D4E67AE97D38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 1cb15a130a4017762319ab2c1f28f2bdcbe017d87ee19c91576e3ecb3028a4fc
MD5 0f5543ad493649d3ce144cb467b56699
SHA1 ff894601142c0ba149500364e8c127b039504944
SHA512 b92ce81c466f3af48347e2f79461e32434cc522cc04a875cbc01bfbf394d4c8ba1fc907b253e808a56692b562c707b2f33ed7f2e3d42d142421e0016e141c8df
SSDEEP 49152:RDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3EarSj8RoTCCW:i3Upow8sB1JTy
TLSH
T125B59D3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-34-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/940-137-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/940-28-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/940-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/940-35-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1464-174-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1464-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1464-152-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1464-177-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1464-158-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2640-91-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/2640-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2640-340-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/2640-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2876-146-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2876-138-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/2876-140-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2876-360-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/2984-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2984-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2984-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2984-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2984-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3740-103-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3740-104-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/3740-341-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3740-109-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/4380-76-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4380-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4380-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4380-78-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4380-70-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4520-8-0x0000000000400000-0x0000000001B6D000-memory.dmp

Download

memory/4520-20-0x0000000004720000-0x0000000004786000-memory.dmp

Download

memory/4520-13-0x0000000004720000-0x0000000004786000-memory.dmp

Download

memory/4520-2-0x0000000003D30000-0x0000000003DB5000-memory.dmp

Download

memory/4520-6-0x0000000003D30000-0x0000000003DB5000-memory.dmp

Download

memory/4520-69-0x0000000000400000-0x0000000001B6D000-memory.dmp

Download

memory/4520-0-0x0000000003B80000-0x0000000003D2C000-memory.dmp

Download

memory/4712-307-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4712-87-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4712-81-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4712-80-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/5024-180-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5024-187-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5024-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5024-181-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5488-356-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5488-125-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5488-132-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5488-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5488-126-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6088-113-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-120-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6088-114-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6088-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-358-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-381-0x0000000000750000-0x00000000007B0000-memory.dmp

Download