Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
- Size 2.2MB
- Sample261030-ea3n2sdb83
- SHA256 b5e74671f4540a2b033989efc2b22f95caac152c0c6c6b8c1daf649b2b785561
- MD5 5c52ed1599a7e6f3b7ede8873ba4cf32
- SHA1 a8d1715ef5593cef70f347fd94bb522b5b7b951b
- SHA512 e4c24c87d823f1f6de6a7c67c3b8452bda7eb9192deb24aa4cbb004b2df88994289fb408df72d029a0dce7ecf5e07036fb3eb85c4c880970e1c7daf3df38f428
- SSDEEP 49152:mtCejjt1nAV97yKtFnFK2dstEPObWxBqLrH9pMQ/lFTjN4:mt7j2Ab3T9FLm
- TLSH T1F9B5BE42ABD344B2FD866633112E67139B39AB090313E6DF96903D7069712F31A7E2D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2524 alg.exe 4716 DiagnosticsHub.StandardCollector.Service.exe 3064 fxssvc.exe 1928 elevation_service.exe 4756 elevation_service.exe 2360 maintenanceservice.exe 4092 msdtc.exe 2136 OSE.EXE 1680 PerceptionSimulationService.exe 1100 perfhost.exe 2428 locator.exe 2652 SensorDataService.exe 2316 snmptrap.exe 1268 spectrum.exe 4328 ssh-agent.exe 4812 TieringEngineService.exe 2072 AgentService.exe 4460 vds.exe 2364 vssvc.exe 2416 wbengine.exe 4292 WmiApSrv.exe 2380 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\R: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\W: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\Z: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\A: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\H: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\K: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\U: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\G: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\J: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\M: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\N: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\O: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\T: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\V: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\Y: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\E: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\P: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\Q: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\S: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\X: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\B: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened (read-only) \??\I: 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe - Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\322e17b29b11239b.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 SearchIndexer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DiagnosticsHub.StandardCollector.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DiagnosticsHub.StandardCollector.Service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0dcd6162168dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1b30d172168dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a491f162168dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecc9e2162168dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cb4ee162168dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084ab02162168dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc5b13162168dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061928a162168dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb530b172168dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe 4716 DiagnosticsHub.StandardCollector.Service.exe 4716 DiagnosticsHub.StandardCollector.Service.exe 4716 DiagnosticsHub.StandardCollector.Service.exe 4716 DiagnosticsHub.StandardCollector.Service.exe 4716 DiagnosticsHub.StandardCollector.Service.exe 4716 DiagnosticsHub.StandardCollector.Service.exe 4716 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Token: SeAuditPrivilege 3064 fxssvc.exe Token: SeRestorePrivilege 4812 TieringEngineService.exe Token: SeManageVolumePrivilege 4812 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2072 AgentService.exe Token: SeBackupPrivilege 2364 vssvc.exe Token: SeRestorePrivilege 2364 vssvc.exe Token: SeAuditPrivilege 2364 vssvc.exe Token: SeBackupPrivilege 2416 wbengine.exe Token: SeRestorePrivilege 2416 wbengine.exe Token: SeSecurityPrivilege 2416 wbengine.exe Token: 33 2380 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2380 SearchIndexer.exe Token: SeDebugPrivilege 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Token: SeDebugPrivilege 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Token: SeDebugPrivilege 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Token: SeDebugPrivilege 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Token: SeDebugPrivilege 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe Token: SeDebugPrivilege 4716 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1884 2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2380 wrote to memory of 3368 2380 SearchIndexer.exe 109 PID 2380 wrote to memory of 2900 2380 SearchIndexer.exe 110 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1884
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2524
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:412
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1928
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4756
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2360
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4092
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2136
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1680
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1100
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2428
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2652
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2316
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1268
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4328
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1560
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4460
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4292
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3368
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 7882⤵
- Modifies data under HKEY_USERS
PID:2900
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 caeb5c5cf87b624f6dec926ae1b24f751fa375c465f9790c8a2a4a2dc5c27d62
- MD5 a105653b24c2f37af9b7fe14e2df0fb9
- SHA1 59f4d4047e59382fb92481bc2c8a93399088e1cc
- SHA512 2ec7bfbc59b6575bfc486e1d46ebb09b9fff54a41046562115cbc0aa12297093f006d02b8b8c0de99ace6cd687a2a5d93308bddc2c08674c12351373709cd21d
- SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEQ/lFTjN4:43q6HjB8Lm
- TLSH T17CD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 c3e7feb36ce816eb3c90149d489e68bb78686782ebc59932bd18fb80dd4e3027
- MD5 634858e7616765531f9ae0cb7c38c184
- SHA1 2e73ecb0a97f3ffe74ac54487d98da1826f146a1
- SHA512 a44cddd0b8cca1026c02ef9681b6b0dd30a5774d9851bb7a27d455b9fd926c0685d8a664d99d6ee55f4a3a2e2e4e54a6269657e9608de8f06f274b8d249ccb9c
- SSDEEP 12288:V1XLsswWkxy2lRq2czADGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:7XYfDtczAznQ/tbw/2Mkjy6Fr7g0oT
- TLSH T1A465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 d63e3e92dc146c1d90259cc9d0f2417f88db7de06b259aecc53c62035ee5c51c
- MD5 f1b06539b35d5b0ca03250a18c73c951
- SHA1 76c3ec1aab06edf486720dc91b395c6754a00b5f
- SHA512 c4a233bfb622cfb089fe7a7adf170105f9ff5f51e1fb7b2118b9fa931bb4d3afab4cc6bfdea2b9043a2e513a5de1be5ff473eacf051cd30e8767f947e5c80048
- SSDEEP 24576:X0Le5ji0hmxLrMcnQ/tbw/2Mkjy6Fr7g0ok:XPji0Al9Q/lFTjN4
- TLSH T115859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 61f3c296db1565fe70b1aeeeec9b51199140ddd096bfd5ee541fb5a210c46c60
- MD5 8c40a6cd6a8ea4f8daa8f075600dbe74
- SHA1 5c6ff120baebf6cf0b9453d4205f0b8dbb0243f7
- SHA512 33d01bb266327ea6eb027ac3eee6aa56707fb74bb8d773175b799c90a2f238dc10dbdfff96c78821ce4797f2593f7488c06e5187221a86b6f7ed5676d305d07d
- SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWE6q8wyuanQ/tbw/2Mkjy6Fr7g0oY:t/ezSC6vUzPvxHjy5Q/lFTjN4
- TLSH T134755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 2c4131aa7224254bef3c2b3d553eee2edfd6dd68ab1f8150e8bbc127c7efac86
- MD5 989f959b771d2632bfafb655e6b6b29e
- SHA1 472fb0f54f6bc3572922fff281847a0fb988eb95
- SHA512 033b2f549584bfeb17fae00c453cdcc65c20da75da99de84a20f3da45e9636e55a734ab9dc9d915c970137b6148d4b682d04995dc02f73c77a076f46099b3733
- SSDEEP 24576:zVbqPb88hv/l+6nnQ/tbw/2Mkjy6Fr7g0oH:zVO88hXl+YQ/lFTjN4
- TLSH T15C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 51bccaa199f173f2122ea2475debae0f23870d641b75744324ffaf2c62852379
- MD5 c95e46e71b3954f2e48967e23e387fd2
- SHA1 0cfc7ccd6b9abfb6d2c834fdedc28d8eeabb5e9a
- SHA512 cd233b3e4a1eedc4081f4638b940a6935f140da7420eeb214d979415fce47a3cb5405c313eb60e19fab42d0d4ad6b9364488b44e4f5b5d150cf967324010ab20
- SSDEEP 12288:nzAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:nzgnQ/tbw/2Mkjy6Fr7g0oV
- TLSH T1675523796A24F897FF2B06B15CD284826B7B0EC1BFD4A74E6B44322D857C39446DB381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 5af8c8a04aa0c5ecdd87cb33016d7ac9a1e523f0724b4d68dc781b15c68455dc
- MD5 fe4b176183caa40099478ba1a43eadd7
- SHA1 5103477704ca1904ccd189f3605a5618cdf113ca
- SHA512 3f28ac969bc0a8cd43214ff4e25c2f81ee56fd0904852e576bbeb3c74ad07d3ecdd9604168a2d9136a5ed4b96a402e8c1be6b8c416f05ca52668b378f4288c20
- SSDEEP 12288:0eBNUbTVO86UfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:0JIU/nQ/tbw/2Mkjy6Fr7g0oy
- TLSH T1B775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 4ea0ddfa70cc15d514ae820fb75b9200a23a6861022f95aab624919dbe5ad32b
- MD5 a6ff5d064da75a24bd62ee8658a79fd1
- SHA1 a357c2142b77c072db876f3ebc20e19a20ed569e
- SHA512 962e9612b46c2cba0647073fc561221681ba6fec358908b7101c05b60ffd7393b13808e472413992165187004ecaa9e3c9d63cae03181ab8b7529d55a62b43f6
- SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:lQvGAdlCEL8c/yRNw5ClLm
- TLSH T1FA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 d7f9aa64d1cbad25c0e87424abef6a5df2cb23bf7b732eeab4048a0f229bd6ee
- MD5 11aa0423bb1d7ce5689ba73ae5c4d27c
- SHA1 a3ff34e1d7ffbb4922135a6adaf1eda8d55ab255
- SHA512 e6546e0fa38082562997efd5894d798ab6c4b82268a14b5150347ffeb80a90266772105809062decd212572b343d342933361adcc92185c6cda8752f5923d98f
- SSDEEP 12288:lAwSfxL/2Dc39DLLmt0LDQewsAjtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgW:GQewsAjNnQ/tbw/2Mkjy6Fr7g0o8
- TLSH T1C275E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 0df5b48da8e287a6dbafb8e5387e85bf563ffac0ea5f3677024c78228977dfe3
- MD5 99676277d32271b6fc9c6ffbd68a1064
- SHA1 2ff40331d57136f88050c0332ffbd41caa6454d5
- SHA512 66f4ee4a807b664be90a055d2c3c7dfb12311b891875b94f10b50abbdbd4def2cdc1e9ab136c0bf0243fd8594dfdd1a894d5ee4dff046f3d8471274df9f7d393
- SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6L:yUEtQevvqc2W1cpV2EI32
- TLSH T148474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 d9ba39064fe3e3c300c14d15c45dae0e1ea52539ca5c5d30468f8f98dbd9c400
- MD5 a2388ce47269f0509044b7bebacb1c25
- SHA1 775085cf9ce41416e1a5cbdb19e7edb8c72a3c82
- SHA512 8ad72d9188740b7936e088403dee277ddff1f872b43cb95d70c9b47e50c670c13f45d5c3fa2a475620e44899c4527a415040579123cfb2a47c9b055accd82d17
- SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/ztQ/lFTjN4:qoqtVjnmhLm
- TLSH T1A3D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 ab502811b3f19d0753f581b95f2676de9fcdc03f08c0ee16d02d0fae8b3c49e5
- MD5 33b2c2a8087b7f199941a300f609221a
- SHA1 b3146d342b7b0f2779c44a9c645266ee3241a59e
- SHA512 2a0b785e52d5b07e99913ae309732679f9f031aca5a5bf1d72d1fcf747ffe9eced44bf3167e577a2e4b0e77658d4b9520ef4e53bbde036b94bf37ac8fc6b8066
- SSDEEP 24576:XAhGLJIFoiwtA5l7S532nQ/tbw/2Mkjy6Fr7g0oH:XAMyFoiq5mQ/lFTjN4
- TLSH T14835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 b95de44a0a66fa28b6201530b02a246c2223f500b4d3b11f16d2504a2a3d1336
- MD5 86dcfc3d7e9fdcc94d9d018d96f400ac
- SHA1 1d33fe4ae7474579466f7e980be989c700b44bec
- SHA512 bbffe15fa4a4a5673af87aa33d0f739fabf77caea7a7c619b41b237a8427d1aff4ddabc3f9d0eb4625a8e56f53f2033e716d7ea39e67c853a97e2cf83a5e386a
- SSDEEP 12288:Fmw5HEjsChN2BFgl0WDm+C6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMp:gwuHOWZnQ/tbw/2Mkjy6Fr7g0o8
- TLSH T14C65F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 51098467201e41179263d01d651abbe4bfc522e2b2264ae9cc9610f0fa47005d
- MD5 b00630dbd92349a793bbfac846bde961
- SHA1 50808b55977b2e21f716ad1616509200243db887
- SHA512 d40cae99eef21118b843b04cc23532f195a09e3327df4889e4adfd189abb2c7f0d27fd9697c2c27bd1ed0e5586a01591b2119c2075aff7a9be9f3495959eb78a
- SSDEEP 12288:RXZ1Iy9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:ZZuUnQ/tbw/2Mkjy6Fr7g0oB
- TLSH T1FB55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 2e8e6a9b3c9acbba27d3ee53bebf49f7d609ae47c91603533f0be10e22f26e24
- MD5 358f7a93ddd14c0809050aa14be5508e
- SHA1 3e28fd8550bf4edd2c6e17910a9aebe241acec8b
- SHA512 ed4c826d010f412837a9ec75ecf69856d9f5ebfbe6bfa15e49c71a7d315fa01ea997e5ac4baf127c0e19e65b1895fdccced817504732d6f50273446e07b47e79
- SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ur:gQRQyi36YOcPQLvw2gAf+PN3gLm
- TLSH T193666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 0a52e52b6028daaa6ad5f067e6e962e06acfb1bb0d93901747bd67fb17d5f0e4
- MD5 7f4e59b5970bbb62388b5a2d42758c3b
- SHA1 07935144b669705d18e1478f07cdd1aafa9cb375
- SHA512 37b8b0ffa1c3021d3d1daf9376459001f12c0fa9aa79584adc8c9f31db483ea2f557c9c1630cd684f1cb19866c3a5f2603516544a7cbaf53f0aa2365d778d02d
- SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ur:uQRQyi36YOcPQLvw2gAf+PN3gLm
- TLSH T192666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 d1a9f2cc46f396e0abc7230244d83a042a7cb8249ec96795924425e362207dff
- MD5 3c37d431f89955733606371a7217def0
- SHA1 fd90b8ecb289036996037a4f5a9c6df4bd888c11
- SHA512 524ec5dbec2a67053563f75b395aa4b2364a239d310dd4252ffde527c64251fec7ef96200fb8221770e55164f9def911eb58c35968423e67840845f68acd9d81
- SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0EnQ/tbw/2Mkjy6t:p68Qg55nhheWu7PNU3/9Q/lFTjN4
- TLSH T1F7B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 90969ccf96beeac2e00288e9d43e977051701dd45bd3e3f24330d90e89d9fa15
- MD5 f90ce0f65f2ff7676d75439c4fc31401
- SHA1 871dc7eaafe81bc20a92a7d924c25f4e4e30f640
- SHA512 784ee6f111a0110435a6f173484edd7455a4561dc32da0091443575bb348bafc1e1287c78265ade2f1efb86aa7bf739a334fd81cdb891edd7f2969517aa70360
- SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:dy5112gYy5azzVvL69nLKnhZzLm
- TLSH T171167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6691b80919e5fdd1fca1ee47a5d543a46b55ef34d460345d928503ae9d4f209e
- MD5 136c34f1b3de5afe5a2da3953663c955
- SHA1 91579ae006f3b57ac830c0cbc1d606c50616def1
- SHA512 92984168ae5aff19de680fb42c6383f44f2538cd5d9e24c4906bc8245270af364edf5bb95fee4572ee3334487fb19dbacf193abd4ad8b78bc3a62b2f651c0735
- SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gljQ/lFTjN4:Vu6JmVxd2dILm
- TLSH T175D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 77238d8ea62fc159013eb9c74fde1259a561b501e3e827fdafac558d52b2afd4
- MD5 6dfe8c217472d313dccccac64f96809a
- SHA1 f56ab9d5523f4a871f71855ba0256aac6a4fad4a
- SHA512 6ef758fd80698ed1395c9acefc11496d50171f523e4b49d98f5694a0599ffac7770b22222ed86752874f327b851daf7c0cd92d86187101fa821a9f89bdb68419
- SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4xfQ/lFTjN4:7mifPbRhLm
- TLSH T146B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 12085afaadaa24a59e47ee6f502f452ae4ddcfb53a2188966ac9061b7d7c9b07
- MD5 cb54e00601061f1e8a39a619d66b5ac0
- SHA1 e75582c675cf67e8d69bcacab39b943e2d6a7836
- SHA512 0af69d4cb43961b09ca505ea5ab472142670f892a90ffcf8aef091e30b2e46c5483ff72e400cd061ccdb53492a1bb0a1c084ae333de555f25b2271e23a97025d
- SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHqUQ/lFTjN4:s5dKTi61HLm
- TLSH T12DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 8f2ab9b7df88a6900eef18b30fb16ed584f76cb70969148adadb1366545e2a97
- MD5 9d0857fb16185b1064a3bc90e9b0f97d
- SHA1 30d0f5674ccbde374e6bc1009d3c1176822719c5
- SHA512 9ee82dc422b5e27c782d760b20c95cef71163d90b684ee92239736f9287ed7f507520f3d4643b7b364ca1afe70910dd8f2248327b305e671400d42420017415d
- SSDEEP 49152:xhtSn8EApI0figngiDn0AP5wzQ/lFTjN4:gX2iyphdLm
- TLSH T13595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 31bef165c5194a6a4ab38e83d694c64d87ac64303e3a8a0fbb620de1bc0645db
- MD5 0e8c977c5db195521c2856c27b1951e0
- SHA1 3619788c25c6f13fb38e206781eb27ef7a319017
- SHA512 c9107daa9cd83cef5d354c210ae3fee5dc5598985864f74e8cf66043a36d8550db3c0c699d523b061cb1c11a829a197f5d876aa71fecf58812dc4891a65fd8bf
- SSDEEP 12288:lYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:lYnQ/tbw/2Mkjy6Fr7g0om
- TLSH T1A55523697965F98BFB1706F14C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 2fb34153d79b0d59c2bc1f094abab0dae8d22274a345b884a696123d977780cf
- MD5 9a2fe549fb2f6046d8664a4dfaeac7b7
- SHA1 b90ff1074185580713f8f273e41ea3497c64f324
- SHA512 a0658ccdf6e4472904d1d347952d494ddb20a2153eba19b2e5bb1a8bb23a87fc5b4d663e20a02eb956fd6da4339db68fcbb264da483f87a9cf22d0b97a1e029f
- SSDEEP 12288:bxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:bBnQ/tbw/2Mkjy6Fr7g0o9
- TLSH T1265523697964F98BFA1706F14C828182A73F0EC6BFD1938F7B482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 c054cb8f7eb2e6cc02a59930d3ecdda17861f897a113986594bda7c8eac93f4f
- MD5 27a31ec77547ec04758b055a21cdc7cb
- SHA1 9cc93c8650c4f0d56cb0de5cfca84c88acd37421
- SHA512 be0659707cff3996b9081560095f8a446806f1b67bf1d92d8fdfccab4456316dc6a430acf5707f4bad948737b186daa901002d8fdf7ad96b318c60d424e9b8d8
- SSDEEP 12288:p3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:pXnQ/tbw/2Mkjy6Fr7g0o9
- TLSH T11E5523697965F98BFA1706F14C838182AB3B0EC6BFD1938F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 5ba52592a46cb171c5bc00ad36f524d090f1504133ee53ade694423330dc0d36
- MD5 975eee7acbdebe5765b2b1cb1b5500a9
- SHA1 c20b83ebd54d02a377adeac989a5de295f05ce6c
- SHA512 9ea9905e337606eab822921575ff7745575a7a25c13f06c555ada8671176fecb8130eca7c387ee3500567ddb63dfba79ef80ec8417cb4f68766c04a814c2a570
- SSDEEP 12288:ZV2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:CnQ/tbw/2Mkjy6Fr7g0oM
- TLSH T1055523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D419A6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 54bf66e0ec14e2cdea89cf28ac437a48460743e0c83fe443a97c3ce9285dbb17
- MD5 c62e8fdf8b3e8b6f3af66618cb5a86e1
- SHA1 1531efa40df19278259553b0d0bd9ef4d4703151
- SHA512 a6db2f2d5c1d1ab75c66eb6828bedb7bd21b86fee19d0f58eff585a27cf2a06aaa2e7785690320db4850b764009872100c4ec8c93047d603247763336d19ef6f
- SSDEEP 12288:qeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:qenQ/tbw/2Mkjy6Fr7g0ov
- TLSH T1385523697965F98BFA1706F14C838182AB3F0EC6BFD1938F7B481128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 fb7feb93cd471c21bf0594579d91619aa1ab7bed8205fe3cec55e7214a870270
- MD5 398e9c7e01ae87380967aa35b48dcf2d
- SHA1 ad367658e121cb3f99f1877dcbd487d0bd35f176
- SHA512 6201b8e5543c2351c56a81e807fd0d6f41a02f3a93f5aa646d6117551a88d5d28bdbc305b5a7c7d1e6668ceb380803cca579d1de9c7a05a0f4c5742e18afe015
- SSDEEP 12288:1FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:1lnQ/tbw/2Mkjy6Fr7g0ov
- TLSH T1FA5523697965F98BFB2706F14C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 366d00e20c1b975cd9722b7e1440dad5729486712f595390b59c499336425422
- MD5 b2e0940f69ee696bea71c580734b74ba
- SHA1 1d4de5179c7f0d5afba8b3ac91bc34fab1a618ee
- SHA512 c471c22e40cb7652b60f0b4eb98b22803c87d72754de6b393f71eb8c5500cc2bd8180aca89609b1efce82cd52a26a050bf904d2906d04542fdc9aa6157d93d69
- SSDEEP 12288:V5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:VJnQ/tbw/2Mkjy6Fr7g0on
- TLSH T13C5523797965F98BFA2706F14C8281829B3F0EC6BFD1938F7B481128967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 265d2664c95e5332779e3fad0abc7e199f2bd7a783bb82802b11449447b29491
- MD5 e4f25202690be83d5e45083ba89a4433
- SHA1 e34d4a9a2ac47b24314f6ef42dcc20d2b8769ab0
- SHA512 f94132186240167a316718c5c9e97c2b5532e0b6e91b0990e033268aef06380470c276fdd8caf8c59963b6c9a287231a41443319dee173cb598ff6c67ec0f78f
- SSDEEP 12288:yiZwbDzzFEoS2cPvyRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:VZM3zFVSOhnQ/tbw/2Mkjy6Fr7g0oj
- TLSH T1337501A5B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 060baeed17b34d12437234585b1e7a3106cde0ec5ad9d913cc459a8e8fd2a069
- MD5 f7c73ff9432fbff4455d49dfee22c132
- SHA1 b6be9ab5f25498b2a8f69399097a0a3c0f903009
- SHA512 f6d550565d8946120cfd93c1d567fa153234b9a661c59ea055bf6affb9420fd6fc209ba9045cc105b62ef2bb9b8487751eac237db0693c5bc9557a17155e3047
- SSDEEP 12288:KEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:KknQ/tbw/2Mkjy6Fr7g0o3
- TLSH T1085523697965F88BFA1706F54C8281869B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 0df7dced1f4069a4a28580a95a3f1eb410b9a338bd1663da054ab9fae9275ea7
- MD5 8c9440ec257ed68602ed73fe75a5a78d
- SHA1 1ed8418746159e9f550ded5d2d4ed840236fca07
- SHA512 70a94a35e2116c4f9418ca4a3c0b5c75e0ad3f85b44c776c812e41d8b383d5b0df7e1c098b96a256dfbbee9d45e9520f085fb8006b6c69468ee12483dcceee4d
- SSDEEP 12288:SQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:SwnQ/tbw/2Mkjy6Fr7g0o3
- TLSH T17E5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 ea430718d376b947fbf8ac1ab89c8021ffd14f102a519de2d542e22e1884939e
- MD5 686c24e7884f4c60fc524b1a1a07bc6b
- SHA1 373103f026c1665fcde8d1f617e9c0023baec108
- SHA512 e3436b386a3ecc5da78e932f1bb300448639749308dde5ca8d6d9cb9f69fc1cf81b140a6020f523509addc7f1ef001ae4c4143759ed26d84268b38c613165f45
- SSDEEP 12288:5yPz5L89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:4zydnQ/tbw/2Mkjy6Fr7g0op
- TLSH T1CA65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 1ccd78ea00cf5233da4053d122a95854b4e707b3481b7aa827051fa5a427feab
- MD5 6d680c56faa1ca9c859f9081570a8e8a
- SHA1 1d7fd44ed804eaef0e633b25579540810efb3a97
- SHA512 bed62702a5c5a8e218f341a0f8088275fc4a8ded64f025a26fb74fb8091b1a221256a9255cb741100527837e1e6846a1b653f0b19c751a30ad277af38c9a6172
- SSDEEP 12288:6EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:6knQ/tbw/2Mkjy6Fr7g0oO
- TLSH T1B255236D7965F88BFA1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 309dfc9ab117528b0dc77933a0af3704e9c6144d0064d4916bf801fb90ff8809
- MD5 f1d288023a5a389922dd131782f16d91
- SHA1 1e319406726eb5ca00eb43e363ab8459381e49a1
- SHA512 0245060f7383e2fb0536c642fbbdaaff839141d7ba3ed0ab77645d935f8bfc1971168f0c648ce9b58b95c8f8185acb880ac66cc11571f6f76bdf453c76df9569
- SSDEEP 12288:HEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:HknQ/tbw/2Mkjy6Fr7g0oO
- TLSH T1FD5523697964F88BFA1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 40e2355310bd4a5b13db43267f239b0150dcb9ec13ed947845eb75f97eec04ae
- MD5 3181bb0fff5deb2cec5f8f79e3729721
- SHA1 8e1f0a742e97f78b8b960f551e0746cca9fb6d10
- SHA512 a22f0e22573833565fc176b5579ffbfffc52db91ce9e3cd02366a90f6ca26dc060ead5f4beb4e78aeb9ff312c32ef02c36102cf261b59be05552ba7d4070bf08
- SSDEEP 12288:hyPz5L89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:wzydnQ/tbw/2Mkjy6Fr7g0o2
- TLSH T12065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 7255c52d58f4110bcdb90077bfcb33575224da0df92973111aed44b519fa544a
- MD5 b4ec0131161326744ef5572a7f1ec79f
- SHA1 603baf6fd89b4ebc5a30a3ec41175834b9200bf5
- SHA512 23810f9f17b6eb864a39b5c6b4e3f9a587eb5cfab723b4ca189cb9a0d416ffec1b24dcf59e5c4d6bb4516911d5e12ef1150a8926107504680c643ad6c1e2e6ea
- SSDEEP 24576:ucP4mcvIjkGOxhKP2l71nNKbrh/8KBMnQ/tbw/2Mkjy6Fr7g0oh:JP4m4IpOO67W8KqQ/lFTjN4
- TLSH T13265AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 3a2a1a72ce126b9b43030f99c6fa21b33c74aa52307332ca8df4d8af7658fe20
- MD5 bd4d28271be6eb12da37337f9721f8cd
- SHA1 336ede4101c95d783f6314ad571fdb70b6b992ab
- SHA512 f07fa7c9ce29146493c4ec77f8300d298e869a3524ab3647b89bac2af9b88be29e1d7bf37777be8b8bc939a765fff5cefa5be122f30b126bf5410dfd65dea815
- SSDEEP 12288:zssf0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:fUnQ/tbw/2Mkjy6Fr7g0oW
- TLSH T16165F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 d07d10891d00242989bbf181ac242580584b20a43770842cc1899871db585411
- MD5 951a98f5bd601921c323ce29d56ba151
- SHA1 bfd69bf3e56320329937a51cc1d8d89b267f4dd5
- SHA512 6da2ac243b899f7d0c8f775973146428e310446322fa4a064dda63e3ee962bc7242295e3541348a35a10a096ea14247fa33e99fcbd9d933f120d6de1d77212b3
- SSDEEP 12288:8UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:80nQ/tbw/2Mkjy6Fr7g0oj
- TLSH T15D5523296668F94BFA3B06F05892C151673F0EC5BF90D38FBB08222D957C3D41EAA745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 157617673c757ba20fe01d909d74a90b26c3bbb7cc378ae8ed969c7746053f04
- MD5 77865293f6855a2fb2a1e83bb29b7e0c
- SHA1 5981a95149df1ec516c1a55642666f4d3aa4f753
- SHA512 e3749a90a5ecf9e0d24c215b20505ddbed3240738299b2f3b64314087e9e4c44fcc8649abe7bcddc3b366f329ebdb2921e480d79c2d09892372185d6039567e3
- SSDEEP 49152:ba0h2GEkuAe73q3pp46zwwQeQ/lFTjN4:ba0hNYG4Jw6Lm
- TLSH T1D8859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 c84c1304b80fdd806e045e10c07974b02092a95f8963eb245401a82dbaa210fb
- MD5 d32a7477ad95baf64d680fe93295bb55
- SHA1 fc3ebaadd2f468d41e0e3bb572292e9cf1a158a4
- SHA512 a1e8b4f3e6084d4713639d9951615fedae5a4ff87722a480dd4df1d19665ac7470484289a74002ece7f6f8d9c98a2375f1dcd9abb2a7671d346960fbec78c5ba
- SSDEEP 12288:PhbHjfXhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:PhbHjPxnQ/tbw/2Mkjy6Fr7g0oI
- TLSH T15955027D26AC30DAF63692BD88928546D732BC552B11A3DF2385423D4F3BBE40D79B81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 905eb7aadeee99165dfdc3f04af45d61648d3fec7ce78ff4f08ccc639ea85d27
- MD5 eee983cd54492d7ba6e9f9911889dbab
- SHA1 5382e71beac46737c32c539a2ffb6492e75fddb5
- SHA512 7e9eb15fdecd1b934a4acda73d9e1040e120615a66b80ab385d3952dd0d19698644fc18f34a9c456d2655db454f786153f07012b3ba5fbbc213a352cea40a34a
- SSDEEP 24576:u3YgnJcRTk4yti+R5dBR/ZnQ/tbw/2Mkjy6Fr7g0ou:uIgnaTk46pBR/ZQ/lFTjN4
- TLSH T14245BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 3c62095abc903ffbaa311da4007faf906761e94e87455797b48060eccef50b7c
- MD5 fc00126e0b122da66009a1b94fc8a1dc
- SHA1 096e3fd56aff10d80b3e45b07fa2ced39a0660b2
- SHA512 2d49e4c04933f4ae60a202f2fc69839a1cafb0b65c01843cdaa728feeb4dfde3cfb96d37910d8055db5ddbe6acc5d2c570e36672005883f7489a834d0f8863b3
- SSDEEP 12288:/gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:/AnQ/tbw/2Mkjy6Fr7g0ok
- TLSH T1B255236C6614F98BFA2706F54C838546673B0EC17B9193CF7B48212D967D3D41AFA780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 3683c939866ce101fe2b178d024ee7dd1774d2203c2ae8817a6410278f91536d
- MD5 4c940608c74e5ec3e46f74da8e26d570
- SHA1 b4d99c0685458b13248ba829f52690697bcb771f
- SHA512 fdf37875e11e1bb6786d12cadae527d55ad83e604bc0ae8510370ef7f27be1e36358c7bdf9983598855c68020f682463aa380795dc67a350c5d699c07eee990b
- SSDEEP 12288:UOb4A4LWOsvAYFTDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:5wL3UTznQ/tbw/2Mkjy6Fr7g0oN
- TLSH T1EF75F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 9254286749d6a4aa1628bcb18cf348f89563a69f2ce292cf576ab50e900a8c4a
- MD5 8d02d356b341b8ac1fb2732879978409
- SHA1 6ecbfaf74dfc70e7cb166864575968bf29d2445e
- SHA512 471629a77697dde20aff0ddedb4a42619c21db5196c46fa453cddcca976c235119fd70e4c916ef77bc09d5d102feecc2386c95aacb5c5ad639a9ad496d9e13b5
- SSDEEP 12288:rpFtCO/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:oOfnQ/tbw/2Mkjy6Fr7g0oX
- TLSH T17855022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF85C7AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 6576752b5f5ca9eacd5600b30c4e7df518697ab970055501a9eb48e10aabaa1b
- MD5 eeabf4fc32a7544e3d970b7ab1d1c240
- SHA1 86c2958e1f3ce020b2f45cf4e774d9c574801165
- SHA512 b98e7bc5f1163c303e2af0ef2c85bcf4d8a42302bb324ec103229be1ecad431d316c592ca719eb34cbff53aba966569ef4c0b92d0082b9f71c3b75468e272c8a
- SSDEEP 24576:J7NM9YqZqmWMUkPjZM48Mv6bEhsknQ/tbw/2Mkjy6Fr7g0oV:J7cBWMpPjN8DbEhRQ/lFTjN4
- TLSH T148659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 4ce6bb911c728675fa8558ee0af6d6751a377beecf42ee23cddbd0761d22ef6a
- MD5 f83a6d833666827e5ed70dd85ab9e18a
- SHA1 6a4c6320e0897238f58bcd1cb99613aaca76df26
- SHA512 a5f3a9d87e69c24d2fad9d5b39279de17eef2c9c21bd4e322fb62a98c8db20b8bf42d96f1ea25d776eb76bc28ed3bccf65b21f2f1f2c2dc2792daf79369406f2
- SSDEEP 24576:AW6BApg2YuyuNDYTabvcdvNYf8km1CnQ/tbw/2Mkjy6Fr7g0oG:AF2YuHNETovAvNYf8kmEQ/lFTjN4
- TLSH T140857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 7978d80eb2439cc1422b2f61b4c0ec335d16f2556b4ac32c48db169fc8d3a8e3
- MD5 acb02d3ee95e3611316f0a8f2861e3a1
- SHA1 8b20096813cc7ad9de9fedaa7426dd3409780c10
- SHA512 1b1dde1991f9417ac9a2092a4877f4d67b3e06090ab59a72dba389d46c312a29aa4923504cebeeeafcc402c485ef02875eb15be46760ca91d12450a5b51cab88
- SSDEEP 24576:fAFs06+Omlf3NXEbToLnQ/tbw/2Mkjy6Fr7g0oH:oFs060lVXu+Q/lFTjN4
- TLSH T1EF65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 45c2d00d16a92bc2d967b5b248b10d43aea5268b8e2e0942e62c51c2ef56d9c4
- MD5 5b379efa07e48ac14b6435102a421966
- SHA1 0a770dbe41a1fb556054105f7b8f0ebc6e932208
- SHA512 19ae0ea44d3de29aadeb1eb39e8481f89e4aa83726a7fd0b09b27d39aff3b9c929f06f1281b06f4f9a61904678fec4ebe6a88518fc525652edd0f76b77461344
- SSDEEP 12288:MCJnJ5D3VkrqzxkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:RJnJ5D3Wa+nQ/tbw/2Mkjy6Fr7g0oU
- TLSH T19975D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 f7953ee7130d394539aed5b76467748a29a607f30388cefe38575ab302c22d7c
- MD5 c928f7afa5df441e97f2f1cb1f6ebd62
- SHA1 d8d3ba49ba94b7249bd870538b50bfde8ce94c89
- SHA512 b2ac1cc1911ac6d5d0c1b124c296be973806bcbb5febeaeb3fff6416d0a22e83a492a317db1f9a01f1a0fe23f62fb6b7bf380cd133792613375d160e98988419
- SSDEEP 24576:8EPghm6/7IIXdwcXrif7qQncjlP65i3VuZnQ/tbw/2Mkjy6Fr7g0ox:jg06DIKdwc+eQnSt65aVYQ/lFTjN4
- TLSH T1F7955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 d2e7a5b96613d0d1c28e2a40ee56321aee1a202844621d7c7fe9cfaf8cc63a19
- MD5 f598570e2844b7dae79399cf88731147
- SHA1 88f1583720b2f40bd66d9d33c694d3e21503fc76
- SHA512 f3ab249e22d3cd706cdc37ad616c932cd24648c1064804a0a9cf1dbdd57df4f3033a5679a0de36696591878b240424a7b192dcff670de366e45e5be66e8e81a5
- SSDEEP 12288:CEP3RS6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:BS6nQ/tbw/2Mkjy6Fr7g0oN
- TLSH T16155126D37ACB0DAE52A517D88918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 d4b09c821f90cb08cec1bc171d05e33c8262bc174c5f9248f89f61e8676e51e2
- MD5 34db283efec6d6e0c782239e67bd9095
- SHA1 6d6ebd47fc25ae36b8e560c2c88616163bf89479
- SHA512 b3485dffb05b9eab8d7e2c103d81bd23eb13b50b7c913a294c3fab5421d910e844458a9635bbd4dd20b56a7def970aad0997abd80a00d24d77da6daa870d226a
- SSDEEP 12288:WjkyxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:WIyBnQ/tbw/2Mkjy6Fr7g0oZ
- TLSH T1AF6512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 a06093e31909b9620d22c6160cfc1f49a6ea3ef969380196d32215e6cd328119
- MD5 7a1f40ec687cb926959ff55aae0072d8
- SHA1 283dcc82ddf290345b1bdf131b63bc7a0ee4974d
- SHA512 c0d65eed881c4ab04ca3f491afb072ecfc0ede7c040680498d941bddd63bd1c6e18108fcf0c76bbee4098c6c757e3f25a128c578f364fbed3bf8b44bb3741ad0
- SSDEEP 12288:40PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:jvnQ/tbw/2Mkjy6Fr7g0on
- TLSH T1F255236C2625F89BFE2706F448928542973B09C17F9163EF36886239CB7D3D416F6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 999e0d5a7797a47918622736f849f4425afa5366cb053b2f6cac26ec30984d40
- MD5 23bd6f0390bd02102bff10d8e4cf8c3c
- SHA1 8627ad90ddb494b6bef12dd65e4a8bb666a66911
- SHA512 9db503d42976309c7b1db877d999a5aa63784e6b0f31d260fdc88b54ba041a645554adf92e8efa40001b42336bdf15441437662256cd2745cf42599d4462c8f4
- SSDEEP 24576:zQ9MxZKdcz9dw38nQ/tbw/2Mkjy6Fr7g0oj:zVKZ8Q/lFTjN4
- TLSH T1D4558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 d6322ac61c0827221694b82a2924cd1882ab7fad5a638755636a5eadd46684fb
- MD5 196b1d0bacfd448c5b4ab48f760ca5df
- SHA1 f07b92b60e396335435973bade90a426bb8d3353
- SHA512 60dc732d2abf0e749c33267b74c5c6264a79726c116017ee5a7e22ac2570f95a46e20ee216cc5d2bf4c4762dad352f23c3ee25246615b709bdbcc7de3828096c
- SSDEEP 12288:nyoKo20Rple9ptGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:nyocSApNnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T13365E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 8e3367b6e9ed26164934b8ce262456bb220e72ee06df172fcf43dd3bcc521efe
- MD5 b22265bb42c6ad14524ca87f2f43da5c
- SHA1 121204ac1933b39c37096a570e40fffc0b9a3e79
- SHA512 8e284fba8d5fddcf770c1fb7d35a1ec803b1c001b04d3672324b2b9b8be84694f7d000e25d459c1ad3d0f729f083ccae9f218668f65163e946d1f765281a2ae9
- SSDEEP 49152:XWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKNQ/lFTjN4:P0zuNIYLm
- TLSH T1D6A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3f0e892a5f411c176b361046cbd77d31e802166074af05e948fcf62ef8b1b5a9
- MD5 3e3e3ab3c662081021d090ef2e4392ae
- SHA1 3d786c0ebf37d4ad7a59299c7d65f46004fdb2e6
- SHA512 8c1218f6cd9402008b36cb182bd19175bbfee1195452e16c811319960348c2e76ff1619b10c4bec4f381d3f8a262251a24ab2d7d8b404856e421181a5261f0cf
- SSDEEP 24576:P1QT7EcpfxR+N5AWAz3ooiYtjMqb6nQ/tbw/2Mkjy6Fr7g0o3:yTDxR+N5YzTfjM/Q/lFTjN4
- TLSH T13655B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 b3250e7fa51d6f5eaf2af324991e361d87004c4f60acee2260e55e319a2748f4
- MD5 94ce11ef7b30e147ddea79bcc5ce5909
- SHA1 52350a28a77c6bb72555c84ddd0885314d7928e6
- SHA512 b356b0aba92745fdfe98d843f9335a484c069572dc4e06f0215bb28aa2bc3c6f269bffcb79cacfe90ccdf5bd3ccc52d3719a774d9283aa4dff3d71873fffcaac
- SSDEEP 24576:LTMdOz0FFS+1mSLWnQ/tbw/2Mkjy6Fr7g0oD:Z0K+1mSLWQ/lFTjN4
- TLSH T19F75E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 40b2a49a150b37e22bab646491857b73dcd6a4fe6b76a228a357ab4a5a73564d
- MD5 17e76aca577eda67ed9cdd52271d22f9
- SHA1 34f69caaccf7e4c7f96a6c55bd7b2b7c88c52e17
- SHA512 7e9d1c43c853e45e2dd87cce32a109af6ea345a1ad11399d2aa9463698b1a10bdbfd930ff6ce8db801ba031ffc59901dcd4de67935c396e1fc1d35cd8c2de0d5
- SSDEEP 12288:I4TDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:vznQ/tbw/2Mkjy6Fr7g0oI
- TLSH T19F55122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
- MD5 SHA1 SHA512 SSDEEP TLSH