neshta | 539f4171b917b4d2650ff326b6a0b85756c7cfd4380455592ddd4a9715b1f569

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
Size 1.3MB
Sample261101-1wp6qsft9k
SHA256 539f4171b917b4d2650ff326b6a0b85756c7cfd4380455592ddd4a9715b1f569
MD5 a3dbacee43363eee7c58623ef9cca29b
SHA1 d161552a2c39256c9532781c451419666d5c6d74
SHA512 0b4508a7744cefddfa8ee07115c58a8ebb4a630df4601fc3d67ebc5205430f49caf9efbf0c18dd4ec5177a3b4e777c6f103b27c93b76608cb4714a6494509c64
SSDEEP 24576:TTdPgwhlOBN6dTPBFkgLqna7RGw1iqhuOM6ansBjxkOTWvks/O:TT9gclOB0TjkgWoRGw7uOMkBjxFT6f2
TLSH
T183554911E7EB8239FDF36F7C697942610A7ABCA1AE38D68E1744055D18F4A90C970B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 20 IoCs

resource	yara_rule
behavioral2/files/0x00090000000188ff-48.dat	family_neshta
behavioral2/files/0x000100000001b96e-200.dat	family_neshta
behavioral2/files/0x0008000000018969-408.dat	family_neshta
behavioral2/files/0x0005000000018a2e-407.dat	family_neshta
behavioral2/files/0x0007000000018916-422.dat	family_neshta
behavioral2/files/0x00050000000189f4-421.dat	family_neshta
behavioral2/files/0x000200000001897a-420.dat	family_neshta
behavioral2/files/0x0005000000018a33-419.dat	family_neshta
behavioral2/files/0x0002000000018992-418.dat	family_neshta
behavioral2/files/0x0005000000018a21-417.dat	family_neshta
behavioral2/files/0x000200000001897f-416.dat	family_neshta
behavioral2/files/0x0002000000018911-415.dat	family_neshta
behavioral2/files/0x0005000000018a20-414.dat	family_neshta
behavioral2/files/0x00070000000188fd-413.dat	family_neshta
behavioral2/files/0x0007000000018907-412.dat	family_neshta
behavioral2/memory/2248-462-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2248-470-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2248-473-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2248-486-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2248-488-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Executes dropped EXE 12 IoCs

pid	Process
4768	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
2396	elevation_service.exe
2528	elevation_service.exe
6140	maintenanceservice.exe
6048	OSE.EXE
4156	PerceptionSimulationService.exe
3108	perfhost.exe
4268	ReFsDedupSvc.exe
5884	SensorDataService.exe
3044	ssh-agent.exe
2540	AgentService.exe
2500	SearchIndexer.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\56964d92c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\svchost.com	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\DPINST.LOG	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ceab8744c6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a64c3d724c6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cae8cdae4c6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000820998704c6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cac98d6e4c6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c540926f4c6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000df24f6714c6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000904d0e724c6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a11dc724c6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d5ddeae4c6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4768	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2540	AgentService.exe
Token: 33	2500	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2500	SearchIndexer.exe
Token: SeDebugPrivilege	2396	elevation_service.exe
Token: SeDebugPrivilege	2528	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4768	2248	2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe	89
PID 2500 wrote to memory of 2756	2500	SearchIndexer.exe	101
PID 2500 wrote to memory of 2364	2500	SearchIndexer.exe	102
PID 2500 wrote to memory of 5864	2500	SearchIndexer.exe	103
PID 2500 wrote to memory of 4504	2500	SearchIndexer.exe	104
PID 2500 wrote to memory of 3304	2500	SearchIndexer.exe	106
PID 2500 wrote to memory of 3700	2500	SearchIndexer.exe	107
PID 2500 wrote to memory of 5784	2500	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6140

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3108

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5884

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1640 1616 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1680 1676 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1640 1616 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1680 1676 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAINTE~1.EXE

Path C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE
Size 867KB
SHA256 c67adb2749d542b2ad9ff3d21f847b7b5293a3ce2ad21c4c2b4fe4225c80a598
MD5 3198f8bb34a361c97911eec5488ff938
SHA1 2aa0bbbf84a00720574254b7e6fcca946a9e71a8
SHA512 aedf2305aacfb36856b6310c2a5b0bb11d287f6111905b7e970bb742a3a88e09e07db2670e57717b4f851a7128bff242f6392d63480b742bee9c23db336fc8ee
SSDEEP 24576:WXYfDtczA5Lqna7RGw1iqhuOM6ansBjxkOTWvks/R:VtckWoRGw7uOMkBjxFT6fp
TLSH
T1EE15F129B7D008F9ED67827CCCA28111E633B8654B60E6DB03F459694E337D95E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
Size 175KB
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
SSDEEP 3072:sr85CnHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:k9n4N5QVrZZ7Lxkmsjj
TLSH
T119045C22BBC09075E69317723EFC79E44BF6BC319AA410ABF318495B197E350963931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
Size 328KB
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
SSDEEP 6144:k9x6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:Y6exwI1oB8RZ4Q5VYH
TLSH
T1DC645B017F908EB6F5A2807F5D7A631D5A6ABA221B10E2C373703B5DCD321C59A3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
TLSH
T186A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeCollabSync.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
Size 5.7MB
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8
SSDEEP 49152:DmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:oiH9MfT3NwMkKhBRr0yAk6qkKvq
TLSH
T1F3567C22B902C139E15102B159ECBFE9C49D99348FB105DFBAC41F6E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCChromeNativeMessagingHost.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
Size 183KB
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
SSDEEP 3072:sr85Cl8pIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:k9KbfHwCbyFdAafCPc53T/h
TLSH
T177046B51F7C7C9B2E09206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182566B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 131KB
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
SSDEEP 3072:sr85Ciq9YnyoRmLisiselSsONt3F7oQGO7M1bp:k9kgLHvld2
TLSH
T19CD37C13BBE0C872D66207785D25F36696AFF6305E74CB677B880B0E9DB46824D0C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FullTrustNotifier.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
Size 254KB
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
SSDEEP 3072:sr85CYl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:k9r3PiY+Fa7BdvG1cT7
TLSH
T128446B307B86C53BE66301718CF8EBBF942EBA150F6851D7B3984B5E5EA05D32E31846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogTransport2.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
Size 386KB
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
SSDEEP 6144:k9W3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:WKhHSDeWTRW8fdebmqI
TLSH
T16A84AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 125KB
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
SSDEEP 1536:JxqjQ+P04wsmJCWM2D57Kykf8d/R8Tyr5J5is7MDjrXDyO4zkm8dbHVLokF8iJTp:sr85CCQw/STyr5Jks7MvrMzkm8PL3Eo
TLSH
T127C3AE22F6A1C432D4920D788919C3B18E3F7D3169A99957F7E80B5E9E607C0EA1D31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 142KB
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
SSDEEP 1536:JxqjQ+P04wsmJC9S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghEuireklhKsikg:sr85Cs7HN9fN8sFOE1Z5Y2966ilU9xL
TLSH
T1F2E38D21F5C188B2E67205B54D2AA79E942CF6340F3194E3B3E84F2D9D342C39F765A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 278KB
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
SSDEEP 6144:k9P1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:jK+HMYcytZh
TLSH
T105546C1A77D84CF5E467C23DCD528642E2B278551B34D7CB6760022AAF637E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 92KB
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
SSDEEP 1536:JxqjQ+P04wsmJC66w8MghW4wNlu9HQIXsW/44:sr85C66w8oFlKwW//
TLSH
T1E1936C13BB928E33D4204AB91C6997B8D4BEF5306F1556E367650A4E8DBC3C22C3925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7c4ca7fd133b61e5730b8041f1e7b8beb1a2f8266e65b30fc18beb3bbde84cca
MD5 78b3244a15fe40d29adbfdf13ac27a09
SHA1 19d66e2d10d8b70b8edcd52944629e1e375c5976
SHA512 970b15effb7b2d36c119623f7b7451be946c00e198536844d4e21b7cceee3a1eed0b3b664e2889d2b5d9641514854747536bc15a33e72284018bc313b9617321
SSDEEP 49152:Nb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnSWoRGw7uOMkBjxFT6f:T3q6tjB9WbwqOMkJxFuf
TLSH
T139D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 16ef690084f3d2c4eb145d6c680be6416eba0e92da799297ff574ee6ac6a8314
MD5 be477e14501b1b79d6e4f181b91f7e27
SHA1 275947a7c8988750a84a81ccd027a758e05d8a9b
SHA512 32f30fa87a8f5b1bec9e13bbaf920c4a8579a9a44a8479a781074cdff7bc7000d5f8e69492862c9950a1437b751babbed10c53fdd65247668518e844821468ba
SSDEEP 24576:9XYfDtczA5Lqna7RGw1iqhuOM6ansBjxkOTWvks/:otckWoRGw7uOMkBjxFT6f
TLSH
T15D050129B7D408F9ED678138C8A28511E633B89547A0E6DB03F499690F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6ced570ac533e4e21951f6f986b126bcf2f7bb34329e4e3f543ed261b11d9a8d
MD5 18b1f7e88256616a8eeed6133c766f5c
SHA1 91aa9018a98ed2a07bf21b03f783b18d3825d5e7
SHA512 494733577bc3f204c570aa07ee7674b5030c58f0adec532c01e8808a39d5239bdcb61b807593c0c2c16827d85f87c1553d80bd4e3c6165d250a4a605be108090
SSDEEP 24576:r0Le5ji0hmxnrMqLqna7RGw1iqhuOM6ansBjxkOTWvks/:rPji0AxHWoRGw7uOMkBjxFT6f
TLSH
T15835AE16F6748331D073C0B9C5D2A69AED7230865B308ACB4296D77C3E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d1457429f8a7e220397a071ede176432e6abed4098f04014cf8924c915aab97b
MD5 7e1abf78773bd912deeb194b841551d5
SHA1 54d317659d9becb05c1f3f08f447f06e15f2fccd
SHA512 9f72a873c5d362047d72f8a897c1204defb76ef8d9d95f61838edd0c3425d28abd865ab626459fcebb838265c5b076584081371d8d66e5f12daaa8ffcb977e2d
SSDEEP 24576:Ha7/ezSC6vUyDZaqgrvWx6q8wyuULqna7RGw1iqhuOM6ansBjxkOTWvks/:K/ezSC6vURPvMHjyTWoRGw7uOMkBjxFO
TLSH
T18A756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3a2598b4412611361c6d0144a4f6a9db3ea298896a9cf62a173b1e23884eeed0
MD5 82c9b7565bae83194ffefcbf3fa4127c
SHA1 78305c633b138a595ebcb1ee8cde315b133b7a61
SHA512 97268c38ab7ebd8c078d6dfb727311e2b1118311662b34be0f9193f882e9239087c7234d8ec588a5ca6a0eadaab19445403015895441680f07ad69c2a60cb5f4
SSDEEP 24576:lVbqPb88hv/lV7tLqna7RGw1iqhuOM6ansBjxkOTWvks/:lVO88hXlVBWoRGw7uOMkBjxFT6f
TLSH
T17B559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 da15ed9a8dfef6ccd908899e96a8c448a507b70dcfe50afd36cc1875d2a8303e
MD5 334c7742e2282f48139cdac993550d16
SHA1 2ee32dcb99a16675e536d2ac24d4d7820f17e9cb
SHA512 fde6f9c96fd499c0f095a9b013c6827d5c1f6ee745124a4cd79f28d30976ab235175a5ba43b3abe567d4a72d6c2b55304ea0b3cc432a87029c2d1a9594ab696c
SSDEEP 12288:oG+LN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:oG+Lqna7RGw1iqhuOM6ansBjxkOTWvke
TLSH
T152C42356EB853096FF63853069DE50301401EEFAED9498AA5F753C8D40B89FBC6E2187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 66c2e5e0c2ebcc2ebe510c6a30f35e8700bf2d44c7d12469f75bd6abc1f95492
MD5 cb2d6487505e6ad0b2954d6ec727b032
SHA1 51267288686ed70944a887c274ddc42a407d819b
SHA512 2773bfdc4042d414c796f9301f4e0d7f184ca7ffe854a5ae05507ce021302db36fec9c9fef7088d92b87666cc89cbb7b5c692a00b19c9cea2df28eebc93d3405
SSDEEP 24576:QJIUlLqna7RGw1iqhuOM6ansBjxkOTWvks/:QJIUlWoRGw7uOMkBjxFT6f
TLSH
T19705CF3BEE28FCD2C67A8DB85A918200D77278704F61A3CBD175820EDE235E55E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 77079dae127eb867944643fa6b66197c4193958ecea44773a7f170fb9536f136
MD5 1cb7f14573745c6eba120206496090d8
SHA1 bca7bdce41bd6e65bf6aea6bbf1b73e99146998f
SHA512 1f2dee2cdf1a5da5ea078aa60c05543b0e0c761367f3092c86ed529abb856b9adbbb88911406f94a0c98c63c9c2a21af9f8558c79c70e7ff5a2469a63a522cbc
SSDEEP 98304:RQvGAdlCEL8c/pRNw5CEWbwqOMkJxFuf:OvyEYc/p3w8HFOMkPo
TLSH
T151267C656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9adefc89d7467b96dfc648e10f89109b4bc7a77a377a723c611fdfac3686f90a
MD5 8f798f2522b8b6e9f1832c37cf0ecf10
SHA1 9ff63be6ad8bafe92034c335d896fa0b2d03384b
SHA512 554eba278f6434c40977d75a7ff2c3d278c415340309fb19bd37d15cba04733c239a9b0918d78616e4a4d9a0eb7a3475327e8f6dd2405ed9b0bcbc327b16dd50
SSDEEP 24576:rwewsAj3Lqna7RGw1iqhuOM6ansBjxkOTWvks/:Elj3WoRGw7uOMkBjxFT6f
TLSH
T1F415E031FE74E036C7BB0DB21B2AC716142DBA604FA119C3E3B84D9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 24ecc2ab54d087a855bc2cebc488e6950f508e6d50386d3b1e3eed7245ac9f8e
MD5 f7141ff2cf1f6ca86746bdede9bc24a1
SHA1 0e116a28274fdab29ddf610ca8858f80e31641aa
SHA512 6f069c116dba0b195c481365028afd1b98e3d6e4d4fa4f573ccc58dd84468a2dc8f0a1be864dff8d3894c93f572a2c4f701733b145a51bdd0c5322e3e6c7307e
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHeFOMkPo:QUEtQevvqc2W1cpV29I323M
TLSH
T18D474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d8f1084440515034b481c79025d9545825f9de5b61f8efe54288fa56f7d2fac6
MD5 e04a5d018ac252148f0da81ad36c4d4a
SHA1 0124e460e62be6f8a58fc133bd1228d0c765536a
SHA512 2e9fa71653ddf7dbb75493bef41cf8ebabc697716b4de04abc90fd29ff6b83aaebcb974f242b2380b8700df7ae17663fbb4de313c586f19a4abaf2d9a0300a15
SSDEEP 49152:1CbRquA/m2yL5zifFiV+XenmE3/zXWoRGw7uOMkBjxFT6f:ioqHVjnmgWbwqOMkJxFuf
TLSH
T1E9D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5b7fd0a205b98be198c76207b35d882df87f6fbca1d092eba7c247128d772086
MD5 98d4abfa728cceec79a768677218b088
SHA1 e27295854779661acd37ffdeebc3863c9a91c747
SHA512 805e288e642e6c4a885496693a8d82f1312bf2ba2c6d20f340fefe3f630e1c22b026c4b5f5b09545e9ee15570f8e2da99cf43016de095a2a3e406ae7a179da29
SSDEEP 24576:rAhGLmIFoiwtA5l7S53ALqna7RGw1iqhuOM6ansBjxkOTWvks/:rAM1Foiq5QWoRGw7uOMkBjxFT6f
TLSH
T1E035AE81E7F955D4F5B39A7899B68170EA76BCAA5E31C20F2160D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6d9301883624912d906e78fc85ecd6d41a72c6f6f2fc126307e84096e2c3cf31
MD5 f347c74984deeeac38decd1ca2d2eb05
SHA1 b6652f3d7b70f90d6ec6c9d80d88a428d8302311
SHA512 ee0831c3cbc16e01038aeaea2ea7ffbcc09b543c53cb552e6d586d9fb7a0481091fef8e1a0d188f768c893729dcd75cc60af6cc25d85d40082ea653919bd0fe4
SSDEEP 24576:HwuXOWzLqna7RGw1iqhuOM6ansBjxkOTWvks/:HwQOMWoRGw7uOMkBjxFT6f
TLSH
T19405F14677E41CF9EA6381388597C135F7B2BC562A21CB1F0760C65B5F373A1AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 2f809a2ae76b37dc6dc861f9b4f0a3a3fac2e1e8fbc82473c20510eba72d1637
MD5 c6c52992c603788ef208b4a771a24ebe
SHA1 ce128d7d30920ed916bad551501713e6dd13a73b
SHA512 89a0b8486bda94259cce2da1fc2fa1b7d5c2e148dc59ad4c73d47c227215f6c0f7e3e76e71c8fd63d5806bc24b29dfbd650fe7e3d9e7c1080fcad45e6e36c907
SSDEEP 12288:PbZ1IynLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:DZuCLqna7RGw1iqhuOM6ansBjxkOTWvH
TLSH
T13BE4125A37D430FAEAA38238D8E94114D772B8A6AB7143CF1670059D1F72ED64E35723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 269ffd389e3127771367ec8ce888d5af3a81ccfb095ce2ae75adc42f6aabfd48
MD5 fa9e626aa9552a62d8879f9b28a22b8d
SHA1 7dede605eca626f3364f135a1b58df695d27754b
SHA512 d1af1222a6a36643be398f8ab91717f7170de09a789b751cb5e0775fb1b0ac4d48b564f21a50f0096839c16902756f3d738ac0200632baed33aa94089b6e0b52
SSDEEP 98304:mQRQyi36YOcPuLvw2gAf+PN3RWbwqOMkJxFuf:NQyiKakX+PNYFOMkPo
TLSH
T192667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ccefb96de657ae614e4d1bc18cb69d4e2255f05f2fa0c43acdf2ac902bb82976
MD5 46683f26346df5ea11e68a8747c8917e
SHA1 cf277e33d210566f3728966e0e7aa0c0287d08a1
SHA512 71afc0c508c9417c0a2926a5aa25b274696d84488d04f1eaabede92644b4be9cb4ae5cd120fa8a408cfec8c23fe619f7cf1a436abd1c517dd630eabef3c50e82
SSDEEP 98304:tQRQyi36YOcPuLvw2gAf+PN3RWbwqOMkJxFuf:EQyiKakX+PNYFOMkPo
TLSH
T178667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 882c531ae49b6dc95a5002ce2904eb0593e5ae389380febd502f3813f62a4b5e
MD5 eddf25816b42fc1f1213eb42c54b4e6c
SHA1 e825f0bc475546d801315f5c76c94a1cf8574317
SHA512 b55686613b4e280331438e03a3a07ab1ee1db4341e3cb0a9ca636d0c220f18fabd862df425a6e6776772e3b3afea268103970d167222660d1f013718add1cca9
SSDEEP 49152:x68Qg55nhxeWu7PNU3/HWoRGw7uOMkBjxFT6f:vthGRc/HWbwqOMkJxFuf
TLSH
T12BB54933B2F600A9D44DD1769F4A873196D27C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aa26f9c412bf68c4997a00098087638815c267e59f6b17220b330ae6933a8bfe
MD5 06c761389a05433778a8a16882662dba
SHA1 cafd0595c3711e0100c8f4e7433bdc6a5097ee29
SHA512 4343cf02de605a743b809571f5cc8aa654af5b74ff524fa641a65455e22104541d70555107ee1fbe13b2092c5fcdc5233bf5debad44a1c2193a076900f34778e
SSDEEP 98304:Ty5112gYy5azzVvD69nLKnhZ+WbwqOMkJxFuf:uLIH+WhLFOMkPo
TLSH
T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3ddafefd5dec991a81aabf8ef0e5a03ce50c934ca8b4f545ea3778b9e06794ad
MD5 8c977da9544197b3326700df789df189
SHA1 1b675a1c57dc27b8043df865282107768a96e34e
SHA512 ea0ff49eafe3b2aaa31a6351059cf661bca3d4549196e7ea861f09f6468125f902bc91a2d10c416fbf8cf42c30a2247031d80c73f09d21e5e6c08d64605b3717
SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJWoRGw7uOMkBjxFT6f:/u6JmQxd2dJWbwqOMkJxFuf
TLSH
T193D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 286e8963fa26697a9b4541ea3b44bf90d4fa2954e0739582699f9a663029ead1
MD5 af743b741990a893026169a9934aec39
SHA1 e5396c5c03b16dd2258ac0e70b3d54e07afa9273
SHA512 02a0efab4f53b542f681d734c6083685e79709a4d4ddb6bffcfae0ae90bee8de727c66e1725ec69a7660d1b176d249907cd3883a371689d0826183a8543245af
SSDEEP 49152:F1hpsNoJpF1A6yU44CwH7R4xFWoRGw7uOMkBjxFT6f:FmifPVRgWbwqOMkJxFuf
TLSH
T13BB5AE13F2D901E8D06EC178875A9232EA62BC460B34B6DF0A9077961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c9062d055fbf9c219f4cb9d2eb42125031327ed64a3202e7466932534809b7d1
MD5 66f67f2e25127604723da8c0b9fd74e1
SHA1 036578b68c32b4d0c5afd324d60e8938646edb5a
SHA512 e3ee2f67919db021e8b7782a89ad4533a8f27f3d5dc708f2bee5624350356b5a6971a51642101477297b2d370d644c781999e2fffc702d930733c74973d9d44b
SSDEEP 49152:rSuZQIY0Be2KIRVtOnks6NMHqCWoRGw7uOMkBjxFT6f:55dKOi61CWbwqOMkJxFuf
TLSH
T1DDC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 37694a69e635502666ee3c25e89fd5996c40c333454fd9c6528f6c574af29f45
MD5 6e26b3f18d632efe6f8b1101cad934b2
SHA1 12eaa22027ba6951ee5aaa86074d953305f0d663
SHA512 2a795192401390a3a383dc41f9b8b9fc084702c5a6b41510b8815a18b6a8c8f8605ce62abfd3d5d84a2c1115f1671ad3a475d32606dcd354093c5be65c39e871
SSDEEP 49152:LhtSn8EApI0figGgiDn0AP5w5WoRGw7uOMkBjxFT6f:KX2i/phsWbwqOMkJxFuf
TLSH
T17C95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 551cd3bba707ba5d99b62195d4e3165d1a42fd4d66cd1db864ec0bf928d01a5f
MD5 ba051f69391a6e5badaffdee7fa90066
SHA1 ff661627f5cd8274e44eed22b056fa46c2fff4cd
SHA512 a1cfcda22f149273afcb9ca96ed5e0bbf8efb80947538140a81dbd8fee8792d566a4419eb37fcc38f848160a5335756f9eebd4ef968a44b1dc07a322380eab24
SSDEEP 12288:ZWLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:ZWLqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T167C42356EAC62096FF138170A8DE50345405AEFFFE9044AF2F79184D41F8EFB16A258B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a7e38c8904fe38b0621ceff118a70c82eb6621d85318c4c9e6da41709d18f8dd
MD5 8abb276d723c51a0b7995f5d580bcae2
SHA1 b4377eccf43e8b5683d1142253f1693618c92e33
SHA512 befa8d07faaa86afb3a7d38869ec628ff1b60aa38467bf3ea603b4fa0e1634dee1128a795986712ade6136ff57d9e7be974b64bc91d9166e785240eafc4502d0
SSDEEP 12288:m7LN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:m7Lqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T1C4C42356EAC62096FF138170A98E50345405EEFFFE9044AF2F79184D41F8EFB16A258B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e663fb8da647d9df2c619e338f4e794fbe10ff13397324bf602c9ab1556945ca
MD5 0ef2a76541913e6f60026a827f781adc
SHA1 1d4cdc7900acfd5af58534eb8af62d33d4753fa1
SHA512 456efc8001a7eabf73d67c8b6019a0872cf8a6b6dc44c3a392c71d7456ee6d37a2dae8e3da1dec1b066e1ca53259a840e55249b683d44ff2abb98e6e0f92c08f
SSDEEP 12288:J9LN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:J9Lqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T167C42356EAC62096FF138170A98E50345401AEFFFE9044AF6F79184D41F8EFF46A25CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1866c71dc69eab08edc090c5c87c96e7ec235d8681c9ba2e32f5776684d21ef9
MD5 97a03a3d2f9060686d27d6d038e67863
SHA1 7a9538258edd9a820e67aee97796ed7d41f872af
SHA512 ff223e7effb56f6066f85546e4612387b6fcaa89faa2d967c1c17fdf0dde523819a21fd743bd89c2f2060fdbef58bf6c69753094db14a50561064dab4d7c7808
SSDEEP 12288:9VgLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:4Lqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T148D42356ABCA10D6FE63C170D89A40209561FDFAFF7145EF5F200C4D09B0BEA59B1B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 433ecede0100e2f992eb428dc091a294bd68f7be306e45a89888cb9464cc09f9
MD5 464e5ef35026dac8c3a4e6ce178aaaff
SHA1 0378bcf34b2509ac3b554a0fa64a4a92a8e16be7
SHA512 c94b3737170c19ebfc11711792986392db0ffe22bafa59e339ad1e7f3e525bfd4e30fb3a9ae2ccea490a14e2d145bafc6508f2edcf76a41fd6e30f9bd3b3d7d6
SSDEEP 12288:3oLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:3oLqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T148C42356EAC62096FF138170A98E50345405AEFFFE9044AF2F69184D41F8EFF06A25CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 cf3355e727b4e19cddd13a0c4757cc447364416ae4ca26ccc3d79e36f8385000
MD5 fa085e7117fa7d3566e599e43f9e2fbc
SHA1 1ab008396d9cd5ce2ab2db882f69508e8b2fa0f0
SHA512 0504f3d146ca1f07e1e124831cf216f48f3b4c453afdf0cbe3c608246b7f6ac24e9efad3c8509c02beaad20d5020c39d5995cf70ce96403a035b9e5f9e68c12c
SSDEEP 12288:evLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:evLqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T1C8C42356EAC62096FF138170A98E50345404AEFFFE9044AF2F79184D41F8EFB56A258B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 bc56229ec5e3e3faf5182d7df17374b78c8996a596d2b80fc7afc789a4a326e6
MD5 bed3f4b6385c96085a69774288089e4b
SHA1 bab92e6cdad6c377bf85e08443b0512fe8b39b66
SHA512 dfa29e5032a65a179e7ef7402aea40e70be04677ac4fdaa9e88fca1a7e1cb8eba64bcbec896039eab03093ff64f1fa33dd7ecc5d4298013a7444c39ae969962a
SSDEEP 12288:fDLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:fDLqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T1EEC42356EEC62096FF138170A98E50344405AEFFFEA044AF2F79184D41F8DFB56A258B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 888864569ea1f420672cae60c50ef9583800ebe972492cd0912077c3a70702e3
MD5 3cf0c5904cc8d53329a132019cd62cfa
SHA1 adfb48b4a83e6a64ece10a8bb70810f13c7173ca
SHA512 a0dd4e6f0f575accc20fcbfc4f761562550e2feafd35fd3964ce76cdd90e63163fc280c23b12c6359ff133605b4476650077f0598908ad77fedfefa698e8fadc
SSDEEP 24576:VfwvOk9RX6wkyAIeLqna7RGw1iqhuOM6ansBjxkOTWvks/:ZMnYIeWoRGw7uOMkBjxFT6f
TLSH
T12D35D029EBDC04E5E177823C99B7460AF6B178691B31C6CF029A53AD0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5e5a61e674243287cae7c201df3eda8d38e744bb18b113efd2ff5a6d5e16efee
MD5 f238c6205a738abd744824b8000afa26
SHA1 a75e9b4dc18c1af4725ad13cdc83c1ca8b25d49e
SHA512 64b1359bd6a6b150b66020ca132bb894fe377e9a85e99203385ff2c7dfc3db4cd63a66124cdecb272cf0d007949b03a54fcd2de9b4f480162d828b6780e4abd3
SSDEEP 49152:WYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZWoRGw7uOMkBy:+ySzPxWbwqOMkJxFuf
TLSH
T1EA066C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7d048c2c583980dedbc00a0fe9d65eaff01d70d5cec9a5f7b4792ed29575e6bf
MD5 39203d4677179a8b0cc35eb9f98c6efa
SHA1 8b7bf4600e492f5e69a4573d42c7e3fd15f03fa2
SHA512 7b3ba1b3b6b8601e6a7744c406978b59c297ebb5acb48db77afe5cbcb95e5f319cfb77361ae48f6ce28dd40a14f0a5c5e70733c393d88148b9f875acc634ef74
SSDEEP 24576:847Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYLLqna7RGw1iqhuOM6ansBjxkOTWvke:847JUQjairIhCnDHUPfF/JWoRGw7uOMv
TLSH
T11365AD1EA3EC01E5E1BA827885154A1AEA71782E5F31CACF2270437D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 885bba70ed2c292bf59dce46e3d3a66cfc64b2eeccb1383a68ba5c567e5b5600
MD5 70452b9a04f7b9678be7cda059a89cc1
SHA1 de02eb6ddf6c7dba887e623083c374c74fdb5aa6
SHA512 f9507920d2255b9b9c761ff140e653c2ef158cfd660da6cbe85b0e36182a29324c2831f8bb3af5f75f0f21d4b920063f87c145a3eabf67dc71fd8a26dbc32612
SSDEEP 12288:6ksfCLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:ACLqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T1ECE4F11AD28811E8D56E8135CB8A4600B3237C6A9BE1D3CB17D0F87E0F75AD55EE6B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d1cbf7f8934e21ab91f11c4f1d8d59b6d3856ff389db5b5554fcc3e45d338ae1
MD5 3f351e645192afab85cb383be0453750
SHA1 03b1ef500c4d889cd1d4b7f3ca5519e2bd38f6a0
SHA512 8d7721614e83b8dea4fd5741b6b70b7cfb13a4189de5d960f4765dc2fdf74a67d370421a861f9a23177444ef5fc47ac9f668c3f4d6dcfc7c33a511d681f57d69
SSDEEP 12288:HXCUU3ffna4pOHjq0ttxxrVSEUnZJDhzyllA2B5W/5dY:HXXUPDpODftVr9UZJlzyPA2B5WfY
TLSH
T1B24528007626CB4FC6A940335E33D5CCAB707D51EE05AF0773C9873F9576A59BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b6e27b89de4464215894319703ed629033420fab07228c7667ec1f6679149293
MD5 6d4d8278c30f53c2b16c53f10b8993d9
SHA1 52534e999c485b9e6f148074ec7086e978bc62b8
SHA512 0a2065406295e7dc9bf4f1ae075f6907fb79b33d723e807981a54ec23af9f452319ec498b93caa59759c85d6a04a3fe5ee3afdf1b50411e7f70760b189967939
SSDEEP 24576:teo2hptvqD8ugMHe6s6bbnBOPSzMRXO0j2aUxdto40p6618d+cjBaNe1qd+Gx/:92hptCgrMHe6X/BMoMRXO0j2aUxda40z
TLSH
T18165E9805537E68FD1B75032072B6B8CB764EC42B7496F26B3C9453AD86BB11A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_a3dbacee43363eee7c58623ef9cca29b_amadey_elex_neshta_ransomhub_smoke-loader.exe
Size 1.3MB
SHA256 ba5dd0fccd280cd1d7c9e477b25c391bcdcb5ba13467e529102322a7b5d6e246
MD5 7203bfa400d8535700c842129750f43b
SHA1 024d67db429ae90a7b38363f01eb26492938adfc
SHA512 6e9329df885cfe95b9325b6f4f82a667e3f9327a1552caf38fc528ae85e1f9321a9d4baa9244800cbe3ad0ad3ba50d2c1715a36fd9b1e90d3aaf173b9929a80f
SSDEEP 24576:ITdPgwhlOBN6dTPBFkgLqna7RGw1iqhuOM6ansBjxkOTWvks/:IT9gclOB0TjkgWoRGw7uOMkBjxFT6f
TLSH
T188553911E7EB8239FDF36B7C697D42610A7ABCA1AE38D68E1744055D18F4A90C970B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0f8c62742fefae958e7c2bdad163efdaf88b1b150e2fc01f4235e7d0e01e8d0b
MD5 e1770194039900cdee7318570824540a
SHA1 43cc5efca1a9d766a3d3ff70f93a4d067d035f5e
SHA512 e6d4c90c78de726f4a987bad38a28d1078038d8fa1f1211248062941e0039d3b1eed58bef3b059ad29b385a4cb36cfd0390b694c3e574f675a3fe6292efe4fac
SSDEEP 12288:zz7KLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:jKLqna7RGw1iqhuOM6ansBjxkOTWvks/
TLSH
T12FD42352EBC92496FF738570649E90301405FEFEEF5084DB6F25288D50B4EEA4EB264B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7d8673c0c6cee6d40e12b37129e5f978633d25b0d8a9a2a7a83e89f099d74e52
MD5 e1f2cab203bad86457b16d696cb321a7
SHA1 9a8f1102079fb85589806f2e209501c03fc2a399
SHA512 1bc9a8817605c75c7d40708d926c68b7b41085273bd4b61177bb1d3be7b3683e92dfe26114238f57ae68c5a444de60d0c29122b3dab15746c335c36a24b9b5ed
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYULqna7RGw1iqhuOM6ansBjxkOTWvks/:Kgb4mBIBhGFLWoRGw7uOMkBjxFT6f
TLSH
T11165AE1E22EC02F5E0F6D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 1f5c6676ac27e99204f0998c78c96324125cf73fc5a7c8089d395ec2d7cc155f
MD5 caf73305d3a29840b3c184141a30c751
SHA1 84ea573630d5d09cff87f4ca26b4a52a55aaa765
SHA512 850b88a6e0971ad700a09ae1e30c7d0950021671def0ac5fad2dfd6ea981ad7a1ecd124f2a5bb08b03fc7f519fbff80f3d02dd405b5db63803a37261b6a7f046
SSDEEP 24576:rG88u8FpJqH1nzria7/mbLqna7RGw1iqhuOM6ansBjxkOTWvks/:q7ZFPqV6a7/8WoRGw7uOMkBjxFT6f
TLSH
T1B935F165B7E101F1D477C13889864663F6B2B8251360EFDF0BA88A551F33AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 74a72175ca835f3a8766f4f08802b6007b29bd92428a7f0b8cacc70aebf79472
MD5 328d7e5875f265745b7c895f38dd71e6
SHA1 79a81b61e30b1666dbbb7b8873851bab24b2d360
SHA512 8a5fb2544482cdba7694d06705fa86a2a088d56f39bddc87beb8da2bdbefd72afa5850f469b2177bbd7a9d7b7f3a15afe9f98abd16bcff3bfd2c5cc066b1b0cf
SSDEEP 24576:hPUr+NQfLqna7RGw1iqhuOM6ansBjxkOTWvks/:hJQfWoRGw7uOMkBjxFT6f
TLSH
T1E705F12F62DD18E5FA76D17C89868219E771B8621711D2CF02E0417E0E77EE8BD3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 66f288f39eaae6c231535ce372fa697a0deae7d637b0ad73937f6ff550a3303f
MD5 9d8184b1c570cab489f404beea8abe9e
SHA1 8af262f2d86c92cd5bc3495af583483afe9c0228
SHA512 ecc4804bbe410d00ddc4de87ed97a164680cc7bbd7ea49b07cfae1b37c0813351c3a2f562ebe5cc5fcc6cb8f1106d88f3d5f7e517b877dd69ae9c5cbf0e0b1c8
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvWoRGw7uOMkBjxFTS:kG05lO43bGWbwqOMkJxFuf
TLSH
T142D5BF6A62EC11F9D1BBC17CD9C6460BEBB23825033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 221edc0aac59133ff3c718fbb6cc440a08c5c2e5f6dd52341e5524808668d3c7
MD5 57764737c29ea5d2d1bfa31519dc7655
SHA1 01b447c47decb7ff5f8a69baf4af7633ee43dbd6
SHA512 20a9e2724d162652d46140237debb41f1b702603b8035dc160ead3c584ca9e48a2513fe2c149fb2f3a2f989a3274745093e75daa65d36d1038129098eb5d5aca
SSDEEP 24576:xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnZLqna7RGw1iqhuOM6ansBjxkOTWP:Ra5POZ3hJt2pasx2+mHWoRGw7uOMkBj2
TLSH
T15765BF5EA7FC00D5E579D17DC583861AE5B1342653319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 988663369f474f6ef195e5dfc031e3eec77b75c526db5af69905a3be6b80c52d
MD5 16a82b20a000100cdfaf1af455a227f0
SHA1 39d5552e948c460d22d59a271691f9c75e7dc432
SHA512 9eb7bf14abf8bb1806966ccd7632550a856125285b2bb55b183afb33a0049b6f5514d10fcc0ed0c1139eab40d0a704fa83d8ff94aa2df5915f1d21c5dfdcc8a8
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkTLqna7RGw1iqhuOM6ansBjxkOTWvks/:3Nc/zEOVHFcWoRGw7uOMkBjxFT6f
TLSH
T120858B1623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ee1b02f82e726a5cc93d275479d070c97cc33d0e4a51caf863d81f14ade99e89
MD5 780cb415cb937fc38c35b657b93413bd
SHA1 edf10b6611b4a755f347cf67151677f05d2d2649
SHA512 2f35e6aaf9ed8cf7f2a564fd8b08b48af00689e6f547e3a1cc725f9a8c6cb55e75b1975e72ef79c4fb63429917d07250ce0a74e6251388b300f82e8a6f203ccc
SSDEEP 24576:53kNvNnaFeYhJNtmZBmVLqna7RGw1iqhuOM6ansBjxkOTWvks/:53MwBtOmVWoRGw7uOMkBjxFT6f
TLSH
T1E655AF6EBAF806E4D1FAC6B4CD238512E6727461173292CB5390C13F0E679D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 de73492a7c1b66956cdef63e7ad20e9fb97d1da6207fa92a750b754323c6d288
MD5 96eec1a78ee43a6b7eb6c0aed9d5c906
SHA1 8b332563e6b02129123fb171898ba68f0d912742
SHA512 a39e7d655658a0fb7b6597453e4def5ace51cb2935ecab76aacfe7056a7e0bea46f759a3d959475ed942a79e3323e978e1550c9a3a19a1fb65a72f4ca8696ed8
SSDEEP 24576:rD3FHshBIYQgA2Lqna7RGw1iqhuOM6ansBjxkOTWvks/:rDVHeBIAA2WoRGw7uOMkBjxFT6f
TLSH
T1B225E13EEB9C00E4E97BC1BCDA538606E67138AD072155DB06D481BA1F6BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2248-462-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2248-486-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2248-473-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2248-470-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2248-488-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2396-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2396-30-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2396-31-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2396-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2396-230-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2500-273-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2500-469-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2500-280-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2500-274-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2528-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2528-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2528-316-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2528-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2540-237-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2540-242-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2540-244-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2540-240-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3044-219-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3044-468-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3044-225-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3044-217-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3108-108-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/3108-102-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3108-463-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3108-103-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/4156-95-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4156-89-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4156-461-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4156-87-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4268-127-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4268-121-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4268-464-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4268-130-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4268-475-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4268-476-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4768-11-0x0000000000C30000-0x0000000000C96000-memory.dmp

Download

memory/4768-204-0x0000000001000000-0x0000000001153000-memory.dmp

Download

memory/4768-429-0x0000000001000000-0x0000000001153000-memory.dmp

Download

memory/4768-9-0x0000000001000000-0x0000000001153000-memory.dmp

Download

memory/4768-18-0x0000000000C30000-0x0000000000C96000-memory.dmp

Download

memory/5884-212-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5884-465-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5884-467-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5884-205-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5884-206-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6048-77-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6048-423-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6048-84-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6048-76-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6140-68-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/6140-72-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/6140-74-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6140-62-0x0000000001F00000-0x0000000001F60000-memory.dmp

Download

memory/6140-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download