bb7fa9c946a4a9c566408eed2bf8853f5b2847c0e4fe121874ec2909bf03bf9a

Analysis

max time kernel
25s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Size 2.4MB
Sample261104-1t79jadx2w
SHA256 bb7fa9c946a4a9c566408eed2bf8853f5b2847c0e4fe121874ec2909bf03bf9a
MD5 47a76d7d9b52fcd0829b972a05788577
SHA1 cb77ff71343941259d21c6806eae3d3b1672ade6
SHA512 95fab8ba6057796fc0cf59dfb9fa0c6f82c64fea36d0f7472ff48ffb2e24e0346f12ece6e28c8ff7260e8839a69056ea08a7ffb7211071484f376afa0af119b4
SSDEEP 49152:kr0rVNuAZwZPRmch5VEtnUhs4sT8gPbNebJDmg27RnWGj:kA4Pv5D527BWG
TLSH
T16BC5BE21F3D78171DA5F167098797B794AB5AE448B288EC3D3807E1DB9326C1983336E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5392	elevation_service.exe
4564	elevation_service.exe
4348	maintenanceservice.exe
1484	OSE.EXE
6080	PerceptionSimulationService.exe
2804	perfhost.exe
1348	ReFsDedupSvc.exe
1340	SensorDataService.exe
2568	ssh-agent.exe
3756	AgentService.exe
2292	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\75a1bb843a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bf41b08ca76cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e46358da76cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047632a8da76cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bde8648ba76cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069588a8ba76cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f1ebe8ba76cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b92aa68ca76cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab9ab98ba76cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{976AD872-20B5-E96E-DC64-CA407C67347A}	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E01E1B35-70C6-CE64-C4A6-DD5552332A4B}	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E01E1B35-70C6-CE64-C4A6-DD5552332A4B}\{3F549F2C-A6CF-845D-0E2E-F7C618C3DF16} = 4737d8bff0bb11ea19043b545f961349ca96649089de30b847ac60e46989a85f	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F6350DD-03B4-8FF4-8793-3A4D109EF047}	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F6350DD-03B4-8FF4-8793-3A4D109EF047}\{9BBFC424-8212-FA21-67E4-F2695B47D6AF} = 777e41cb842f808488f1959e601fe26bc032635bcd6ffdc72a934b56113bfcd3	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4315442-AA72-A34E-BD6D-797285DA5635}	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49714F7B-EC0D-1BD4-F13D-858148E43916}	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49714F7B-EC0D-1BD4-F13D-858148E43916}\{7304FFB8-D427-7FE6-AB63-4267296DD8CC} = e3bc58c7e4995ff4eb1b5864ebbf51ecff0389eee69285b34bdc327c2727dafe	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{976AD872-20B5-E96E-DC64-CA407C67347A}\{406B9EFB-8956-7E51-C1B9-73D2E4B3028E} = 3e3b151e2f2428947782380f0ff06484c4804f2481d22d8f2a04f4549b8e1aa4	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Token: SeBackupPrivilege	1348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1348	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3756	AgentService.exe
Token: 33	2292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2292	SearchIndexer.exe
Token: SeDebugPrivilege	5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Token: SeDebugPrivilege	5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Token: SeDebugPrivilege	5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
Token: SeDebugPrivilege	5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
5784	2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1588	2292	SearchIndexer.exe	100
PID 2292 wrote to memory of 5420	2292	SearchIndexer.exe	101
PID 2292 wrote to memory of 1724	2292	SearchIndexer.exe	102
PID 2292 wrote to memory of 4944	2292	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4564

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4348

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6080

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2804

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1340

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2852 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2752 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2752 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2852 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 74c10617c878b42d3c06a566da708640b86a504f650339b48841f4c2cbdabdab
MD5 1dcbfbe2c33679dcadfd107e4d260d66
SHA1 1a3555f5e1450079fa313fbca14e1d0a9930ce0a
SHA512 aee8e8b2eba7364e7194afe6ae7909d2521b8c61cc998c3c3c9cd6f113086b77097fd72eeb8d2f5ed9a3e8e63d7e6667f525385e90db5289915fd19c2cc1d071
SSDEEP 49152:fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn3Dmg27RnWGj:d3q6sjBgD527BWG
TLSH
T12BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 cb8edf6f6afb0f478e4592cd7e0824257ed9d203e40bf471cfa78bc4669b808d
MD5 8abee2e82c211fc03341f69525bd8244
SHA1 c0a6afc1a783eb826db619fbf109f92d56fe9151
SHA512 76d19d4294387a763a04468359a8c1b09eb5dc1995a7ea898bc78f113247ddf15c0afa58fde71ef5af0de7572e0b0c620718f7132b91ecbb414a8a82accecce4
SSDEEP 24576:sXYfDtczAgsqjnhMgeiCl7G0nehbGZpbD:LtcZDmg27RnWGj
TLSH
T1E765F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 504ceec54fa327921db22a38cf5fc4d31607b5d15aed4b98f0347189d132367d
MD5 2e4e4461ab39a6797e6263ef5ceefe1a
SHA1 4f7010e9ddcbac29ce1229420b045cf2d42d3121
SHA512 bac92bbdfd5874a70458dafc79bddfe845cadcfcbe389359a1b9e883033229d7854428a2b4a5f4caba9e33e513e1124f1db11ad2e64405f45f2ea22876866fef
SSDEEP 24576:e0Le5ji0hmxxrMbsqjnhMgeiCl7G0nehbGZpbD:ePji0AjyDmg27RnWGj
TLSH
T1BE859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c2fd03f5a98411d7d2b96a7033948a071459ba8705d9224c87ddebae3a2ea1ee
MD5 79a71099f51ea711381cc96020ef428c
SHA1 5b713b8e7b2d0139941ff47515b9fa24df82596f
SHA512 22dc585878e2a54fd865800be39a57c8a6de4e8eb10298174b9f6c1e3757c589bb134b2028bca0a3f05cd3226185ccb207239bb3af4190a3cc6ac388f9db233f
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWn6q8wyuVsqjnhMgeiCl7G0nehbGZpbD:V/ezSC6vUzPveHjyeDmg27RnWGj
TLSH
T166755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 93d33273272afb53fa22bb0c3ffcb37d2c522e277b018b3aaa030bf1addd9030
MD5 7c385b86d916c05d806f8a844bf382e2
SHA1 c2e0c79779c4be0cdcd58bc430c5e0d0f428d91e
SHA512 af1a59bcea5929cc7e69220728568e5dc2c4d7f8b82f034ca9c3b29a09145d108f5a98b327ed631202cf623a0c02cb63c6a84be158fb12098661d3de15e0f758
SSDEEP 24576:NVbqPb88hv/l+Y0sqjnhMgeiCl7G0nehbGZpbD:NVO88hXl+xDmg27RnWGj
TLSH
T105559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 46539aa3cc9d40018ab30c02983407a163f61375247b51b5d6676900e97e2df5
MD5 f1adfe4313508af8c10875f2bcbe59f5
SHA1 adc38299c6bca21a134f3b2b30453a9bae4144a9
SHA512 8f4bb25ad140639b36062c65b9e2ba59d816ca192df0042585de10f06b5561a023605fbddf8676bd08af6beac09b2e31e1a9cf60b7201adc769a7433f368b88d
SSDEEP 12288:HL/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HL/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BF864C50DAEB7608B5C3E9F11EAC137E56982008436A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 474edd62b7eae71eb78c53568a8b184e97d85bdfcd6c0a9ef20a749bce7e75cf
MD5 25fa575ee3a453ac3fa079ddae7dc9a6
SHA1 c2a0013ee30674230f5db4e51342147e5639fb04
SHA512 3cb6bedb5240030d6f778a3b8c77ffa2882435f4386a5b0068604b67eca165b71f9e6d40d3d0125a42276bcbd2a3cc26c4df4c80f963ff83b43f29ccc2bf9a14
SSDEEP 12288:5eBNUbTVO86UcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:5JIUcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17665CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d06e4886b074af64fd4aa9ff51158cac9c6b04c8a873db84adeeea42eb57f95c
MD5 ff9d866ad2978e900fc733ca2ef84de2
SHA1 abb874e4d5f1b70fb47fe1c64627e55f8f96fdbd
SHA512 5c19a9f4aa7385f96b6e46f543e7c9616789ba57f0162ef3992e81d4582c2a1c890bdd11a3ef269eb53e743bc1603bbc992d7fecace9975f4582b9aa63849e97
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:tQvGAdlCEL8c/DRNw5C5D527BWG
TLSH
T18B266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dfdfeb897276c7e085c4b42c8645cc0328da7f6fb2f201c8746f132d5231981b
MD5 7b0d1e819324121f014771505ca0c863
SHA1 370266e3a8ce6f7e682b1eb910073e597b1f2386
SHA512 f10a8066ee36cd67f1fe80a514a9548c39dcbb98e6243ff2d702b16f5f520c617d454626bc113489854f72ecd19f35e9fdd1fbb6c05ebd5d5927428793be2c7f
SSDEEP 12288:RAwSfxL/2Dc3RDLLmt0LDQewsAjOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:y0ewsAjOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 133d515253ce37bf6d35749d09d9a7142c0670c0dae5978dfc1a6dd0d93d6d53
MD5 cc196993486b57d1787d3f6ed916f1d1
SHA1 86a509dd82a2976a36d2d5122a4badbb988be245
SHA512 6a240c318f4d054012dafb988519c6b87ed74f53d1d23f0d1fc156011cd3e696b320c97926ec7d6fd774910f2d734217d62f327ea66212f8f8ee76acfbd99b05
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHqVQBWG:SUEtQevvqc2W1cpV2tI329B
TLSH
T126474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 232d6ea3cd3f7424dd4bf44a8f341f545e555ed29b58b6571037c111d9a36cf2
MD5 ac9a6180d48e175d4bc80b489158cbae
SHA1 60be5d47f8bc9eaf7164b5a2c1ab9db559aef7bf
SHA512 450625970f7a8d98f4d531c43b0c8f8286e0dce9a19b03c463150c8bdf801b3d4320f4c7da0f537dc79b8eaa935bb8ff279ee18324511ee9066e2e870e4ba2ff
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/zCDmg27RnWGj:joquVjnm1D527BWG
TLSH
T1E0D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 80a54a8ff32e4b5dc6d32f3e8a73cbdc842eaa916fced1b1f19dfa2dab805f52
MD5 922c57455d5df44ac5a1e4ad50ce8001
SHA1 eecf3c0e613c7d2ad510d05ab25bed331129a43d
SHA512 4ce852e01bdbe6fd79aaa55d028ad01b44d0333cdb3deba2af1000be5ad536d9acc6d17c8d59aa7b2c7892bd6891c24d6f7e1893016f8db7b8020e8f5e00a173
SSDEEP 24576:GAhGL3IFoiwtA5l7S53BsqjnhMgeiCl7G0nehbGZpbD:GAMUFoiq5lDmg27RnWGj
TLSH
T147359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 99101e9a6192f915723c7e7269cce143deb33d116f0bd97a412ff87386856709
MD5 d387c5464a1406495ce8ced7bdc42623
SHA1 136a11dc6624a8391738190bd472b22d356bb0c5
SHA512 8addbfd29e385be832fc02e195c73f1e44cebe6742c091ad6829ec90b44d16b4d4a5953e11b0c5e09349a2ed8197b15519730a9e7c7fa9c334a9e6e359c2b4a6
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+C1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:awu4OWqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 82c44d8135e371918599de84ef5def86cb17273526241db15158c415edcc01dd
MD5 b83b4570deb2ea2a3eb590755fbbd797
SHA1 3c0ee57b237c89a69e66e5b66e521a9adbdec314
SHA512 1f3ce67a9b8bdc2219e786d7110e72282698bd95658156acb8f89c91df003a9c606e5ba78e7f9fb1cf2aced50edd4013ce3a1e80db0bbeb867264043e8660b84
SSDEEP 12288:DeZ1Iy+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SZujsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 de05b7af7b3e6a7d7dbfbc31316a76aef4650e0745b7d4a4337aaa0ac562aaf0
MD5 3ab6db4a8d9fb5686409d5ea7452d01f
SHA1 80fdbae6531d74d87ecec50598b7f8bf4e5fdf02
SHA512 86c75419acc669c6f299d40bd7748a575b000af6311de8f328e6aefd82412f1304d7e0acca9d87edb95ae6e388cabbecb654213a66ccb7cdf7ce345b269043a2
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN30D527BWG:pQyiKa/X+PNEVQBWG
TLSH
T1B6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4a62b05434e392f956736dc69142052966cda3d5205432d2c968ace18a7cca78
MD5 4fee3d912eeb044bce6600f34b67e478
SHA1 036efcb8510080273dc4e64208ee94e47e815695
SHA512 e50e7ea515352cae4ade339d6c15d98b1d6c7b777ee8b4bd54f05b60e7eef9dae6f2c51f7b4f77e4578d2a22323c49ebd388ae680f0be1e957deaa098d234407
SSDEEP 98304:/QRQyi36YOcPbLvw2gAf+PN30D527BWG:OQyiKa/X+PNEVQBWG
TLSH
T158667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ec7f3cba161fe90dbf3a2056771815dd19ec2d43889f319ce9263e430b885cef
MD5 8b6b9d0e0ae6c1f29b582c2347857344
SHA1 6518950ae2ecd4bd5d714329940312bd273380ec
SHA512 7cf67fa303bcf2a1c1452bbf1822a28d6a4e2b01afc196b3687d782225a0371f066ff0163fd9b25b2563c55b464d7455074c6585387c58d600b1dd0ce12d891f
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0zsqjnhMgeiCl7Ge:668Qg55nhceWu7PNU3/yDmg27RnWGj
TLSH
T167B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6083f5c53a7469fb85a6c40f62f7d20d3464d3caf1d539b3fbfb45d78ec963e1
MD5 189b24cb00b90d4344a75f5cf97a7b74
SHA1 0f2e13319b84088dcc7a1be9a87c300e4aa5789f
SHA512 f04fcaf9948922253e3e0c86657fae7462726d78b97eb15aeb0d7e8553e691615a1ab41ca4381b18a7d6e6a42bb68018a9c6561c2566c3ca3f507979cd40fa47
SSDEEP 98304:0y5112gYy5azzVvt69nLKnhZjD527BWG:1LIHEWh9VQBWG
TLSH
T10B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5e225231417eadceebddab31fc12b3e8d8af62434410ea6319bc27e986dcabbe
MD5 1a890698336a38e0772014471aff236a
SHA1 dabd898962118398ff59f68ea4356273a0df00c4
SHA512 6ba78d6484b84760f150a04a752f90b6056ed57a19c1b6c9efb0fdbedf65e6053a538042808a8eabea06cfbca23525a4bc09dbe0a655ea4a06c2376d824b27cb
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glsDmg27RnWGj:4u6Jmdxd2dsD527BWG
TLSH
T1B2D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 de60418bcb0340012d984c3e5ee68abfcb6493a5a1a3e04ce01db8e59a4d3556
MD5 3ce282c8eda0b45b6d526f299cc06a75
SHA1 eb8563b06ce0460c18a0d711032628d518404705
SHA512 474381c2602f32b14eee191ccffd8eab99c9c23f22d248eac8482e2081df7668ffe0c5fb9a2638b8c2320d948451120c57741d9775c96b81b7470c9d7ff17dcf
SSDEEP 49152:l1hpsNoJpF1A63U44CwH7R4xoDmg27RnWGj:lmifPWR1D527BWG
TLSH
T145B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 66add0c4f7d9a90e978a420ab9d487bfdb97793f6f64aadff6bd8805afac23d1
MD5 6a7788ef7757a60691232fbdf9b6538a
SHA1 d52795c052bfab727cb4f047fc7755b03c2c4c75
SHA512 a0bf53483359971f81e61e6530a9a4ab0c26e14a4317c9dc50f826f5366f55b5d10cdc67e788fd7598a8bc9e05f768c0988a4f7f4bfaba4d9bd4769bf0a32931
SSDEEP 49152:+SuZQIY0Be2KcRVtOnks6NMHqnDmg27RnWGj:Q5dKii61nD527BWG
TLSH
T1D0C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4cedae986c0a4104d070589be0bd253d88fda98407eae08611a5d0fdfb9f0286
MD5 5eff02e96dc727f356cb0895004daeac
SHA1 86429e1a5e6251943bb9d8dac65c6850e25315c5
SHA512 de4f0f3766c4622ac440e5b9fa564bcf8405ea2ebc37b667f738d71e6dfd9398aafb2583704bacb95a830b40c0fa8e2d7f8a862fe9e6b7caa61d1434aba91548
SSDEEP 49152:LhtSn8EApI0fig3giDn0AP5wcDmg27RnWGj:KX2imphhD527BWG
TLSH
T16695BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3f87d05972942b29cff541d544ad26f3f6e32e2a466857e38fa34c535ab2c6f6
MD5 c942f8bd75f532adc49870f4533b0e0d
SHA1 fc2874c5c7b623f6280058035d4e7f0c46dc77a4
SHA512 b7a9d58fc8802e825c09e5c752f58ca59b7c50d516f6c1e3d4095385ff8118e389cbf2b187efed0b83aaf6ba5a4885cb5eb8ebdfe8027837839abca594432d38
SSDEEP 12288:2HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A5B7CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6791f9d6beff919850f99898579065b15de36d0a8c69b75cea4e4d0daf045bad
MD5 ebe888322e342af64bae957c5bf8e3ce
SHA1 7cf3bdc99806c64011a411ce90aa12ccce999a83
SHA512 99ddf0f483f8aef013c21c07d35b796734eb751d0bc3a3131d9d3e704bc13dd04657b56d8947885a9c75886bada6c9a61dcc0b611bc5d97d797d533aa8c9546f
SSDEEP 12288:EiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1994523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0e86f2d9ebca5a2e746b166462466692872b2294d47ca9f56e6e2de5cde46380
MD5 d2286c37ca4178f42db5b36b8a4c52f7
SHA1 67279c3ad68db75d5f381388d358f48a67e55506
SHA512 93c1507374fd1c496644576f8cfbdeb37b9214521c33a724994e83ea141b5b114c9a2138662c1c061a5da7eece51b747c0af55ff4eb10a87ffd31af051d1c748
SSDEEP 12288:dEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BE965C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CB9FAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 59ac9e9786230588a7e3a2049fd0317b8bc573363d38f409351f1d2cdac8ff35
MD5 79d569d434896d94b62f03e6ee59ce6a
SHA1 fc1b7b7272cf7be925942393f2d64dcb13ff9674
SHA512 8c50ce763e5c2752e6b18c9a7941e984ac25b236d943d93615da93b063567c6b2ca361daf68ff569ad3fd51f47f89c70d89ff4615a8f208370b3bed6848cd01a
SSDEEP 12288:dVhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A645236F675C00C6D83685B4C2E5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5ac4f1d5f5fb7f01c04e731737694091f642b3e20da4721f925342031ca0bdee
MD5 df0b08d8963ecda8a82462ed0ebf5f20
SHA1 e38cb083e9ea69561f4ff5c128dfc01feb9f564d
SHA512 12add30be05b9b42ecf54db2cc4e6f1bf70fb1036235b39f5ed9643036f7ec0fcf92a0d7674207538f36780d0966e1ad84124c8e5e681cbba51833f6566236b4
SSDEEP 12288:XZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 acd9b2338a60a98eedbbe2175fd4ad9128d0ce22ba873c81f4ecfaf3668ce799
MD5 ec0439114442b822d87446195fb2b10e
SHA1 a96dcf740ce855dca09c4f698378054b93f4b0f9
SHA512 618c10eb7048bf4c846706405a6353ed044b906dd141471da7b587f32f33f41bd3569dd31f987b496796a3d83b38f3e304660faa1c9c7b8cc1bec051eebc7cd3
SSDEEP 12288:YWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f686a05577d460ce3be05a7f2be44196918649262f70f9de0b1a86466eeadc59
MD5 f5590d28fc1d5293a5dba8811bbb9aa7
SHA1 df6f29869707871fbe1953fe93dc97f784d3a0c7
SHA512 fd0db29381c8df9c80bb8728348d2b3e5d4009f94b8394bcde9b946857ff6c9a07e0d3a1d20290eda70503afe6ef1b9880044a300273355fedccc95b6b8a38b1
SSDEEP 12288:K6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:K6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BE965C41CBE52648B5C3E5F11DAC073E5BE92004837A6BBCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8f6a315e077cd9988c9dcb4df5d1a9198eb450e2f8b2c1ecccb25df4e114b7cc
MD5 0f0cd3b8b9ed8173bc3557a76f066125
SHA1 cfc51e3d2711389d019dd556d36056b7567584f9
SHA512 d2828a70ef941c1198c19dd94ccdc39839e5f82ed8328db2cf0bd8feebf6adc33979f7ad9905b33f8ad523333d87c777319c9666c29f044622a5b9bee54f6435
SSDEEP 24576:nZMRzFVSOCsqjnhMgeiCl7G0nehbGZpbD:nZMRzfKDmg27RnWGj
TLSH
T19C6501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8bdb3b84c49f457115043ba2dda3a859c62d2bf470ed22223f8903bc9afd9993
MD5 c64fe86d14c746f7c3562ff62f428748
SHA1 00572ab3941d242b791910b2a8ca28caaf43ba7b
SHA512 df5107decf01199aec3e656ea432e97c603340ce3c1b55db2cbbfc04936c03cdc8e4791c776482f62a6fc6cf9c7f09b0775c8a79eb722d9d774f7c1f41b072a0
SSDEEP 12288:4TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 34122257b13a20675131bd9f90d3b47cb0987f5beea4e1f18d6eb3d366db585c
MD5 395c1e781c67b38875aa1734216e5a84
SHA1 0cdb5a1c3a7eabf339c972ea22a6bd8d391e4a02
SHA512 256ca6ea156e169e379787fcfdced2f5293a578f6d76f507a7d43542944ed5ae24d397bd1677d3d0c49f40cc702587e33e3af681129354023e558d2b6bb06c18
SSDEEP 12288:qvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1584523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e7be7385e3b15f86422fa3e4b81dd330f0e397de8305b3c131eeb56fe4228d31
MD5 d2bea32914e52527638065a60ff1a074
SHA1 06937e106812bdc819984ad945d6b8350947d078
SHA512 de0fa7cbf11129d6d9534c463f53095b622549c7c48b5d3a338e1c8a0784a000d55759419d37a08a1a3774e440eb178fb12cccfb6ab56044f25bd93a24766170
SSDEEP 12288:VyPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8zy+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D555125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 33a0436f87078fb87932c2234189be63cc0562e1691944a51e9c12241f1bd0f0
MD5 f1be6782a59a20a835734a8648e9d924
SHA1 2f66daf08cbd88a828da2f5d4d31f38f31cf5d52
SHA512 d279c34755137854b25762caed9730243170c3529ec0d70bed811d7b1962539ed06ecd140f4487d456a346818d29ed22a77ebf0883a94c0121437be712c70c9d
SSDEEP 12288:4TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 86be1dd7c87a6d09301e9ad0f85e6c0e41ad8da433fc18ecb8f14b74f14f4490
MD5 145b2942d9f9626bb46ef5730d9f537b
SHA1 7f576542680da33a6fee3754b485a5e95106f7ac
SHA512 552ee0cbf386017526305a214e79b8be980769f16b74c1c2c3dc501229d058f7a419eb09eb12394704849c87a4616411426dab9c5f3426a8f299e6445bda72ed
SSDEEP 12288:WTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1d73b66cf311bfa6cd03ec558899b0cb233acea190dcbb9299266280f3b69d73
MD5 15ff52606d301032d83694e3ff66001a
SHA1 dbccb4fd2ea4035b26c2f08619298fadbb3ede2d
SHA512 d4476feb133f1c84dd79b9783d753723c6dd499e71f3fb7e8180d5eab848382abfb78e99f1f528d382144e9283e5aced0bc16424c3d14645b41087a6983a3b90
SSDEEP 12288:VyPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8zy+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C55125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fc1844b5dee2191474811ff4b1a3519114a7b1f0ab2d357342ef2800d83c94aa
MD5 28e1f3a88cdd8af2c6d3be519b60d829
SHA1 0a905395a17858385eb882ee68ebd2f3edcfad0d
SHA512 f75c0b36f368b73c042cfb454b316b1e4758deeae604792d79cbba7f93020c15d7dd7c7b8b38d1a3343f343734899f3597a144346e5764324ed65b94e95c0a75
SSDEEP 24576:OTDaLl3z0zDUsqjnhMgeiCl7G0nehbGZpbD:OTuLljJDmg27RnWGj
TLSH
T1556501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1222fc3998a9dfbd60319fe80931137d2b795226eab19719cbc78f02182db741
MD5 636fc313746d73a1fd8fa8256e70e5b5
SHA1 deb13ac7e7bdc76d4d481aa02a87d768b8d41a82
SHA512 e00ed41cd394485fea3efe3a8968426060115cd2df9ee135468ac72f247a632684c2822551ef5a7b8841a7a50d66ebd972975225611f94f5aa8051162cf991b7
SSDEEP 24576:k3vd9CHKy7GZosqjnhMgeiCl7G0nehbGZpbD:uvd9CHKyaKDmg27RnWGj
TLSH
T18D75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9812992f9781c369593c91509954cf3bae50f460cf2b8ea965a8afe55cb9a68b
MD5 3d9b6a795cd9fa3839e762c37a703f94
SHA1 9364fa5ae9156692d80cee8aa06e395c94b96684
SHA512 4fc1562f591d9984647d47509d5ec80f87549770032e8cca4098443c1f9a9bbaf658cbcab9c91cf0a8f35c2d8b9269d56568856b4f3d4359f0e0d20b0caec480
SSDEEP 12288:pkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 373ff8d9cab43dcfd715dd67b690516c6abf82be81f289dbff99b2a4387d3c48
MD5 30ca2707843c3731736d3622c3f568d6
SHA1 55ed9358f96fff1355927da078673e31d627aecd
SHA512 22460490e74bf74fc24ec59fe2a753b0f7da36f4af8e8d739354d19a35b9671b15371e9da07c1d55c49cf838e73d7d82b37e89768a245a6aedddbe818a13b4fd
SSDEEP 12288:zeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zesqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BE965C41DBE52644F5C3E9F10DAC073E5BE92004837AA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a94eb7f2154d9b847135013a6f33669b2c33e6f513e05262226e4f1edd674d9b
MD5 f1c564964941e16067060ac43289a825
SHA1 fd32132cf6c968a8387bd2fcdfec09186bc1e357
SHA512 4697831e0d67d3a6cc7ba30a5562f49e64a0f1b413a90dc3c85734c1bfa3ecc22e0f801d5581d1f00241482575ef23a40acb329f9b976c9f3dbe26bf33f8efc1
SSDEEP 12288:9tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1144523BF965C41CAE52648B5C3E5F14DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 26169274884fbb5e09f4f3886cfedd4fefad841c9d560a7cb1502e36cee0fd33
MD5 271df272e9ba78d665c8e0d2de124046
SHA1 c841d58869ca15b66f2d37dd2a471afb847c81cf
SHA512 882018eba90f35368eff0203e3a0cc2b3fe0f1780516aa42a212afb9e266623811c38f2e36d8343c642e67b91a9fc6ebe2011500f1695f3bdd60f5aba4ef0e6a
SSDEEP 12288:aTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B4523BF965C41CAE52608B5C3E5F15DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 adeaf62b81f3292009f5249e9e538bada3ce99f986677b835cf3d780c28e09fc
MD5 8feb4345472609ddfb84d7fc16774165
SHA1 4d5263487569069776c32c073c54e722e11c2351
SHA512 df500990af109ac5fc1e474ad2a4397337face03b2691b5f766131aa43506e090e1e2c0f1d6a0e28aab25238c6f90b614d03bf9653afbb6eab5bf67cde3507c8
SSDEEP 12288:pkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6513847719d9ff51d5b2c3d8bf0df1a5fb167e2c530505932da50a406e7418d0
MD5 beebaa8ef83f0c0ffa1984b61766af45
SHA1 6c1d21a76360e6b0ad5c4c1a6972a0110565cf0d
SHA512 de38ea1e9b728b70a17454b1c60b037791de6411f057a5c062f3003d2c81f4fe4752d4dbcf379791c82025c46153e50de286883c5adb5ef8d6b807a1d5bbb54c
SSDEEP 12288:brXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:brsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BE965C41CAE52648F5C3E5F11DAC073E5BE9200483BA677CBEEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f671a430132eb3d41e534d59e94affcf04245926ea256463e868c4bf49d3d272
MD5 afcee95f164854f72b0461b509182ca0
SHA1 e3e728b55b315255ede7e8a2fb13dda8f61836f7
SHA512 44e975f6ea69fb617002bc3381d3087a5c37a7232a2729a4bbd24ac25705a3338e184134da72174d6360dc4265dcf45e0f79e8e8b633e27d008679d09a9742cc
SSDEEP 12288:wZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b4b5875757600dfc3a9f8e4864a505bb65d643177c57217f0c9f8e07929a2e15
MD5 bdb9091fbaba5a3a9434936abe029737
SHA1 c66e7cddcfb30da3c6b552978411341f84d3f402
SHA512 842673a193a0224f89cf39a5f4dac4255c09a313b521ef3c4f721a7282f16904d43910a39dce2b68edcef4e1cdc97b15da72be11ffb8f325d7938c87bcbc2681
SSDEEP 24576:AfwvUk9RX6wkyAIfsqjnhMgeiCl7G0nehbGZpbD:0MnYIDDmg27RnWGj
TLSH
T1F885D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 78d43d8bc2fd9f6ad52c97da1b51ab3382e5c3ed7bcf9337e043e6f2dd95fa08
MD5 5e60bb37f9d5920b7a76a5cadfa95dda
SHA1 c6d73499c1f27bec06016e00ffbd97d56b3d09f5
SHA512 c8b7b54f4add9a4e26dfb331c799c38c0039566c37aa2bda620f1846c13b76db81bdf01b84f89378049707b6cb48ec74510abf74904282e286353bdfa73bd7c2
SSDEEP 49152:JYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08Dmg27RnWGj:EySzPUD527BWG
TLSH
T114066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 642cb39571f66b183d61dc15bde23b546c54326db4a72970dee2915f775a0cce
MD5 55fde2c64225f80a00c479534f84efd2
SHA1 7647e956caf8e8a966576920e0c83895e8386ae8
SHA512 c703dd38b8e4b8b4efff861dea826b883f5893b5062155eef0fbaf30e052c47523a22a934107b241d05fcf31dcc7c0ffdb12732b7f7e15648bd7af3264afd4f9
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYysqjnhMgeiCl7G0nehbGZpbD:a47JUQjTirIhCnDHUPfF/sDmg27RnWGj
TLSH
T1D865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 74f8b38f6aaccd974f427c4cda9c89264fb7e910b475f1ea60d090b4aa9489f1
MD5 ddf0fa718819a2c4043a818c836b955e
SHA1 cb4888cda14209c7b4bc8588a4c63f54b0d95417
SHA512 b888fb88bf4a206746383b3a1ec874edf24fc56eb6c22bddcd8e46782d862924b6452b8e01f34f9a2893ed9824c8181c3ab78ab2e7cd9741a2cfed894316a25f
SSDEEP 12288:nbsfjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B555015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3bc57b65eea62ce1d1fdd9eac44e44160489629a3459a34a21b595a70c11c97c
MD5 62abf86cb370239923fd0b0858b9e0cc
SHA1 97e06e5c54c72794f69d2896428065dc7021bcfa
SHA512 d7a9b9ebc1cd8c2c6a5752529aa9c8f4ca38f2982ceb5b670d83b447eff3726a8fb0b4dd2ee8e8a3b9d0b9af17f69d586ca802d0db9252702aee219627f11275
SSDEEP 12288:9c2EPBqfN+WgP6upFY69Q1kzZZaRMUUFc1M9:9gPSNapFYP1kFZaRMUOc1M
TLSH
T1E55517117666CB4FC6AD44325E33D2CCAB707C41EE446F0373C98B3F9576A59BAA2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 2622c7d0114b77a03afcbe1837d6cb5679ff8fd67bd39460a4e0bb14fe8f0abe
MD5 be02ae4b9ed2e0962c500cff02e67cd0
SHA1 67a0b0e2e691dc039be81cd1fcc25c8c9b399d3f
SHA512 6811439ed2faa032048bba872bef26026c4aa32793700f56fe3369660f2f0a1bc96ed09df3e2814f16714edea012f392c37cbf706d6eed3d84315aca3435a02b
SSDEEP 3:OlH/lUESYreqpFls17ttA3mCllltq3mCllltGlslslslslslsl6lztt:KG+nFqJUmCtSmCtEEEEEEEe
TLSH
T1D88192846F510720DD063A7A002AC3864730D34FB495ABEB2A4C6022DD006E82D22A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 7422d5b7a347f7afc3cf88d8b33ecd69a6729641a038beeb440fc81b2aaeae1d
MD5 70f8701b0f94a5c835b5bf9738472c51
SHA1 8ba4669276ad1066f298e3ac3552eee8143d45e2
SHA512 60ec6fe6a3afbdc9c90ff9003bb193761d28e26acabdae8d5dcab05f9fe668661d87afcbe9e235983770b52a3183d110e68f6715b853a1e452f7ab0ef508b5f0
SSDEEP 12288:uiD5LsXFyXMGy/zl5Day14r9wik6D2+TRQ2FxRZiQvBMbhKAagYO+g3S:mFy+DaK4r9hBgKAagD+wS
TLSH
T1937507415537A78FD1FB6032033A6B8DB764EC06B70A5F267389053AD86AB45B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 111333193e13b27cffa541fc190a64afd4cfc28d33f4ab3e8e476b0eaad49463
MD5 3038eb5cfd432457748a5996c784ebe4
SHA1 fa9452c78fad143247898f846df420ca98e7dcaa
SHA512 dbb38c995c0b610d2bb8ef509a9f2783d90a7b45d6acb02dd660266a5eef66e115e1afdfbc9bf5e51fe5a7acbac7adea11cdd7b2d57db4cee24fdfd4aaf460a6
SSDEEP 12288:i077Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E45237BD35C518AE93609B482EAE12D681B7E669F1004C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6e14aeb8e064d9310776fe9a8dd15b9477b68e840eceb143f864dc7729b3ed6d
MD5 dbc74613d0842620ac8e60f099e1fec3
SHA1 e214fe22bde13c050e024b5a2b5d2e36b410f588
SHA512 52a9cb060aa762a1582ccf15d76916e3059de1d2c4e62bc55b85f8414fdeb552d6523cb5001f74c2fd96b4cbc050946d038eaee53e05e0e98b255a66a26e6b2c
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYVsqjnhMgeiCl7G0nehbGZpbD:ygb4mBIBhGF2Dmg27RnWGj
TLSH
T14B659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9d1dc93e4097ba6aa83b34a12f1ceed9b8d51cd177a7f30fb0c0d1015be866cd
MD5 bd0b39440023d06a03332be582e08aaf
SHA1 e03fffdef23be94f28b67be274aa195d60dd8aba
SHA512 4cb80b3e2f5540f044415aca4190feb01893de6cba4957e0c49dc8c7bd3064df3b62e4529d8c9a323b7535a3b21337f19f4bef3189d8c355f4db5bf042469689
SSDEEP 24576:BG88u8FpJqH1bzria7/mCsqjnhMgeiCl7G0nehbGZpbD:E7ZFPqVea7/xDmg27RnWGj
TLSH
T13985016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0994b7332d63bbb99496cfefde893e8170aa30f2af7c564841f450ae3b2b9518
MD5 d364f7c024cd6b1ca1f252745cc9d257
SHA1 21d562d0ce8ac66bbd3290d9d02acc58e4790f4f
SHA512 2413658c20c60d44d7159b17a6edfd760cfe885f68b5535604da0a3402fdc08c0213a62d7293a1cce290ece772e27290ab43832d1a3023e83664455096019f8a
SSDEEP 12288:tHvUrBFrEjwaQGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:tPUr+NQGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A565F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e3b95c7649fcf415009030b701645898e5e85f46a9351ebc648aad69754f18e2
MD5 5a60bc5d2534efa7af9757a5ed06ea5a
SHA1 639a09fb07488b0b029711a459e19f7c1de6b57c
SHA512 d9cf0c9d0133b580c02c18dc47fa8f2848c6005fe33c1e9ea5f07dd6477ea394f2ed277bb5db78087404119320f20bc92de86d9abff8cc5e18c59ba071d3bbcd
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaDmg27RnWGj:vG05lO43bLD527BWG
TLSH
T16ED5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dea6b9c9163f8d701234f29e2f8cef1c48e9137e6db0da136f21e4561e8a66fe
MD5 b2a46f86ee1f6fd198f1b6b906f85330
SHA1 e6c79e526d27c6214c48844abf255049e02f9229
SHA512 d06ad68c103456a0a79b9372ad5a3a5685d09514e8e97323e900f969a27166ae910ad756981e372a2563e56f39a72c2b6dad78539da4a521492aec337968aada
SSDEEP 24576:Dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnAsqjnhMgeiCl7G0nehbGZpbD:7a5POZ3BJt2pasx2+myDmg27RnWGj
TLSH
T17265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 326a165bff6f98ebcd5c6fcde79d059d078f2d11190b35714780d055afca48f5
MD5 664a9e964b3e726bcef27e33f7a3ec58
SHA1 dccba72808a2cf005f47688780e70ee9b804131b
SHA512 a232cfc924ddf93c0c10b237ee61498adca6e021f4d358f9d763564bae6b2d93a7a80c498627d2f98b69798a94ca04b691dbc349c80612a6cc628019df06f450
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkKsqjnhMgeiCl7G0nehbGZpbD:TNc/zEOVHFRDmg27RnWGj
TLSH
T151857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5a925a545e4721fd9f06b9a2afd1ded649e679b0b2f9846cca1471df1658eaf2
MD5 e3484661e60570943260d5a72637174b
SHA1 1b3e69a9526b3b216488d362f131379dd97fa0e6
SHA512 c28dd7f8e5a8400be5179a51642db896f49efe782ed3764d15749a3f9d3be88c58c668ab37e222d5e8d6515172b241c809ba014fe0a8cb256c9bf3eb74ba6335
SSDEEP 24576:GTkNvNnaFeYhJNtmZBmMsqjnhMgeiCl7G0nehbGZpbD:GTMwBtOm4Dmg27RnWGj
TLSH
T12055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d780857989090a3c37857e03e320fa58f796650776582ba929f15b84526cc8ce
MD5 c8a0e2bccc89026d0a6423393b5a64fd
SHA1 a3fbe5e79f551aae4a2caea658fc51a264a96e93
SHA512 14362950158a61e6093a89e198d9dfbae8b13604e0ac63f9e8bd7b45f70d50e5ba9decde81fcc77042134820de19cbabfabd74504c1bfabb784ae5f4697364c2
SSDEEP 24576:dD3FHshBIYQgAnsqjnhMgeiCl7G0nehbGZpbD:dDVHeBIAA7Dmg27RnWGj
TLSH
T15675E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1340-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1340-101-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1340-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1340-317-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1348-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1348-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1348-331-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1348-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1348-83-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1348-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1484-59-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1484-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1484-256-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2292-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2292-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2292-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2292-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2568-109-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2568-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2568-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2568-115-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2804-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2804-291-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3756-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3756-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3756-126-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3756-131-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3756-120-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4348-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4348-41-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/4348-47-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/4348-61-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/4348-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4564-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4564-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4564-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4564-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4564-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5392-24-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5392-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5392-22-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5392-16-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5392-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5784-0-0x0000000000400000-0x000000000066E000-memory.dmp

Download

memory/5784-81-0x0000000000400000-0x000000000066E000-memory.dmp

Download

memory/5784-8-0x00000000027C0000-0x0000000002827000-memory.dmp

Download

memory/5784-1-0x00000000027C0000-0x0000000002827000-memory.dmp

Download

memory/6080-278-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6080-74-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6080-69-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6080-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download