5c5fb3c8cab3b8e88b4a6a17ab93992bb73d1814ac7bfd863ea914f9176a0c2f

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
Size 1.5MB
Sample261104-wrdvpayv9m
SHA256 5c5fb3c8cab3b8e88b4a6a17ab93992bb73d1814ac7bfd863ea914f9176a0c2f
MD5 6909f1446b8b7316ee51382898670f87
SHA1 a827d4f35f4464ff971db7c038b9d6165c914d70
SHA512 9678ef538d1c24f86cb960eceb7683b1682eb615a759577cea27c024f7deab979243ed88a452c887e9e346dd484cbfaa30446c373c56d7b96667d681ca36acf5
SSDEEP 24576:33Bgi7OsIdHFua0KqjW/UGeMohWH/82B9:HBgWOshzvjW/UFMohnm9
TLSH
T12475021077F2C873D1A315734E52D7A9B7B6BE529D35824B67C03B0EDE30182CA29B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2236	elevation_service.exe
2452	elevation_service.exe
4464	maintenanceservice.exe
4576	OSE.EXE
5108	PerceptionSimulationService.exe
4300	perfhost.exe
5668	ReFsDedupSvc.exe
3428	SensorDataService.exe
6116	ssh-agent.exe
704	AgentService.exe
6004	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\36f3f3ca227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030009ba0876cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4952	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	2236	elevation_service.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	704	AgentService.exe
Token: 33	6004	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6004	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6004	SearchIndexer.exe
Token: SeDebugPrivilege	2236	elevation_service.exe
Token: SeDebugPrivilege	2452	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4952	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
4952	2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 3700	6004	SearchIndexer.exe	100
PID 6004 wrote to memory of 5640	6004	SearchIndexer.exe	101
PID 6004 wrote to memory of 1124	6004	SearchIndexer.exe	102
PID 6004 wrote to memory of 4976	6004	SearchIndexer.exe	103
PID 6004 wrote to memory of 1476	6004	SearchIndexer.exe	105
PID 6004 wrote to memory of 1540	6004	SearchIndexer.exe	106
PID 6004 wrote to memory of 4136	6004	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6909f1446b8b7316ee51382898670f87_amadey_elex_emotet_icedid_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4300

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5668

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2584 1528 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1672 1704 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2584 1528 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1672 1704 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8c50490417e18bee16446976bbec4e937bd95e81371d1820a5b16207fb771308
MD5 63a2d5b75edae24e13c1f2422527c0d1
SHA1 4d000f612eaab46a0a7f7049908c6a4ab75cc2ed
SHA512 f56807811d5a9221aa5b341c2f1aa6a217586be67dff8250ca7e99217616f56ea1c67f1b3870c2d5c0c0a057a569e90511ae13bc7176bb8d628fc194956bbe48
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjhzvjW/UFMohnm9:73q6HjBKzv3FNhm9
TLSH
T1D9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3d59eb8815ed353d43dc44bd2922610062104070c9cfdf5a5ccac6860a2a80ea
MD5 958933fbbfc746b973a2c2a2e04ce057
SHA1 8d00adf14274620779d417d0b78f5f3757473953
SHA512 1b28570b09711587b28cc2b8969896c53d972aa38ca75e748a7af1f6215f91529bcb0acce834a15ab80ebd2d2320c7ca2f9a4bd5a3839951ba9239a8694b6e71
SSDEEP 24576:sXYfDtczA+IdHFua0KqjW/UGeMohWH/82B9k:Ltc9hzvjW/UFMohnm9
TLSH
T12F650228B3E509F9ED6B8138C9B18411EA33B8524760E78F03E499795F332D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 062342dcee5591241883f6315e7059df097866e55068543a11cefb998a8e3a99
MD5 dfee645f3926b9040120e6f9cdb74ab2
SHA1 89e858776e8cf8d256dc8ff25ac086573501c38b
SHA512 0b20f25981acf76e88756e07fbfb5ac6162669b5a3fb2eea287642611aee5b5d6dc18c1557e4ed6f6551d5ac6460fa1c8c201e4ece60fcf8d66d4fc714fd9847
SSDEEP 24576:80Le5ji0hmxirMrIdHFua0KqjW/UGeMohWH/82B9N:8Pji0AcMhzvjW/UFMohnm9
TLSH
T132859E15F6748731D073C0B9C5D2A69AED7230825B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5d0cbd9bb2c0da16b341233856eb9739730089e1303bd45a9d4b932c942ca073
MD5 912be0a10fff73a096385ff1b7ae12b3
SHA1 4bd4f693e7b22b6fc49d6d0e21b4f2d53b7d1f80
SHA512 910e058d446522d4c5c00b57da49548c437959793b25bcb5124dabec8f75411e290636bcd67ffb7e762800d6c1876f36f63a9cde590c4b4c6b16243485b447be
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyutIdHFua0KqjW/UGeMohWH/82B9U:g/ezSC6vUzPvxHjyohzvjW/UFMohnm9
TLSH
T1A2755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f541449611dbef32439a2cb1c1cadff3c75fdb5458207f9341fe2aea941bf984
MD5 905982080acb1efa30efb02461a7c682
SHA1 58cc75ea12ada22d79107fd6e15b3dcd5aff6b7e
SHA512 6130590d75df067d3b8bcf45a278afbc11be2073393733e4904aabe07e148c83ab49cbad4a532b08a44363e03129ebb1fe5e82d98aa1996a2749da2cb82aa004
SSDEEP 24576:YVbqPb88hv/l+6SIdHFua0KqjW/UGeMohWH/82B9f:YVO88hXl+nhzvjW/UFMohnm9
TLSH
T170559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e537e59402b1a88b1a428443f7c2fa6e461c83df410381ea3a024a234fc257d9
MD5 04d320d322be00ef1355e21575c4c73d
SHA1 e73a35b504c0b1f0ac6e150de07c6e37e1233aec
SHA512 5114734f9f09c2adcd185fde40dd87660c12942877588086e4f467ab0ce085ada9740f881cff833857f69c7507845b453dcdfe26a5a43b2e859386dda437ed44
SSDEEP 12288:ZRftOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9:ZRfIdHFua0KqjW/UGeMohWH/82B9
TLSH
T19045236CC2EB59F0E39F6530A274A4B5EE17BE838C85DC0F0550B9AE5A30411EE1FA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d569f484674caf32727d37b2766df94920fd15aeb824a6b4eccdb833c8aa764b
MD5 6c9272076b8e8cdb0dd56d2a41481026
SHA1 0f1e4d58030b62cf572c7ed42a9aa7b009fc55e6
SHA512 9e82f130f0a4bfb568230f2aa757ca0e890b0e29554113c5605a3a4cc4c0749afcf629232529ab943bfb64b29a0e8c1f0e7a7ba04a2f51505ac8987c991ad151
SSDEEP 12288:0eBNUbTVO86U6tOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9k:0JIU6IdHFua0KqjW/UGeMohWH/82B9k
TLSH
T19B65CF3BEE28FCE2C27E9D7856918640D77278714F52A3CBD164820EDE235E15E3AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f576a7fadb1cb52c494af4d7fc96479b85a60d861ddfd030f415e308cebba80d
MD5 827ab21621d3b17f4a2392479524cde1
SHA1 353e278946eb75fdcec7076834b038083cb19c46
SHA512 ece515ea67e9857de9d2d03b0e1a433f3c3ab3b24829e1713a36741fdcb8150ca4e9cbdd1a483825292cf82be9ad834531ac0598c5dae9b27cebc12016d97f6e
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:SQvGAdlCEL8c/yRNw5C/zv3FNhm9
TLSH
T1CA266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 09f6d032a9ee6b2cc7b0f98ac05b5a5970c1138edcf969a256cde550fd3a0f1d
MD5 018801465562a0e87671a5f01c47819a
SHA1 e4d351143c0188e7e00ef643b41e57937e8b7199
SHA512 7f90b67401dc2b595be92fb0a50ab62e69bb9e6b9a62af6fa266f00be6a68bb2a188bec46d27b87fd08d3515774ae9a543c35060bfdf7f7d27e5d73a88d1c112
SSDEEP 24576:gdewsAj8IdHFua0KqjW/UGeMohWH/82B9:Qlj8hzvjW/UFMohnm9
TLSH
T19E75E030FA75E432C2BF0DB21B35D716582DBA604F5119C3E3A89E9E59302D26736E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c6b520a8b70893b4aea03459441f676379dc4a9eaa19ac42b0792eb951409bd8
MD5 7e4d99cde5ac7005b0186d9908900ee7
SHA1 99eec46e0a1b901eb80237c89d5402e687f394f3
SHA512 be09008f0f815d03b456264be93966fb2ca78e767db7b0fffcaa44251d45b5a9170166d1b2f4f709f5b30f81737f1a2170fc823376c5f20bccd874a6bc496657
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHIjhm9:AUEtQevvqc2W1cpV2EI32whm
TLSH
T136474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 05aa98fafaf1a976f5654c25285b9a890115878e04f2f4fda70cf864785b334c
MD5 ebe7c4855444cddee8a722a41536d65b
SHA1 9bb77eac8da3b6dbf1e816cc287b6c68ae9071f3
SHA512 29f0af25445d9af120cc518114b1128f746d4dbd0db7a8813ff14829cc570f687da48489526c22f229efd9e55198a9ebd88c4f779c241fdf1d1a800ece0f4031
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zchzvjW/UFMohnm9:QoqtVjnmbzv3FNhm9
TLSH
T16FD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ca25645a9f6aebf487f822e63d44cf1077ac6fb08539c2d6ab85a1d9c02419ae
MD5 4c8f9164a26da8809a57306327e2a353
SHA1 cb6c89416617a5eb1ec4973d2bec4d9260d58e17
SHA512 43f27cec8ec87be50d95aa17ef35782702b78c64e42a2848268a5ee51ab8b608a57ed4eb560016e427903689ffd8d04775fe769a2705f99c12b6c3f18ebf8ce6
SSDEEP 24576:wAhGLJIFoiwtA5l7S53JIdHFua0KqjW/UGeMohWH/82B90:wAMyFoiq5ZhzvjW/UFMohnm9
TLSH
T12D359D80E7FA55D4F5B3AA7899B69071EA76BCA65E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ddf802883597b6729a93daf63031b7514c5ae872413c80262825557d4a7f1466
MD5 a1b87857b75017c6b65e94ddaa1889cd
SHA1 56d51e95a655446605116c46d2e02c5e1b834f03
SHA512 3669f76f17eeedd9275a1e62764eca44baf78a52b2d453617c0e600cdb356b720b27fa68f6a23aa8a41f9d6e7ea42a1b6303608c6a58dbcca908fdbe9434e11c
SSDEEP 24576:rwuoOWIIdHFua0KqjW/UGeMohWH/82B9O:rwDOVhzvjW/UFMohnm9
TLSH
T16C65F14972E51CF9E5A79538C567C036F7B3B8022A25DB1F0760C65B6F33261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5b1ae681e12ddb9900676359e49c661df8fea6409a0b12740fe1a6863ca09fd9
MD5 032c4ea6a126ab2184a49f7560e66ee5
SHA1 e9ed5143242dac7bffcdc889525a76c79f1597a4
SHA512 f134271b2104a7177352ad592a44a2cd4d505f7c4e04f5fed85dc7d2ebea817771e6080f45b27b80c640694d0d7efabcfd42b4de6f43c27984a7ef6fd64fcdb5
SSDEEP 12288:EBZ1IystOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9e:iZuTIdHFua0KqjW/UGeMohWH/82B9e
TLSH
T1DD55129C23E920F4E1A79238D9F05455E77274535775C3CF066042AA2F33AC2AE3E726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e8955e152b1a2facc7d99fb776565542592012d735f800a5ed62cfd0eb1e20ed
MD5 5293c4522d6fa632bff79e296410aea3
SHA1 28e3b49f1edc2bdbfa68f6e8879cfec707d5fb0b
SHA512 4be13b3094021cdc62ff8ef73ccbb5cadbd10f919482a3522e98f23cf299ceecbf74cad7555ad7e4e9def519cc2a370a26587ca27c7c98245aef697ab71a56ad
SSDEEP 98304:hQRQyi36YOcPQLvw2gAf+PN3Ozv3FNhm9:4QyiKayX+PNujhm9
TLSH
T1AC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d540499e5bf61818807f84367ae36dbddb39f6e49b3462a43abd93bc242fe17a
MD5 2f2f1b58cfbe5d1b134b6e946b5f0ff7
SHA1 e87dd4e38bba2172567f1bb27ea15ef842e01bdf
SHA512 7eb876a2d7729e2f32b02a35008d582d81b250bf5abe446e56712cb438c1166f84b6c7490ea1243aff9fa9133e1f24e54a022e56a12b931351579a09e0a9f6c4
SSDEEP 98304:tQRQyi36YOcPQLvw2gAf+PN3Ozv3FNhm9:EQyiKayX+PNujhm9
TLSH
T1B5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8981ec404b771b7123946c75fd08f435fe5e6f9ab645beb7c5f11957db9363c2
MD5 399b1885a4a68cbda2793708ce162c6c
SHA1 e081822a205ce77ccbf21f76d10ccb7af40478c9
SHA512 35bbd5208c03cbcc961dec023c5e546ea20ab34b99c6395a9088839358fb0b66e1155728e0ab7ce07a05c1b6be7dc18323e5820df4573bc6101c25a1582987f1
SSDEEP 49152:B68Qg55nhheWu7PNU3/MhzvjW/UFMohnm9:/thWRc/8zv3FNhm9
TLSH
T13BB55A33B2F600A9C04DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 21200551e8dbe0eb4a49da6aedea55b585372b44e92074d88a53a5622b198129
MD5 f8d9d1e80fb942fead0d8defef8b6cc8
SHA1 1071656ce1af5acf5dc2e3d8909d5e4cda9af5fb
SHA512 3da722952466353228533b47b961e2159b1db222c6f87cc0e0a02776fe4feb9eeab9e6cb47631150b08b2d3de881c4648778b22a484673f9e8bc1dec111ab32d
SSDEEP 98304:+y5112gYy5azzVvL69nLKnhZZzv3FNhm9:vLIHmWh3jhm9
TLSH
T108167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9d98299cc971a7f1c047ae850b7c46660dfda2a1a5d4ab6e56659477de0613c8
MD5 1a1a102edd02ea04cc5ace100d50f4cd
SHA1 7d5187475d6add88a8ea28f8cab1eceed0e5fb17
SHA512 18c2bb6aee00e39524c2f1b6399fe0975ce18259c07ee49fe662227182c8ec6cadba09f6d2e4c42082ccfc02c04fba309aa0bdb9c4fe3394efcc0f992cc40b46
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyhzvjW/UFMohnm9:lu6JmVxd2d6zv3FNhm9
TLSH
T12BD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 773bdf69d09e9dc21f156e74086b82d439b20d16ff1f79518129d9884ae179a9
MD5 de7201e970a93e9f45f6bd091b8ac04e
SHA1 ac84180c4b1a6ccad5dd1ad19ad92a9f6a521bcd
SHA512 57555ce352bb350ccace5177c21dbba4293bd8f9edbc0804d96788948464615f7130481037008027581abdb8e4fa6d516a108aba2384c703aa701d7a0358f5c6
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xahzvjW/UFMohnm9:rmifPbRbzv3FNhm9
TLSH
T10AB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2633563cc597f0cfab50317890da159038ed9f0c0032f9bcfcc5e281fa56fbc6
MD5 f884fed874c821f40e3fb32b22b53eb8
SHA1 f1ba718e1843bd75c15189314b21986f99f21643
SHA512 67ab8b5b7e86761d75f28830059c755765f6c442f0482a9e2a5e48ea8e00f29a26858a5f985b51946ac4e12f658fd5ba92753e9bc83d8b7076db663dfcdaced7
SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHqThzvjW/UFMohnm9:m5dKTi61tzv3FNhm9
TLSH
T14FC5BE03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cb8afa46c87d7a1f6a7fa2490bc822cc10bf0e36267bb46ddbd816719caab11c
MD5 d553eda68806247e3c8bbb73cf397ea9
SHA1 a9f4723600a8b187faad2849745ebeb34c04a498
SHA512 c833adf5c95dc311c897f165d7f044d8e64053c9a7de7bae691efc4b826720ac3d6e6308d02c2f67b9af09e7f647eab991b64c8b1e54bff338087a1899befad4
SSDEEP 49152:+htSn8EApI0figngiDn0AP5w+hzvjW/UFMohnm9:fX2iyph3zv3FNhm9
TLSH
T10995BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 06d67d12ce6f4b8240d98e026503b6963c1d5972e81dbdcced0d28c0a545dc78
MD5 e436e2f074d06078571a9ba0bd7f08ec
SHA1 c346f5c3c3809e7535657f734b0b7de582685859
SHA512 151fb4757112a5ed02bbb7b4a8b598d1407e967579a7036aee2d41525d75ad17dbe0c0a38071d71ef892956bbc9d6ddac0294d00563c3c5cad14990ca8656e54
SSDEEP 12288:pntOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh93:pnIdHFua0KqjW/UGeMohWH/82B93
TLSH
T1A545235CD1FB5AE0E24FA530D274A0F5EE16BA838D85D80F0650A06AAB71551FF0FE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5333c7705174c2ffd37969fc49b9b72fd85198f13f258aaa27bd2ddfa1d31a96
MD5 0f16b820d2f8ef4ec3552b17716e8a23
SHA1 a479dca4ebd2543dc53a172c86c7edd216effadc
SHA512 58275db1c5b3b399e1a9672312d8ce0c74f690b396d9395a86abc48f549688bd53cbc75b99640200f43ad0fc81166971d806d85c91f99bfc682ae37efd82cd16
SSDEEP 12288:xAtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9g:xAIdHFua0KqjW/UGeMohWH/82B9g
TLSH
T14B45236CD1FB4AE0E14FA530D274A0F5EE16BA838D85D80F0650A46AAB71551FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a051b2fd924f0a764265b1cc3bdb18ee689d81a5641e69f71a48d1890601da51
MD5 057dfab55bfa039baf662efca2c2deec
SHA1 7199ad167a7743abee7dce59cdb08cb8ce58cc9b
SHA512 b0f3ab683d19da806cdd6036300aab6661b71e4dbab4e5446b4c05118cd07acae0abf6700305077f2e2972ad5a3786eb2cdf02c6824c8e2c97e5664404a38835
SSDEEP 12288:/itOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9g:/iIdHFua0KqjW/UGeMohWH/82B9g
TLSH
T17445236CD1FB4AE0E14FA530D274A0F5ED16BA838D85D80F4640A46AAB71551FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 47a35f7d77d5aa88bfa01f710e44d5a35fb6f94180ae447ce3bdf652d29cf342
MD5 2b466bdb2100a15fc3c278a359a48bfb
SHA1 bbb5cafda7c2ba61a23af75650ec8d6811aae129
SHA512 a4eb81d12476db2cf958a0362a5350c12efa9b0eb2bb77e0da9c045666af2db8ea5f6de258c28959a6e9721ecb3c04eab8ccba66301429d843ee169ae08b6e45
SSDEEP 12288:zVptOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9l:bIdHFua0KqjW/UGeMohWH/82B9l
TLSH
T1F845235893FB45E0D1ABE630C27090B5EA76BD838B62D90F4700546E5F71690FE2AF5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4a50ff67389d6940f2dc1b1edd4b8f0f24dcd6890187620fcd0252e67ad5e8a3
MD5 48b54284b99fb3a1e8699d2ff0256a07
SHA1 b33412c90b6449fd8f96c77a675b97b0ecd36956
SHA512 deac2c694fd9ec06bde760008f9550394a9205ea18b0c7123061aec5aaffa71e125e28482eaaac07bb89e6f8e2f2305a943455582a2f6936be7ed45e33d4691d
SSDEEP 12288:TBtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9I:TBIdHFua0KqjW/UGeMohWH/82B9I
TLSH
T15B45236CD1FB4AE0E14FA530D274A0F5EE16BA838D85D80F4640A06AAB71551FF1FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ddad4608c1d5505d68a9ae281e590288427276b2762bc26421ebabb6d62ae70e
MD5 170e2dc794d032400485ac468286b521
SHA1 984a592798717a51a381704dd6e6be48c6b1d7c2
SHA512 c773f497f853890f65b0f735f7e41e13c93e30fa2c0cbf3eee7216b6631feaf3a33f9ac9f4d0c6b7611f4c46188f6506c974e6e89c60e1633e050cdecddfe3b8
SSDEEP 12288:7ktOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9r:7kIdHFua0KqjW/UGeMohWH/82B9r
TLSH
T1B145236CD1FB4AE0E24FA530D274A0F5EE16BA838D85D80F0650A46AAB71551FF0FE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d432b7ec7fb739c45a3bb7cd383aad43ce13341ab4effd4f9a1a3561a119374e
MD5 05e18881d7956c3a5b0d562182baf71b
SHA1 8f11e2915742974fac69c09b09aa47c0dbec0c68
SHA512 68d025ab40b0387f04c2f1e73e3cf405cfbae0733e9c6f54b0dcd73403cba502e42e059fa2073c436dd08f581712ee91108688db19ca9b43ef8311cc08add42f
SSDEEP 12288:6YtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9S:6YIdHFua0KqjW/UGeMohWH/82B9S
TLSH
T1CB45236CD1FB4AE0E24FA530D274A0F5DE16BA838D85D80F4650A46AAB71451FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 dbe2a61bb2315bbf5589a629ec4d01bc549d4173de0107549328a9ba1da4c805
MD5 4c6d893da67468035ebadd3f31a9f118
SHA1 594e433b2733795154dad3ddbe87415d67bd0b31
SHA512 62f727d43e4b7bbac271c1ba24bde0fe6e1cc78eb598487b587b47634708691e011311c26047083b090d24f65c98f83a803b89e4881002a6de153a146d1d6c5a
SSDEEP 24576:+ZMSzFVSOgIdHFua0KqjW/UGeMohWH/82B93:+ZMSzfUhzvjW/UFMohnm9
TLSH
T193650298B3A11CF4EC67813EC9659816D6B27C560B60CA0F03A4366B5F333A15D3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6ab2646510c2d6b45832ade0e7be07b02b3d0a2ea0ce1387b41ef3d2f6bfc9df
MD5 205ace4b80a837ed9f99a446ad466dde
SHA1 0b44bee7c0b3ea9c5c39393568da7e0f0ede450c
SHA512 0b5c335d603992fcb61f2bd2a6bfff1d29cf4fe7df758d33c6826620c41704599ec258c4b6d8564a1361c6e9fce59155550d47dcec54bccfa05325b5f4eeaa0e
SSDEEP 12288:ZDtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9d:ZDIdHFua0KqjW/UGeMohWH/82B9d
TLSH
T16A45235CD1FB5AE0E24FA530D274A0F5DE16BA838D86D80F4644A46AAB31451FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 205ffe658764466d9bf5dc917a5c595b68e57204097891c8be1e99d44f6883f9
MD5 b25f938250e337dc57f2d1d9757bae15
SHA1 2e33473677220afd8055229a86dd4a7c79297c41
SHA512 770ce38839b113c12d21a975160fccd29640b1c957f974950d6bbeeb7adee44152b92d63812279aa2d4a81c3bae0305cf098dfbb8d23febb27b9be5ed39a062f
SSDEEP 12288:TPtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9U:TPIdHFua0KqjW/UGeMohWH/82B9U
TLSH
T12E45236CD1FB4AE0E24FA530D274A0F5DE16BA838D86D80F4644A46AAB71451FF0FE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6f6f3b2168cfb522853bfb485c57131e69df701b10cbeaebbd25c5ff2c0e6a85
MD5 24972ec98f3b2c841b507eef64ae1e80
SHA1 b0131ad809f3410e6bded1085e92ab93825feb87
SHA512 90ae7b6e8e59d4226052776074d6b7227e1fbce6b51365640ca124f836bdd54bb94062dfaa8198dc482445b3cc051a00901e9eabd080db4cfc19315eebd89c2f
SSDEEP 12288:EyPz5L8stOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9g:dzysIdHFua0KqjW/UGeMohWH/82B9g
TLSH
T18655025BB3A630F4D16B9234C9711952F772B8734B60CA5F0760467A2F33691AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3b43151128af1ae59a47a1103be40d24018fa652327c17e6e470a7e0a32da841
MD5 b6cee9efe4679d18785eda2f72a34ddb
SHA1 7b73d57b3329d3fbeeb01ded8f4442974ebe57d3
SHA512 2f37c775ec65d07d6b9098644dba5972a3c091bd2e356c10816c434507adf304e3028503c2d82f3f50e24fa7ddeee5553a1721d648153f1368172b81852052f6
SSDEEP 12288:rDtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh96:rDIdHFua0KqjW/UGeMohWH/82B96
TLSH
T17145335CD1FB5AE0E24FA530D274A0F5DE16BA838D86D80F4644A46AAB31451FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 73fcbbd6beb1571be83aab6f5a59547d0bdffc1023c4a03ef8393beace7c2557
MD5 1c0055155dd9d1d04c607527fe05edac
SHA1 d1e4c849f606b3dd703590e3f22f0e5bfa8ee9bd
SHA512 6df2f9448d8ffcb703fcec818d1ec28363e9a2a4e6c1c505e0dcb423db6add07895a32972a92633281d806dca33befd14475ddda94022c7839155f03d65b8710
SSDEEP 12288:LDtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9g:LDIdHFua0KqjW/UGeMohWH/82B9g
TLSH
T1A045236CD1FB59E0E24FA530D274A0F5DE16BA838D86D80F4644A469AB31451FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 45dc511f89317a6fa929a91b4c12717bf10db4a0aa69ae01509972a215a2833f
MD5 0f344091673e47b404928b79b2ae08d0
SHA1 94f425111476c4d41e9a0b4ea665dd847e2bfa4c
SHA512 3fcba6c8a8cc7a17205054b767908ac0e61d58cba5dace1700be6b8fdedf61ae16369a37162bc705ef44d968dafb27452f2b1a8cc5c4d41440900a61ffb32f90
SSDEEP 12288:6yPz5L8stOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh98:nzysIdHFua0KqjW/UGeMohWH/82B98
TLSH
T10155025BB3A630F4D16B9234C9711952F772B8734B60CA5F0760467A2F33691AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b50955515119528667e1f180a810192c15bfb33a2f549a43fcd07a4842b27a5e
MD5 dc1ee1e0237b68955b4c5afef6e403e4
SHA1 9a4fd07757273c7f039b3a0a04b15458c877f6a2
SHA512 5f01bcbd5133aa0488c9a293dca6ba98c7d776953889cc37a8105938e0211deb8f4213b9f234e523a1c6781091d07355f98d11986f9fa690bbf123688b314404
SSDEEP 24576:uTHaLl3z0zDyIdHFua0KqjW/UGeMohWH/82B9L:uT6LljthzvjW/UFMohnm9
TLSH
T1C56502A4B3A11CF4EC67813EC9658816D6B27C570B60CA1F03A4366B5F333A15D2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e0bc7a22d8ff1e877cbd64eda57dcce663516056ff6547f712c07c14948376cf
MD5 7c641997669e90789146d282ec125c64
SHA1 f00bb9f4c6f4c10d9991dd627128744d008cad13
SHA512 de7b943a3f97c67eec183ce761128811599040c1fd8ed0f39853f941fb722db3de66dc9c36c9ba0cd252ea954090a81c21235c227e39b47be5d4d05f809c1c4c
SSDEEP 24576:437d9CHKy7GZmIdHFua0KqjW/UGeMohWH/82B9s:C7d9CHKyaUhzvjW/UFMohnm9
TLSH
T18575CF90F3E414E4F0B79A35C9765511DAB67C9A1B31DE8F03A4261A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cca91a43e43690319522637831905bf8dcb3ced296dcd1b461edec6eb1702627
MD5 13173024c23f8ada284c0439f711d200
SHA1 f178b6e64193c6eec35447e86f2c2791eeb14320
SHA512 a5b7e8db9c1ce34d02db9f7e7ace278e0a4d92c97b808dabbf79c34f8f70d1084cb625c457b2fbc6638170c935231db30bfcfe6f1c81660a9448bae4d77697c6
SSDEEP 12288:PCtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9P:PCIdHFua0KqjW/UGeMohWH/82B9P
TLSH
T14845236CD1FB4AE0E24FA530D274A0F5ED16BA838D85D80F4640A46AAB71451FF1FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a389fb0ba442d516cb855133ebf64e7a046d3f4c01c258cf402e3ae712e52697
MD5 b975bc657b7632aae7ac60c9652aac03
SHA1 f68e425d828d88f5cd52bb22b491b079b2d7fe62
SHA512 c241cbee7956000d1e25f9351d2abe773bede1f455034234009d6a51599d245052a5448142e785e4e0f64b5b2f77695c57edb3f8490397347edd7f02569e6505
SSDEEP 12288:9MtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9H:9MIdHFua0KqjW/UGeMohWH/82B9H
TLSH
T1BA45236CD1FB4AF0E15FA5309274A0F5EE16BA838D86D80F4640A46AAB71451FF0FE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 de1c9c29a13bed8ede18a79fa9b6bea73fd4299a46311a0af95fe72339d30130
MD5 ddde62ba1cb0a28e4845b1823e0d4989
SHA1 012324d5bb5f1496662f5f0262405bb21ca8ffa9
SHA512 053bb51d764229257206c71cd3075b20e8b1df91a4d30ababd7f947e96af3acd1e3a5baba09b230026b9c2691665dbfa06b94cee63f464845502e9f19b10f992
SSDEEP 12288:lltOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9O:llIdHFua0KqjW/UGeMohWH/82B9O
TLSH
T12245236CD1FB5AE0E24FA530D274A0F5DD16BA838D86D80F4640A46AAB71451FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 abf0a566bcaefffe903235df272e1db70120ee040c9909a79513415966ac4b76
MD5 577089f6dfc7cae2f785b43b689f294e
SHA1 028daca0149fc0fc7bb9faa117c1d15624ea84cc
SHA512 10a2f5c3a67fc3646472e5d26dcc3aab17e513a13f59c540e77d827bfab11c573f094b2452a1bfaa2962bcb48f241e688032a87ba464e144339ab1e6ab1f04a4
SSDEEP 12288:DDtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9V:DDIdHFua0KqjW/UGeMohWH/82B9V
TLSH
T10945236CD1FB5AE0E24FA530D274A0F5DE16BA838D86D80F4644A469AB31451FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 19e96e5f013e0fed36bc159963b80a25227acde9900066d8a0b2e0902ee843e3
MD5 de392915e942afefcdab83b32fe5561d
SHA1 c72c7d1361af8a7a2691d74fc6c4ace885b838a9
SHA512 6673ea077575d61ef69376c534926de258afbb67683add1fa900dfa0a5b2511436b9f4968b38f1405eba26921611df5e00b6b53743e0e0279a1b417d36424fac
SSDEEP 12288:VCtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh95:VCIdHFua0KqjW/UGeMohWH/82B95
TLSH
T16145236CD1FB5AE0E14FA530D274A0F5EE16BA838D85D80F4644A06AAB71451FF0FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fa8a26533ba84f6566364ff60699409396d2f2597f65a5128702a03f30f56fdd
MD5 c24bbfc2498321f375b7756ab61d6624
SHA1 6169069285860d628272afb5f2365351cef0f896
SHA512 b7bd48eba89510a4223364fa2276b7021f4578813f77103afe9c1d23390560a4e0a1802d9940148a9ea1570b8ca11fd01d4df0485d4e5af5dc7726f6a4357908
SSDEEP 12288:57tOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9d:57IdHFua0KqjW/UGeMohWH/82B9d
TLSH
T1B045236CD1FB4AE0E24FA530D274A0F5DE16BA838D86D80F4650A46AAB71451FF0FE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e23dba70a9e6c31b164cac09fa501caeaa592c1d91f41259cca081b5a3e70691
MD5 9640e2851e4e421890f8574b8bcabe94
SHA1 4b289f871dba7f570469c610b43c31e71f692d91
SHA512 d9d64585ab8d8b3ecb7830ed79c9ea0df1f2f6a41967bcdbcdec174bf1da8940dbe721d601071d3c3ff41e89b046b39223e6a4fcd84b1ee5912b34a2a9224add
SSDEEP 12288:ABtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9B:ABIdHFua0KqjW/UGeMohWH/82B9B
TLSH
T13C45236CD1FB5AE0E14FA530D274A0F5EE16BA838D85D80F4640A06AAB71451FF1FE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f8d38bad9a13deff3deb0bf7b41c6bbf282a10eaaf87e5f69a5d198702367e67
MD5 ef9d47352151cc5c644a79f88c4c6867
SHA1 05212ee2172ca27083ba30a47efb46fd94b3bdf6
SHA512 785124128b664d70c23ad540204d9d0ea3c113f21355ebd856c08f8048696552c86414f1177843b0ff065502b1381cfdfc9f480d89a66f8c835bd39a87691542
SSDEEP 24576:Nfwvok9RX6wkyAI/IdHFua0KqjW/UGeMohWH/82B9o:LMnYI/hzvjW/UFMohnm9
TLSH
T14C85D029EBDC44E1E1B7913C99B7460AF6B178591B31C6CF025A536D0E33ED4AE3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4fae2340722c52d4ac78f37c7fb196ace9bc938866c98b627ed27071382a0357
MD5 6759c04d62e1af108067685e1da33655
SHA1 dcad4eacc262eb6a0414c1a420b117d10129c5ba
SHA512 760bfb420906987ce5467bf74d990659df44c16e35dd559cad758531a62509c8b3833017831fea1c43033c66c9429be90bf22c7e042c7ecd22f364b5426efc74
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ehzvjW/UFMohS:0ySzPuzv3FNhm9
TLSH
T139067C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bbb20f8d83b908d16ef486001c6d57093cf3e05f331dd95929f41cf38c050733
MD5 82f91dc3a7e960997c46db96a3e05e70
SHA1 4db13081c1280ecb5eda8077dd7524be2eea9ba1
SHA512 44fd1b8e4b7f719d2900c14a68e54637dc9d4f3a6ee4d64d0e71e1ded118d00e8495a3b4337af626fef7b0c9a95987f2c984cfb89cb01d13f4ca2927ea56f710
SSDEEP 24576:c47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYQIdHFua0KqjW/UGeMohWH/82B9X:c47JUQj1irIhCnDHUPfF/OhzvjW/UFMF
TLSH
T17F65AE1DA3EC01E5E1BA927885158A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1006d9c88a840b504253228ba883ec89a2ee93e1d4f93d7d56e86b1804d48e67
MD5 39b1d4f070acb95ab3fe10cfcd600c8c
SHA1 23e211f70db3282b55a22505655faff3395f742c
SHA512 150f2983837a42b1f1e955f34af5080d52a014b164a08ebd9a362a0b5037d84cb04ddbae624361a3f80fcdd1fbb657f12ad00c16f0f6c6f38c195b810c3819e6
SSDEEP 12288:8NsfTtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9w:tTIdHFua0KqjW/UGeMohWH/82B9w
TLSH
T10A55F019D2A902E8C06EA235C7659551F7337C6287E1D3CB52D0F53E1F72690AEEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 5e08bd116fb348e4e642c08a050fad0205feac9a1e4b371a44933049994e5d42
MD5 5603b750ee3d378e4b45480a906f1d1d
SHA1 8509a5e50488014744bbbce4716a5827b08f1667
SHA512 b97778bd60c56e61e4c3fb1561c9a636ca80c857b9bc1bd92dcde5781eba35627acee7d91e2dc85c5763b6b3e209431264cf6b1638c0e697f4c670b8e61adbf6
SSDEEP 24576:baUJ1UP4Ya9Gkx5lOGjU4aFHFLJWoDehqWWk3weM:71Ugf9Gkx5lOGjUdZF9NDwqWW2w
TLSH
T1415538407626DB4BC6A940325E36D6CCA7707D02FE04AF0773C9873F9576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 2f76d282f93ee5917949eb6059acc074c1bec53d172383956c967970360dbf5e
MD5 09bd764d485c7c6b0735931f53dc1a93
SHA1 a0ca53b8759b692946dff129c1364b2355fb6972
SHA512 eceaa21480ef9c8817b98f8c56678a36469a9212d6f837105c7243d467181048a5e0865016adfde18a7095b19d3426012a669e9cdfd7f9e0dc9d7aba2bc31256
SSDEEP 3:OlH/luUbqnVSl4ll4l3/rktGl3y8jK63mCllltGlslslslslslsl65n/:K8x442TdVKcmCtEEEEEEE
TLSH
T1DD8112A4078C0F60D9BFB0300DECC30C2715C24560C0EBFB02589443CCD42849E4ABBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 b6ad42d5d4120c0765d82a1b1dcbda365405a3062e3049fe9d762da5e1e04bd8
MD5 ebd4d32f61df1b7c0cc8a2297b672717
SHA1 6ea9c843069dd9d46a0546ea880e65381670b2a0
SHA512 b5faa532c043a0fea1cab9f855f0078a17e185817bc042c026aa539843d4cef46d56e33ebe18c6005e4d6ef2590a054ae69def64f231f36089041aa6b5c257d1
SSDEEP 24576:7B/GfZPoTrHr5JtKprJ9Gkx5lOGv9Gkx5lOGw9Gkx5lOGd9Gkx5lOGP9Gkx5lOGW:1YZ+r5JtY9Gkx5lOGv9Gkx5lOGw9Gkxk
TLSH
T168551800A5B7EB0FC97A9037463286CDBB746C07FB452F053345893C9867A5FB6E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7fc91f96b9f43500a6287fb5cef48bd6e22ffe941117bb08488d6e610c0d69d0
MD5 d623e26355b8bd5dbf06ff35d32cc8bb
SHA1 517b8cf82112d1019e3ea0718734fc3f7de1e17a
SHA512 83222dab7d060412aba9cb63548bbb6661840e6262403dda269ee8d4a10d1507fe7442b66cb5e05b3fca23be5f61cdee84d44d994b8605e8b44e4e2309cd9053
SSDEEP 12288:+M7LtOdH2szil407WpVqh9vO/URoeMow/tRyJqQWgOT/82Hh9:7LIdHFua0KqjW/UGeMohWH/82B9
TLSH
T168452368D3EF5DA0F1BF653051789071AA1BBA938F40D84F950061AA6A319D1EF3BF0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 22a6818a306eebe55e54951dcd7362bad79904e2ac7ff0816d73478a122710ee
MD5 cb6a9e3d03c42588729d16a652aa1c9a
SHA1 f62abfae0dfec71be78e196959089a6b3322c646
SHA512 c210689c013a84fc0c1925e065f613f42e90af4ecaeaf9ff86324675026ced78013e6b15768454b9d91dab9916915ce1961d180a3f3c2c51f947cf4ce5e1306b
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYtIdHFua0KqjW/UGeMohWH/82B9Y:5gb4mBIBhGFQhzvjW/UFMohnm9
TLSH
T174659E1E22EC02F5E0FAE2B8DDAA4417D6B278160731D2DF1151426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 64146625d9f4ff9dfaca75721ebe5ba1f74d908a6bb49a4019db0874809fc537
MD5 6bb430a54bab88655e9b2e5aa38b57ae
SHA1 d82bf087431407d7cbbadc8ef6fa5cca250bd07d
SHA512 e6ef8d87cc4113fe55430ca2e69c8b14a3bbe5e49b3688d15e07b2bab1b115773291d069309d024f15a835650cf695f69ad4c9c003a5bfcaac4dd2c54231d7f4
SSDEEP 24576:iG88u8FpJqH1bzria7/mgIdHFua0KqjW/UGeMohWH/82B9Y:57ZFPqVea7/FhzvjW/UFMohnm9
TLSH
T1C485F165B6E101F0D07BD1388A964663F6B2B4160364EFDF07A88A551F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2652f3b2fe3897c89ada8ae0d4957f54c1ba18fe2c3abb38a7aa51e1949aa52c
MD5 11b6ad60126bd4ad8ab77625a9515179
SHA1 bc99913920c116959ea57215772b1ae260c01ba2
SHA512 28e88b350b0c29a493f75eb46036ddd14adb670f1ae53890849753e60e272b58f85a84585a126873535ec2e00f9c95f82b6b113924c2ea8250ec35d0e64c9e85
SSDEEP 24576:JPUr+NQUIdHFua0KqjW/UGeMohWH/82B9E:JJQUhzvjW/UFMohnm9
TLSH
T12E65E12E62ED18E4E67AE17C85918619F772B4620712D2CF02D0817E5F23DE8BD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a9029a14ac372e19623edc1800f7fa4abba7a10b44b2c2b364bc64ad4309d389
MD5 8bb6c911bb6677d6a8ed223e1f4ef8d5
SHA1 89c1bad9a24280ecc40546208cc598128fc72448
SHA512 f2af598099146c1529789bab9d1616384432043fd63ab3ed72ca29653ba5def63aaf8bbb9ca05c2fae0c2a12376ea5aa277670e4a8e8b28b03fee827b726a77e
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkhzvjW/UFMohnm9:EG05lO43bxzv3FNhm9
TLSH
T190D5CF6E62EC11F9D1BBD17CDAC6460BEBB23415032556CF02A486A91F23FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 31cf0b3b800a170bd6e9530d4bc945f4b78e54436f797599b7130ce6da90009f
MD5 9eb3744dd53aa1ba6d13490dbd057e34
SHA1 41dc5994405df734b8d899f890763adce670d1fa
SHA512 197263f01a80d858a47f5239e56216e63a3e188c386b0c6814e8b69f5e8a86fdc9870fba02936c909afa58b60f6117b0d49e45b174f1f4529440eb1f61b0dacd
SSDEEP 24576:6fa5POZ3dpFWVM50JicR2hG0lasx2+47eidneIdHFua0KqjW/UGeMohWH/82B9Z:Sa5POZ3+Jt2pasx2+mMhzvjW/UFMohnS
TLSH
T18F65AF5DA6FD01D5D1B9D17DC583861AF5B1342253329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb46eddb0d28416df3a488e271b840e96cd28e2f40851efb6cfa58b487d4e92a
MD5 ab735b1044980a5407b0853eb5da71cb
SHA1 e43ccb25059b85bce34be6d9050546ba304b5144
SHA512 b49fea90721ed25a027f18ee8ae3172c1110b711a274b0c3b05fddc1e43f161b0f58467a973a17c457d33fbe209ba45e6f0f1229dec39ab17ad9deb7f0ae0c50
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkoIdHFua0KqjW/UGeMohWH/82B9c:5Nc/zEOVHFlhzvjW/UFMohnm9
TLSH
T1B6857B2623E901E4E1BBE1BE89779546FA71786557308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c1bf4559d6ad88eb7ebee34727c05a311be31bf35c5dc9075afda2422fa1aae1
MD5 d6cf146b3a2ad8af34c2256461459647
SHA1 6a38afed0b839b0dc5787e3aa27297011dbcd0c4
SHA512 23355dc9f72eef3f540c0aa7575543e2836c4c61dcc2e60789465038f919f1997ae4ef0c30a79b9fba9f1fc8b77655bfc12abc54e1d8a42d141595edf9899605
SSDEEP 24576:u8kNvNnaFeYhJNtmZBmOIdHFua0KqjW/UGeMohWH/82B98:u8MwBtOmOhzvjW/UFMohnm9
TLSH
T18655AF6EB6F846E4D1FEC674CD238512EA727461073292CB5290C13F4E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8e604a61369f58c16957cd7464faf3ca56fecb308ebd9f6ae560e311ea36fb47
MD5 e6d5a15f430dc093fb9c9e5ab6f43c30
SHA1 b0432ce516951fa06d318148f9836c0b265e8002
SHA512 06e4a26d465936b11a90b150a3a222494f3debf14abf1db64348710aef7d31c8cccbdb208d0d437f2a3b15f620a71432a09cd02e64892739bc9002dbf097a316
SSDEEP 24576:cD3FHshBIYQgAHIdHFua0KqjW/UGeMohWH/82B9d:cDVHeBIAAHhzvjW/UFMohnm9
TLSH
T1CA75E17DE6AD04E4E57BD1BCD6638506E77138A9032269CB029081BA1F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/704-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/704-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/704-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/704-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1124-398-0x000001C6CF1F0000-0x000001C6CF2FA000-memory.dmp

Download

memory/1124-321-0x000001C6CF1F0000-0x000001C6CF2FA000-memory.dmp

Download

memory/2236-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2236-22-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2236-16-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2236-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2452-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2452-30-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2452-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2452-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3428-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3428-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3428-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3428-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3428-315-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3428-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4300-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4300-80-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4300-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4300-85-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4464-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4464-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4464-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4464-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4464-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4464-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4576-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4576-63-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4576-284-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4576-56-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4952-0-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/4952-7-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/4952-1-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/4952-15-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/4952-6-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/5108-69-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5108-75-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5108-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5108-300-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5668-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5668-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5668-331-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5668-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5668-97-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6004-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6004-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6004-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6004-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6116-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6116-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6116-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6116-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download