9221acf55517e72d9dd5a3255ac80265311b22efcdfb366e122a322116e90662

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
Size 2.2MB
Sample260718-nvleyaat2n
SHA256 9221acf55517e72d9dd5a3255ac80265311b22efcdfb366e122a322116e90662
MD5 25a5d38ee7e5d80a1eeec3021bcdd808
SHA1 4ff07bb3409e5f43f5f4419b6bb190727f2d8adf
SHA512 0940f511aab82858d0261b34a0124306d319a008eaa23cb0c36063013ebd59c9c2e030f8659813822de223d8858bb56c2b4fbc490becb76c2857de07c5ceb40e
SSDEEP 49152:vx57inBEpaEUZC87DGUyx+jQkbiog3npR1rrYoDmg27RnWGj:vx57WBjBmlZD527BWG
TLSH
T12AB5BF42A7D344B2FD8A6533112E67139739AB094313E9DFA6903DB0AC712F3167E2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3452	elevation_service.exe
3028	elevation_service.exe
2728	maintenanceservice.exe
4492	OSE.EXE
3908	PerceptionSimulationService.exe
1072	perfhost.exe
2688	ReFsDedupSvc.exe
976	SensorDataService.exe
3680	ssh-agent.exe
1448	AgentService.exe
3284	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\B:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\O:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Z:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Q:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\X:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\I:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\N:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\R:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\G:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Y:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\W:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\K:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\M:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\S:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4914cc768f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e3926aaaa16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fecf80a9aa16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053067aaaaa16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2688	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1448	AgentService.exe
Token: 33	3284	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeDebugPrivilege	4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	3452	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4804	2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 2444	3284	SearchIndexer.exe	100
PID 3284 wrote to memory of 5156	3284	SearchIndexer.exe	101
PID 3284 wrote to memory of 1812	3284	SearchIndexer.exe	102
PID 3284 wrote to memory of 2132	3284	SearchIndexer.exe	103
PID 3284 wrote to memory of 3304	3284	SearchIndexer.exe	105
PID 3284 wrote to memory of 2164	3284	SearchIndexer.exe	106
PID 3284 wrote to memory of 1716	3284	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_25a5d38ee7e5d80a1eeec3021bcdd808_amadey_elex_pay2key_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:976

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3680

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2808 2852 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2912 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2912 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2808 2852 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 54cf2d4a6a17f489d8fdbde930e2bb995b5e21b0a4afd5117d2c4efd95df902d
MD5 722642c73ba6fc330b0d2d898de35968
SHA1 a2b8a76c47471af519d71185152fe4d45c21987c
SHA512 6f0285de771b46c1db414e325c39ca14b7b9fec522c3494b4932d9beb21ca86918dcb364b64c8fb9fc4163b41d506930d743338b66783180fc475a25dadcbb15
SSDEEP 49152:qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZDmg27RnWGj:c3q6sjBeD527BWG
TLSH
T1F3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 eeab2fb9cbaee356529c10a35c8a5ef89f60e996bdca3299033f6b48a5571054
MD5 e1e1cf9295f0e86177091d493cec4eec
SHA1 6154e2969c93cf4a326d4bfd420d499c4945e41c
SHA512 e019d9980655bdf3369d15d3a180c6dc57df926be43adddfa56df1e8a682a0a07c041b15d0b77990b10a404f455977a3dd961bf1c8d155cbbc245c49f90e6afe
SSDEEP 24576:9XYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:otcDDmg27RnWGj
TLSH
T16065F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ed7de42fe923fc060ceb1dd30c007677a6679fd4ff6270510a2d8b838b0528f1
MD5 d58eca4e39500b944f4258c189759104
SHA1 af04e4b7c7bc502141a066278a06c5c9952c6f46
SHA512 32b576e7dbe30a1e3859637d0c8643078a56ea1a337766871879657891cb9e44882b78b31bd0bb5dff15d744f686ce46654f1426d9a0eff9089585de5f611f63
SSDEEP 24576:D0Le5ji0hmxxrM9sqjnhMgeiCl7G0nehbGZpbD:DPji0AjIDmg27RnWGj
TLSH
T1D4859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1ca6bfe08be3eff902bad9ed7b4e9d77944fd87d43c9accc53a5c3253e9cabfd
MD5 11241c0c154c492c29875fdcad8bd9f1
SHA1 202077dea158a41983cab555e6a6a507e06a60c2
SHA512 98a49e225d3fcb132e2eb4d01e9c93fd488629ed8154ecf08000c19f06364f6770be4283bf333ef47ae3e9e3bce262e622fc9befd0b1750a39c8175775309f7d
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuPsqjnhMgeiCl7G0nehbGZpbD:p/ezSC6vUzPveHjyMDmg27RnWGj
TLSH
T1D4755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ecd74b697b2e2db2ee8b32af75166a1f609ff2a76660e422e8963b0723ca8053
MD5 5afea918ce38d34b48ec5ca15aa3bc79
SHA1 ace5251c3f2909f40b27c1e49b31287860ba2e42
SHA512 b96a2f74e2051a4dbc8196c683f44319d8bcd23ac64862a9a9f14451a9880d0d498ae22ff3bf335afca0cf4fcb0164a346471fb00471239250274d9df50af32d
SSDEEP 24576:fVbqPb88hv/l+Y6sqjnhMgeiCl7G0nehbGZpbD:fVO88hXl+LDmg27RnWGj
TLSH
T10E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 813ee2bf7b0dcfb95d08f103962d668706edca110183bd7fabbd7660c1e9409b
MD5 ae78007b92199ddbd8b6d02c075e6cfc
SHA1 1572d91dbc8b8d8d5a05ef1f8f18a95affc5742c
SHA512 9ed0e58dc38e3ff7af5e12528a8a0e903e73e9ed5adc27442e1e3b267905a5ad05eeb15208aed6133ccf43bdba537c863d7c1f075e9a09022d9632bd38ea8ea9
SSDEEP 12288:CLpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CLpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D64523BF864C51DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 83b4d3900dd899ad588dd20e7667523fff1584d7e2b43a07c1ec0bc9b8776f4d
MD5 ea57fa93ca3abe56792b0a24ba0ce8d7
SHA1 db0af02a75b429b6fc7a2a95a0aca27edd128f07
SHA512 2f77ad583ade38fa46537e3ca20f62e430adaee27f2ee62bce6cf5f382685f5d6dc25e795368a26463f9e6f97992df161d4ceae0986f6f3f2baacdeeb4713da2
SSDEEP 12288:meBNUbTVO86USXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:mJIUSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 01f0b4812fad30b66e454f365c5d6060e5a739e1262bdb47da1ffb0fde09d55e
MD5 442bc9a5c12d275aed451832f78970a5
SHA1 3d9f34d81e88a6d7e0f17a2f343ec15968e3f816
SHA512 2bc199e0377e64993b04fc671685783c619707db9429004acb9d61851b4e9358ee1f5540c7a453b4f96756c9d3de40371392bd9815665c31a56668ea6fa0ada4
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:GQvGAdlCEL8c/DRNw5CjD527BWG
TLSH
T174266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e3098269b0d3d0b140523252e1a4a260e0cd874fcfff600774b6a32bdb641072
MD5 3d21d51b208d148a6ff4df460d0b6e84
SHA1 09d5499bc79e7a9e749e55162195b21c06aab9ec
SHA512 7de1d79b1504d3eb952698b419d9590cf9db8f1f6fcc226fd935331a5bb1af8c7f51f9148629c1fb140fa71ea7ec59b5a20989b1c55c76a19352ad7916d20802
SSDEEP 12288:YAwSfxL/2Dc3RDLLmt0LDQewsAjMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:90ewsAjMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12975E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e350e405d3426bffb10cc31516c311f7b227d493cc80dabd6102e867957162bb
MD5 7d3218998d99ad7923b4b5db0c7dd49c
SHA1 ae4e6ab196ab9dc67dfddc47eac0b0e28100ebb9
SHA512 0dee687a0b19a1345f4abafd1e4e73074459ae82c76ebebbd7a6d55a4c5fab5d5328cd043d60bfead262b03bb904dd13d2b6a763fbf456524950b010fc0412f2
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQVQBWG:LUEtQevvqc2W1cpV2tI32XB
TLSH
T1E0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bccd6e84be45637c6c06d1c99f9cbb2e8f5d70e5777a6b987f2598e143a62f8e
MD5 98bca98bdca0f7d934b8a98467a2c68b
SHA1 ef1aaf3a55f0beac6cd4952d5390e2483c22895e
SHA512 bdfd7a1a82927290706b3576a4ca5ab17e92d6268383f67b23d8aa2599008b0d67f476e303684e40fd8be557d4419fc967f1740dfbfb1effa8b6098099973d1c
SSDEEP 49152:jCbRquA/m2yL5zTfFiV+XenmE3/zYDmg27RnWGj:coquVjnmHD527BWG
TLSH
T13BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e88f3c2d57122c34927dddb8300f198b30c6f36536c9bf094b02b7b36a17d9e
MD5 75e3beda3da1b2a539af9b91f21d1749
SHA1 cd90dbe22c1458e86559f64f1a647ce775e9e3f9
SHA512 47df6302e64f75b7bc27a3f927a3e9e9e48cc5cb120e462534cdd685459bf695d3dff21b7d6f2222cb574e3331407f0e7450a76df3380ec7116b62bd88e79875
SSDEEP 24576:uAhGL3IFoiwtA5l7S53jsqjnhMgeiCl7G0nehbGZpbD:uAMUFoiq53Dmg27RnWGj
TLSH
T10E359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0aa4a52ea91048490b4db2d83a4e0241fa7ad9fad7049726ac05e812866f7c5e
MD5 72a231708a778382c83c1aca36e7103d
SHA1 c7734fe2f95531ba960b7c654ada8c979ec62d52
SHA512 2cc0b9e3310fce9f1c7d023e5baec721d0cda3269b73fba347470f5e15afb6cec458c52d0d59e63a6e8665c4a0242e92c8d2b4ffd140bee2bb3df48d50361ec2
SSDEEP 12288:/mw5HEjsChNVBFgl0WDm+CvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:+wu4OWwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19065F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F37260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 09ab1bf02ba2431a8e20b5037744a72ca4571647b9c3622e33387221cbf133ba
MD5 6d6275e4251ede1c5a70fec53c89a39c
SHA1 5b41c8c98f388ca9c82a85b6049f01ffdc23ea41
SHA512 5f7720ba1134656882effef9d3a27c4e9e443c0b2673794f8cd44491b298407f9560585aba73c2a6be5510751f938c819f703f72b2bfcb1a40f3b4ab86c8f961
SSDEEP 12288:NeZ1Iy8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oZuVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1185512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2809e00115b9269099094e7c4b889c32f8d3be799e94caa7ca1f722ecb0d21bd
MD5 bc0128eb69a81f43ce7fccbb78b93a6e
SHA1 76fd44d72274a1adf303520a73fc4fa5ef080c9a
SHA512 957fd49bf7e867a8acc1479e8d40edef25d1601920a16a40ac5000ff3a5217c890331203a40a54977578b27d65804a8cbf3715fbf0ee791ce88b309502cc1f9f
SSDEEP 98304:/QRQyi36YOcPbLvw2gAf+PN36D527BWG:OQyiKa/X+PNKVQBWG
TLSH
T136667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3ff718a3b9ef699623e960457c41ad2e1230eb8f22c6e133306524cc6c9151c0
MD5 0a66b143da75feeb481bdb881669b587
SHA1 f5c4cd07778c41033f155b65f61a5b4715741bf3
SHA512 9e37de77299a7a1d292341ce610ef52f04363f6df74dcc8d0bb72a026896b8fc4d6d827ddfea019416d155598d2baa9e487f609eb20b5befaeb57d469193d176
SSDEEP 98304:cQRQyi36YOcPbLvw2gAf+PN36D527BWG:DQyiKa/X+PNKVQBWG
TLSH
T130667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b151860d221c72654b351556917943f78395c08cac0f1d941e614be50bf59be1
MD5 c63749e4f0021d3f94479e9856374c42
SHA1 62fae6b09d9f8b9abac24bb43a2a14c660bebdfe
SHA512 30baf687ef004548213e39076290369777ff13dd51d1a7b17b31b049ee0f95fa00b54d0b5097a48ade37782402292349ef4e763af6b9471467d1e779d1eef0e9
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lsqjnhMgeiCl7Ge:W68Qg55nhceWu7PNU3/IDmg27RnWGj
TLSH
T126B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 06561775c04fd6d97caa52e6143c63a5de9f37ef71d80c63070f02d34bc095bf
MD5 a7f06944120e5c055b6e158dfba1b328
SHA1 09a37e6abedb1f2e3ba1d56877a022781e8044c8
SHA512 a331bf6ba3575f9d08bcade1ebffbb9dc967f6115b234b429b68d6f494b56591d0fc5eca9fb2f74718ebd94ef95476af99dfd1607ce7c532c44c075015f1be6f
SSDEEP 98304:Vy5112gYy5azzVvt69nLKnhZtD527BWG:4LIHEWhfVQBWG
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1bfc4707898bdb8f2e579adba360e00c6aee1d4a2d8b3bc4644d6a09466be0c2
MD5 32d2b202e32647a96eb6a83fb71d848e
SHA1 e16027136b055413d2cad2028125d9893bcffe2f
SHA512 0548834fc5fea1a61e1aaa229fe53301564f01dc5abf6e9f8abff31cb60abe75a51e45381e8e5aa84ed0dc506828e44ee54ecb784f2d48e727687f0340b93f40
SSDEEP 49152:MB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:Gu6Jmdxd2diD527BWG
TLSH
T11AD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 00d92482dfd82907a6a2096d7b81d3cfdb3f6c7f37627c5e0d61e04e68581a7c
MD5 75126a2c579d1bf80158db2f4316fe6a
SHA1 6fd1f4be43017952956af3f36ad999fb087657ba
SHA512 43733c9d8d7e035ba25ff0fa8b5fa087bdc8704312a5fdc514cdd847d6dffbb776adae15b3ac7b80c9102ce174f466b399df5ae464fb1ee172d3dc6bfbe2b37e
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4x2Dmg27RnWGj:+mifPWRHD527BWG
TLSH
T119B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 17eef5be1fe6a712af50a45bccb193478925bd847bd61f1c2aba342fa587301e
MD5 c2fd89e44262517dfb5ae9df8d59c04c
SHA1 4953a1efd45d89e5ab839c03864d1c78728edb22
SHA512 1cdb9ff684fa3c9bd90cef27168d72895716fa6d6308ab4ea20fe60661f32cd86da28320269fea8c72ab747f6596c2a2fc3e202658cbf710688b7c9f74182238
SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHqJDmg27RnWGj:K5dKii61JD527BWG
TLSH
T1FEC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 339e7ec2096e814e9f55a8dc61f0a70e09ef6595222cf411f291c3110267e2ee
MD5 9bf823e47fa8ae041bc588431601ee26
SHA1 831fe5f783212819321be8bdaa35f8822e558d9c
SHA512 77b3b4e8981c42dc4c544fd26f391755d2eb3afd9dbac47a60733a0381c4c43781d068aaa45d4b768ff8159a2796a30f8a99463c4604ac240b65f3c86d3c974a
SSDEEP 49152:ChtSn8EApI0fig3giDn0AP5wSDmg27RnWGj:jX2imph7D527BWG
TLSH
T12C95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8ad6c765c47b12bad3e9b77ebd56505c22ed1d1a237300519432b60eef6cf566
MD5 27181fa236873d44d473700622f62610
SHA1 4b93145dc6430e741131d7758b4693e0a1ee3e38
SHA512 fae39eabb28f180b67046282ad62b4f111cde4ecc073936a2f17f2b75849b14a698c5a0417bf5c0ca74bb015b540497b2e7f363221d2abdf470b549cee2b67ce
SSDEEP 12288:0BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BF965C41CAE52648F5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e40ca22b50de157ddaff9630d67ab5a70878dd6d5b5c2bab3a99f2d88d767cc5
MD5 adfe238c5ce9bc352689b6c382b7d00e
SHA1 5071209d2623cfe8a5fd185a291e684a8547a1b9
SHA512 2f5441f9fa27d2daeef6a8cc2e246f39c12d9590a3b68b2f85729e9c4768c648188195b1ef4219f66634d47871e2b82c89e5b894667362fa27d975455770eeb1
SSDEEP 12288:WYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D4523BF965C41CAE52644B5C3E5F14DAC073E6BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 aed315f1b2f340c91e439af9178c410ddc59d3890929e160969f5bf49ee652ab
MD5 57fb9effc8badd1435a1aadcd9f1e770
SHA1 15c600cf6b7d37c1492cad3dfbaaff404c8a112c
SHA512 34085d5c01f228c2aa1c1f60f336987b5ac2002637604edddc5a680facbc43af5002c8aa4e9dff4916b6166128bd890c8d86d53f727781a8500e05062df58c41
SSDEEP 12288:OKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ac3286d0dee5dc8dceb5700b2b6ef35c48015c4d1b6c01688e255fe109a333af
MD5 40f6223a3901945f04855242743e7c81
SHA1 11d80e91f4a58773a565f46f9609290b87386ae2
SHA512 6adc82932f598d26fb61ccd3faa17f0dce7a1cc118d832d31346615ab20e41d6f6c60e56fe3f422d3adfd17811c065364b33f20d5dbccd15d16be0b100ac199e
SSDEEP 12288:1VDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D545236B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CEE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4c1e06d37f10a891cf731412bf9dbdc3c46bcd7fb381395e7f524f9ae2743815
MD5 51103fcdd3d28adc06aa4d796df0c2b3
SHA1 2fb76274d660ac421553bbbed8d8bd6418758d6e
SHA512 a186b62be28b5b26208e02567d4f23ce61e75eb4d322e9f666641cf1f6c655d4de058bd74ceeb11053142e4069b51c1b4aaf7e4ad3f88858138bd4062f5ea1b5
SSDEEP 12288:JLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6d93cfe624879a2189a2bccdfc78d7b7c8d65c14c92126af3eb9acb8a92a38ad
MD5 d79e0752cd2d891aead77e505d5aa787
SHA1 290eb296edcbfc13e3c84145f66ec610e6183aa7
SHA512 88e951b4f9bae3ebfb404d5efb91426144e89ab12d69e3bd70b6ae8fa0f0eae0fc42e16d211277f11feb0115ec681cb023667b713b445bdb1d73872082422fe4
SSDEEP 12288:jkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jksqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F4523BF965C41CAE52648B5C3E5F14DAC073E6BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 651ed7e1ae2d25088b74b778f79ddcb7c991d86e5b9efe9abb7e5e8288d07b9c
MD5 44114250cbd2690fd149b0cdfc4dc4b3
SHA1 7e400b9f42ff5f38e3cb8668778cae5c8de98541
SHA512 67fc6781deeb1ccbab32a7ea373dc38e5677b32f129d63c0a205e9ad6925dcc7471364930d089ce0cc7ee12028bea7493eb0b5f4ae3f94cfa28b242bd2027d97
SSDEEP 12288:IAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F4523BF965C41CAE52604B5C3E5F11DAC073E6BE92004837AA77CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9a58085d7af6a13a7953c3cd80f0cd99853a178d0ba2f85ba8f613f10a2274d5
MD5 607a611dead7a27da6410161b4bdeeef
SHA1 02d9988db5334b203718418104c7bda8ba1f90a2
SHA512 6b026f634fc3842ba74d57f0dcfc29cdfaa299542ad9fcf6397234c532806c695fbf9451f6bf3ef809853a0c3802ead5aa2caf1dbd5a22c073cce3c8fd6d54b5
SSDEEP 24576:YZMRzFVSO4sqjnhMgeiCl7G0nehbGZpbD:YZMRzfwDmg27RnWGj
TLSH
T1216501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 39dc7e9b09a544c42fc45fb25aaff90474dc18979349799221316584d2de5354
MD5 84ed15eebcbe261e65a5549405d78e38
SHA1 0bd4bb606d9c5c7b1c68af27141a56a73b2cfeaa
SHA512 ce29a1cfeef80f594a11ff56293a5af9a198d1cb1cf6af2fd68a762c51f2e93fcdb8bbd8b50961bc14182ea8bfafc45cf9429368beede092bbdf12ca0acd87ab
SSDEEP 12288:AFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1704523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 09bad26d98cadbd50191268ad87cee58c2bb167167ee9ce6de78677b1a4b9420
MD5 1d72282f9d5baa766e634c866fe4e57e
SHA1 6b34c5fbae88a299f3a8c59e7244f49ade6dc84c
SHA512 8782f10de520711090c1af3487b9505b06d3924dbf9d26073e46a17b7dda6967daf534634310d5a5497425456c5a044c0d9a9a46073ee45b86f1e1c7291ed9ee
SSDEEP 12288:6ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1914523BFA65C41CAE52604B5C3E5F15DAC073E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 087e75d4258284d281a5033cc1ecc21eea9f3a13d908399e23890daf7b0f01e2
MD5 e7b51481c5e07167ef2d8f245f8752aa
SHA1 cf045c1e8bec62e6917588cbe87ce995fa0a90c6
SHA512 82be2f3f93cbb2f1c1746b8be4c8a0c135aedc3264ccbba36cb4267a2cdb2176fa55b4793ea4a2002016bd4cc8d3299632469a5fef7c3fe52829df22ca92d9f7
SSDEEP 12288:hyPz5L88Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wzy8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14355125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 000422c0e56e8eef5211487dc95fe8b04d7381692ae2d8288e495d62a31a4dcc
MD5 627bf6e5edf00058b4084dc93a6002a3
SHA1 d3893d1643f697a0bb0e21c9d6934ce37c6b7693
SHA512 2dd855fcfc17f8e8811937adba1ad64eb7aaf8a3586d5e8a4e219cec6e8e0a8cdd787ce4ab7bdbd67b8d19c9682e413987b499e9ab9efb82a721e0d2a51efc42
SSDEEP 12288:CFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e256e6499b80022fd497e005c210597815e4a21561424cb650a2069d23a87d00
MD5 e2d3d677a15140421636ff0af3fa4241
SHA1 3a8cfa06e3ca328cf68d4ff5a4dee560c27ef9cb
SHA512 f996406230112c27a0a33fed18367b6394920356d04754008131e9a92bbcc984fd7aed7f62ae4d28f3eee007f3c3bb8dff6b7341d64ad60f0366024fedbac9a7
SSDEEP 12288:kFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BF955C41CAE52608B5C3E5F15DAC073E6BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 32aeeeb47c5dbe3832e176f6f6233b5dbb9abf8ccfd008ae3fb5d7289932e2fb
MD5 70647905e624dc628633278ecb901ccc
SHA1 a879ba92077893626699894424aef85a562e8d75
SHA512 4b2c810eca6d3ab9d9d0c5c373027373f394d59f161dc14cf451b0b0153c36f064abfeeaa1ebf8a6941d164f3b6bb5afeabe2049296293c87c6caf7f73ad322f
SSDEEP 12288:JyPz5L88Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ozy8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C355125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 abd044fd610836b5287d4b86f26177fd427b5854948c7df822f3059fa40fa462
MD5 bc3c413ecbf04c2f099980b04c983171
SHA1 5b7f4bebccc17b2b911c01f757f0b6a36985dd91
SHA512 c1b7f8d1499d975ae745a05d8b9e4d4c56c17bb57a0a572cd7fbe29c8c7a639820c65d5aa21c590d7646e7315d11d84877abe9928388ae3bcb29852d1e940d2f
SSDEEP 24576:7TDaLl3z0zDasqjnhMgeiCl7G0nehbGZpbD:7TuLljzDmg27RnWGj
TLSH
T1886501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 03a9728da4695f95467e8f5a6a13c8a760729acbbcdf9040b1e0a115144cec6f
MD5 d45bc87d047d41584803dd180e2423e6
SHA1 9d14b476aadde2029651fc0e482cc195cce33b9f
SHA512 cfe02c1895a7664dec8b3376486a9972203add0390a62bc97db857d7ef98e3e75ce998ec36c1c55f42c8685d0a4ba186ad71b1a5121531a7b1140a92d3b36a89
SSDEEP 24576:V3vd9CHKy7GZWsqjnhMgeiCl7G0nehbGZpbD:1vd9CHKyawDmg27RnWGj
TLSH
T16D75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8131539f0df08c099f0eb7135a7d0e729dd57d721082502a004f6cb4301a6644
MD5 b2ba9b969378d31a845c34005c24dea1
SHA1 2d72316cabef35cf79f64b9cbae2936899d25141
SHA512 f94ab237c206432de80c6e38d7b09cc39ff23c56be4d722e69f91a3b788943750fb341b45bcae01c8f3277e7f7dab1f580b8d5a5208fd20b86b7b37859ffa1a8
SSDEEP 12288:EqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f18f878e8e032ff10bbba8d9d2e947e5b3c0a1f0260577c518e5f9bd1cb2c554
MD5 cdfae739bcdea922d00cf113a57e476c
SHA1 87c0c0c7d2bfb92378c0693c09614fb4941befbc
SHA512 2e42bc57a9ae45b679c40b3ac14499ab5b207bbc7b307ffe9afd7b84d2443fd9eff5cd0ff705393cf9c0f7dc3b3a2706204813f29710451af3200f2a4e245c4a
SSDEEP 12288:ecXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ecsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC4523BE965C41CAE52644F5C3E9E10DAC073E5BE92004837A977CBAEBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 76705c734f0f2c5166d6f20404732d555b488293badbadb9023ab87feaf967f4
MD5 85419ab67f8ef74bd93be48e29cee839
SHA1 26298c8394c58cf771e88061449f33c1799ce3ca
SHA512 231ec804637b44d95daf63287136c11d46de7b0d91466723ac6e4d30a4c31324c4b8d4f2a2d2aa64c77ad1a8a7214de21e8cc81bbff912ec2427e5d5ae39edcc
SSDEEP 12288:ZXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3cfcfdc11173fb6efd228e009e7109a13c2c4e1086822955ed6adff2594fd066
MD5 1eca5b24165990a0213e3162a0ef8b83
SHA1 f0f1f980902e8c41a226f5a8987be820461699db
SHA512 509c690de3da2eb5b5f817e6a09dca1dadc6518a5cd83c70ed923da609612c713a95cada6106f89e6e1f62bdd3bc03fcac3fd5482a570e8d20bcc450865543c9
SSDEEP 12288:MFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e2df99fe7d8f548c692391f74a6e5622f383b7fc8cfc89794c1c0db724796e14
MD5 d84140109c99c2b58edeb4ead712af94
SHA1 4b31533048f92290e0ea79dc8213b972c15304bd
SHA512 de1b2ff43629537aba5210ae7938b7066c3b81e691f64a7b350d75614b7e0414ea793574c8da3b859f3381614cd4c6745c7ce34449be2b8d6b8c876e3bb6d50f
SSDEEP 12288:mqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 70893280562c6d766384374263516a6839eb6859250535cbd67a530ba6513957
MD5 e32a01f32729110368541e8c94d22e3e
SHA1 e4dee0eb66728e4c6b19f099241537b5958a2ff4
SHA512 85d7ef1f2afb626e3f72df477063777a4d3de3195122ce1163862393677be9d7799cf7c0e790a3a2e8ffc0c351441ce78410d54b4546068f8595b8419ff157e1
SSDEEP 12288:ENXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ENsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BE955C41CAE52648F5C3E5F11DAC073E6BE9200483BA977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 eedb04ce42cde4a0f8c79068596ff7d60df4c0a214069e47214b0c9118b8b2ca
MD5 3a1ccb1226bbead335f68f1712c08110
SHA1 2f6a1cf117720896aad6487d152582dbc2df2395
SHA512 0b123a8a9e50b572fc34bb675dbfa317ecce20588083700a5cdb87bfd0b8cc52c9b574e8dcdea8f31a7f131438973cee31c44cb2e36ee05b3a0ed9fa2d2f374a
SSDEEP 12288:nLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B4523BF955C41CAE52608B5C3E6F15DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d75ade63d912f401dd4637dfdfcb4d425500fbe52cded7dbfd93179e6553f392
MD5 c4652bbbec72849631725fda5011266f
SHA1 e563757245ccdaed37819bef9a1c4b414eb003fb
SHA512 029edf2ff08fe2f197c5902db74cd88005581b0c8e2c6b47b98dbb3286b6b04a9c7fbd2b3ef185eaffec921ee829fee87c9819c3efc37ec5a2045670b10029c3
SSDEEP 24576:qfwvUk9RX6wkyAIJsqjnhMgeiCl7G0nehbGZpbD:6MnYINDmg27RnWGj
TLSH
T1DA85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ce442f6bf601bccd599106a07215c3c70b9ee20faac0740f3b2b42647a4b3a88
MD5 483010d72e329b310b5a1f6b35cf7849
SHA1 d44654ebf733f3014a45d7fac7209ad8e4a64732
SHA512 5928f7e2cdfaa5cf6276e9c89bc5d683d1a658440e44867d6f5772fc0dcc4a1c64ca358243ba476926e8e831ecb902dda6d216b1e24c1d2d272ec935beadf0a4
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yDmg27RnWGj:RySzPaD527BWG
TLSH
T1DF066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0bb945c2175ed06ef1ccd46797eeb4512aafd10e5d0c8b7daef634980bfb9b54
MD5 4b14f4d6f9721e36c196ddf819a55021
SHA1 f3dccd4821a03516c2ee62367199815c1cfc9cea
SHA512 e164332c3269b7ff4ecb013b85c1d1e1e0387be83718303a78894afed678257be4509e5935437b774d6b6ace2641073889dcca608f38b1e9e067e43397025911
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYosqjnhMgeiCl7G0nehbGZpbD:F47JUQjTirIhCnDHUPfF/iDmg27RnWGj
TLSH
T1E165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bcb44d9b2164c341f16b54d7cbcbbc9a5b9e2d6b25eef248e2d47f1998fbba8d
MD5 f0657bc766a627621e5520c724187102
SHA1 7f6d44e27d4a8b7695cd8fb9c4e9bc9bf73891f5
SHA512 e3386df74c070e63a9168ad2e7a2ca4d08c95c706d1c01125d1c84505afc1593eaf33b3c5857da9cfcdc30e47885d31891c7c2abff505f3fa9c031c38d6a9c5d
SSDEEP 12288:FbsfVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15455015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 4ca505e0faa07c0dd635e01d19f5d6f44a8051d289b102f792ebcc42b843662e
MD5 010b6ef2e558acb2c01bc16f3104592d
SHA1 334355a3fb56a14d002170a0e71b9a4c9792bd5c
SHA512 02c997843ec32dde0fea3a1ac3f574616637b845a79f32203ec20d3eebceb72033b66635708979e8afb05ac1a8e7cae6d1b5f6e7aecd757eb56baca42219763f
SSDEEP 6144:rsBC2naNSluMzW3arSmotMxats7U3fckj17NI1+l2QGjDmUe2FT7oi32x6R3DzB2:0d0gU3frpLERjDm9CkdSgxN0cc266pzN
TLSH
T1D53529417667C74FC66980321E32D1CCABB07D11EE44AF0773C8973F9576A58BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 7b6e15181f071eda09ba1cc668fe055b66dfe0ab70b76fb2391ac2c5f3997451
MD5 2e45ef424cf95e997d586fed07ee19d0
SHA1 6c08dbbe82431fcc38af9f6471e87217b9984dd5
SHA512 c0c91f77e7374ab24d66228f7b857cf7f340821b2ca296b6d0ac8ad846ac26f4cbf06c5bda5fbfcc26ca8beb356384764041713a016bf308d3a3df198c2bac62
SSDEEP 6144:wp0v2szx/Xm0+z83QTSmQRWtaeRXzwSqtMxr80DkNA1P6SqtMxjRs7XgXNbDYIKc:Tzx/mRza+SmsWXznPvXFHz
TLSH
T19265E9415137A28FD1BB6032072A5B4D7BA8EC47B6056F26B388453ED86BB15B1FD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 feb1b65ded60c77fe1a5cd0152ac79a12f2fcc3d8de3af063a4d246138de5cfe
MD5 0c52b3e5e6286f8568c98636bd11c20b
SHA1 8f92f57d8f46627bbc38b6137296a083ed9b4037
SHA512 fc2d3e2cd106ea59f333d2916f08a9f1015d3d6fb0cff06a64eddd1889271af4aeb3f3e491cf12dcb69ad118ebb07098f86306331b488c1629f90d97c812d867
SSDEEP 12288:W07dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18245237BD34C518AE83605B482EAE12D681B7E669F1044C3B95778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 90a487faaaa2f0db79d3926958db8d92e1780328c5014bf5568ef51c7335f320
MD5 dc3555de1d96b2d10bc0531565fc57b5
SHA1 bd01e0b0274b03a825c85d151ce42e2e596cccef
SHA512 b248eaef16f1eacb0a4e9d61c5bdc22c084d234ccb15fe3b84c7497c21bfb7c45981420688f9aaf381c6a846ea286a22d5813dd2f38e78d57e9c06adaa044938
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYPsqjnhMgeiCl7G0nehbGZpbD:Tgb4mBIBhGFUDmg27RnWGj
TLSH
T10B659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1f4c083303684edea994a3268aa11f18cb67a80a6705b6ac000d26c99a6b44bf
MD5 dfe3050b0661b1313d5dcb6a0aa5ffe6
SHA1 599cf0aedacb6afbb009e9bacbb9a5da80df3ca2
SHA512 86ada97b5cfce2325e282ac8c8c52f290a59bb78fd77c5afe534f1f098f41b1a1278af8b3837a1c7d97d41a147e5943d7dabc618a1a06d8f29adeb01ff9fdfe0
SSDEEP 24576:cG88u8FpJqH1bzria7/m4sqjnhMgeiCl7G0nehbGZpbD:f7ZFPqVea7/LDmg27RnWGj
TLSH
T12985016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 45bd6f84c3057b29fefcd4aee2343cdbc14d616b053817b2d52a637184a66055
MD5 3bc5909d5f0596f51b25acba83a00262
SHA1 260e4d034506e2a7170f257f17278d9a0c18b6cf
SHA512 d80ccbf3fe8d02ef23ab9a204fee0b91c6e0745259815d35d40e1c6204e457868e8d0f53680d924382641b1eb8b583922c0abf0846a844ed8856714371c1ab24
SSDEEP 12288:VHvUrBFrEjwaQUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:VPUr+NQUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14565F12F62AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9745540d8cdf83597429c13a66abf6d3af2f8923e3b82d6c3c3318b712ae7ddd
MD5 baad924f5395e72a29f591c875febe74
SHA1 1a90fbc6e99e826974886c08a079fcbf2bfc251c
SHA512 30f2c0fe9e5c6820fc46416b18a1a253ea1a840c33aba86b6a7e300721728b685fb05e3844feb3d7f7db7b5c8aaf7aa31d4d929db9f3cefd3555217e7aecba17
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjADmg27RnWGj:kG05lO43bFD527BWG
TLSH
T117D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 46fc98fcdab3cbf29dcfeea6927ddf033929eff29adacc95bd18c7a54a8375ad
MD5 d915446b7b8ab7c2a7ab779c7c88ba2c
SHA1 f710b332f4d16fff6819f55636433b65e833ae4c
SHA512 3049e95708281565c334953c3c956874f4ccde877c7d16ef37377b9912227ab7cc5ed9c0a60a4c7441875ae99b03fbc71fe51f0a1f3c9f0dc873a874bfcb89f6
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnesqjnhMgeiCl7G0nehbGZpbD:Ua5POZ3BJt2pasx2+mIDmg27RnWGj
TLSH
T1EE65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c440d41eefa6c8d00d40205450f3b67dc1ac76c6c5638c162b2df0ac03baaa0d
MD5 3561e597ab914ca72dca2b25ac5060b0
SHA1 82c6b241ba5b33fbe13ad9cc48a23da6c101e33e
SHA512 0db86afde342baab082f57bf2d6a404e1a6eb44383a8730850ef4c39a0ab5b408be8d2a274723fd649773e8977e0ab75350cfa253eb00c953199874caa008bf9
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkQsqjnhMgeiCl7G0nehbGZpbD:dNc/zEOVHFrDmg27RnWGj
TLSH
T1D4857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 136109f0e9c03a63b5576540ff2a3070ee2a2998272b0d345e0f3c854590c8c0
MD5 d3b17a54977275611dc35d1d5c4d7e91
SHA1 7e2349628ec9229875e8ec3dae1afbd819caf12b
SHA512 f71f58debe4bd49a50282ea16ead8472f2779f509871476e4ea9f463b4042fe966b369b5d0311605fe55b83016176184205ec241a8920012f38948a980efc64b
SSDEEP 24576:MTkNvNnaFeYhJNtmZBmCsqjnhMgeiCl7G0nehbGZpbD:MTMwBtOmGDmg27RnWGj
TLSH
T16F55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e9a47742e0ba6fa4946f7f29767a8f7169ce0af0e3559905aa81873fc32d8e4e
MD5 1e1b91d61d06e64b0d6a3adda52fb1a7
SHA1 86de50f3672b512e8ddcb33ea5d87bbe14e3cd25
SHA512 b49271cf06d33b7805e77147402195c1e31faa51afbe0eb440f79a3e67cd3ea376868f370b87fade8beb4ea2543e314d5f76427e6e86d96c57845ecfafecac8b
SSDEEP 24576:KD3FHshBIYQgAhsqjnhMgeiCl7G0nehbGZpbD:KDVHeBIAA1Dmg27RnWGj
TLSH
T1FC75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/976-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/976-305-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/976-288-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/976-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/976-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1072-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1072-264-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1448-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1448-130-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1448-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1448-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1448-120-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2132-318-0x0000019930D00000-0x0000019930DF1000-memory.dmp

Download

memory/2688-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2688-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2688-274-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2688-319-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2688-82-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2688-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2728-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2728-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2728-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2728-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3028-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3028-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3028-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3028-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3028-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3284-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3284-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3284-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3284-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3452-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3452-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3452-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3452-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3680-302-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3680-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3680-107-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3680-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3908-228-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3908-72-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3908-66-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3908-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4492-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4492-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4492-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4492-195-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4804-76-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/4804-0-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/4804-6-0x0000000000D30000-0x0000000000D97000-memory.dmp

Download

memory/4804-7-0x0000000000D30000-0x0000000000D97000-memory.dmp

Download

memory/4804-1-0x0000000000D30000-0x0000000000D97000-memory.dmp

Download