295ade4f40af942669a875047a36ede3e236d13c0800ff93a63da7c54b4a9f44

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
Size 2.2MB
Sample260722-a34plabp5t
SHA256 295ade4f40af942669a875047a36ede3e236d13c0800ff93a63da7c54b4a9f44
MD5 51390532d9f3c6b5e9f00392d930dcc9
SHA1 cc7178ce5a2558986283d620fb3822072deaf550
SHA512 174948dde5b89de5f6468f90600affc38aeed4d0ceb414c717dda7a8ff5145cba5a07304dbc7e8917c40ec1e8026bccb71ab26387a6bda79cb63c57f16d4ccca
SSDEEP 49152:+VzyP4BTkT3EApTLi2CCzMn3jzjAhFEy5eaXrKDmg27RnWGj:+VzyABTwEwGD527BWG
TLSH
T13DB5AE42A7D344B1FD866636212F6713573AAB0D4313E9DF96903C70AC712F32A7E296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3248	elevation_service.exe
2676	elevation_service.exe
4704	maintenanceservice.exe
2628	OSE.EXE
872	PerceptionSimulationService.exe
1200	perfhost.exe
5804	ReFsDedupSvc.exe
4204	SensorDataService.exe
1424	ssh-agent.exe
5544	AgentService.exe
3412	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Q:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\A:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\N:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\D:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\T:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Z:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\S:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\K:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\M:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\U:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\W:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\G:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\L:	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\63a085c9209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0b9cda67319dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001fd5b8647319dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064fb87647319dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016aecb647319dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000948a0657319dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ac42e647319dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e340b3647319dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5544	AgentService.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: 33	3412	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3412	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3412	SearchIndexer.exe
Token: SeDebugPrivilege	3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	3248	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3372	2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 5136	3412	SearchIndexer.exe	99
PID 3412 wrote to memory of 3556	3412	SearchIndexer.exe	100
PID 3412 wrote to memory of 1948	3412	SearchIndexer.exe	101
PID 3412 wrote to memory of 4160	3412	SearchIndexer.exe	102
PID 3412 wrote to memory of 1196	3412	SearchIndexer.exe	104
PID 3412 wrote to memory of 1116	3412	SearchIndexer.exe	105
PID 3412 wrote to memory of 1312	3412	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_51390532d9f3c6b5e9f00392d930dcc9_amadey_elex_pay2key_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2676

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:872

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4204

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2880 884 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 1884 884 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 1884 884 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2880 884 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 52e08381f915c877429ba3f8d61d075443821ce0ab6a2c7e04ff6e3af569f7a1
MD5 a76a420030cf8c6de22ec12bc9a5c3a9
SHA1 b26e30c900bc60cc47df93cc413a5f82aa6ccd7a
SHA512 8656fd34d103aed5d7bd03a4a04a273386f14fb696a8aa55169cf1ef66f913fd9b967901647148014e25e15fc454c5d56941f0c12f5d0cfa05dd367ab1a0b90f
SSDEEP 49152:ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnwDmg27RnWGj:C3q6sjBDD527BWG
TLSH
T16FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 39f14fdaa993fb6e6bf3f20d0df9abd2c34daaa2a1a45863193a5d584d269c45
MD5 b3f048c785e2c73a5993e558c4614dad
SHA1 a812ac0adb2c63be6ed97dcaef64514da58f0c97
SHA512 07b4f1632b73fe28d5ff704f8baac3e1dc21ae6372aec8944b4895f9aa798caa58420a74c58eca94e38a1aed697d1932116dc335cce0b206afd00ddf97e2346f
SSDEEP 24576:7XYfDtczAjsqjnhMgeiCl7G0nehbGZpbD:etcCDmg27RnWGj
TLSH
T16D65F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 778c413400f104135e17fb10decc0b95ecabd19e786c87259e25c7717eaa2aad
MD5 10c956352fc1e99f35ce4421b08d9b58
SHA1 0480539511da1738e5421c0b1553f6c1efb27b02
SHA512 98bbe2e8e2a183ce01d99a973063347bfebb1a255cbc7df161a15f66e13061119123d21ec71822c15be578af6bcdbb1afda12a4ea1a8fc86d4da39ae38a000e4
SSDEEP 24576:a0Le5ji0hmxxrMMsqjnhMgeiCl7G0nehbGZpbD:aPji0AjNDmg27RnWGj
TLSH
T10C859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 19fe6a660b414c1992186bfd8fd0701ee0dd3a5e062094daf5e6db8a43bca52f
MD5 53c83a89d8a5e857818f1cbf8bef0965
SHA1 20fce5c39aab77484c1733a17af8008950564df4
SHA512 b265de049fcc70d38c46cb1a6528fc27c98588d251fe825df73bbee62393bdbd5081cb22e6c548627b0a88c6d292ba80d8cd26d2fe044ea231d6dd1eb985ed15
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWn6q8wyuesqjnhMgeiCl7G0nehbGZpbD:Y/ezSC6vUzPveHjyhDmg27RnWGj
TLSH
T180755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1ceeb54eaa90c68a8b3739efd0eb99adbd5ac97097013ec82b54fb5daa69c806
MD5 d1fcffc7717fa4098a06dcc38c494caf
SHA1 47d18a27f8c484e2c87cc864abc34711dfd96369
SHA512 ac3f148e862c729b90869013080f94de34c07e4e0fb2a77961ec69b7db42152c4c9af23aafdc7c0060a59ad78a739b1a4010581bd028e590c099e3205a9baea9
SSDEEP 24576:NVbqPb88hv/l+YPsqjnhMgeiCl7G0nehbGZpbD:NVO88hXl+qDmg27RnWGj
TLSH
T124559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 04c803f4c42764f34ae7ad38d700757dc0b1a9b56a6f177e1e3df9d98d6192b9
MD5 a3de2afcb76834cd0d9972272fa9b6ce
SHA1 1c27ffb538bcf66d94f2a4e4435a42af9b31ccc8
SHA512 b17d06ea006e3f37a6764faa29ea0b3195cf1d9e820f1b0181bf6e4858eac03f10560eaeb4414ff9677b3bd567d974c49070d8f6793c3f1593cb8e258c705389
SSDEEP 12288:RLoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RLosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BF864C50CAEB7608B5C3E9F51EAC137E56982008536AA37DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fe8a854dda10f0a7b2526553aab08a8e737074f0086d6665ef37dbe1899b0c6a
MD5 2f970cc2eac4a8d164afbe9e4acece20
SHA1 71871866fa020e6f0e55c7087c112f6489b60221
SHA512 9bd38b231661ab39efea4dd1a0a68508a12c440abe5ab366adf0c06691d0a9dbbb9d47f85aad68d3dcfa62afc47fb229f6e6ce4c15c3706ec9741633602b3fbf
SSDEEP 12288:BeBNUbTVO86UnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:BJIUnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 137000dfcf787c2159165fba8cefadc53fcad8e503979755cdda994e7523f41a
MD5 10e42d2403d5e6c1235f516af0633d1f
SHA1 23c8959b64f698dd6af5dd45bd646f0919ec1c80
SHA512 a9a406fcfe0ea267651d6f92af919dd82773a33b02c8526e0acbe09512e9fed2bc74993f7eb5b41e875fc31a31971974572634ac3d5df1fca250f0ffb7c09215
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH6:pQvGAdlCEL8c/DRNw5CiD527BWG
TLSH
T1DA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b27506eadf75b2ebe6a5e20ea0c04b9f621b5303eeeb3b222b54792d69bbb716
MD5 f8b06f409d5a1253eeabf7aee8302c96
SHA1 2acb96032423cdd859f2c56b9f5d543503501191
SHA512 b7150e6296ca812b78ea385c5f455c414430655ec3d0d0f1085bcf24069fec019c88cea5fbbb1ca0c1432a1daafc8fca2483aeda187adfb7b9f85a78fbb7f630
SSDEEP 12288:NAwSfxL/2Dc3RDLLmt0LDQewsAj5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:+0ewsAj5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A75E031FA74E036C77B0DB20B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2d27846317e62db35b0fc87efe8415bfda6f3ed72bdad9d17d4625409e2c1f38
MD5 e485b27786365d2a862fb221d2dcf5d0
SHA1 8a9bd370a293b5d985a57d572ed57a80cbb23b6c
SHA512 8a56fa8a2c901e80a090a5fb69da96395bf700264e9a8cd6994e116eb8727061c5eab34ac6a3ed14315703f2f4b32d69aff279389cda929751bfb570b0848bdd
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHVVQBWG:sUEtQevvqc2W1cpV2tI32gB
TLSH
T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a720f10e138ecdf962601de8b741f4fa968f752c437a2e4712afe51960bdabaf
MD5 58f0b912c0cc7817216d32bdb31e13af
SHA1 4c2bc23a8e2762776869018e8df959c58867dd3a
SHA512 fb464a290cc4c18b87472d163436bdc97b378cc0f63fb7eb9cab7fc41c4fb31bc932f5b27ac4706c11a7719ec7dc2545b27a341e7d6711aab1947dd8acc7f36c
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/zdDmg27RnWGj:5oquVjnm2D527BWG
TLSH
T13BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3240ddc192acf61b2e2cac43e2e31787e0af14db7f9c000543d430f788009b74
MD5 ed4b867ae5b74db355d7ef4c35e28a73
SHA1 5053cfdd6cce2b99fba401bf1e5e7978e92c95ae
SHA512 66a8405c88983352255c6b528a047a66a2e467d6c57ecbdf267d26b65630026457503c892e876aa7ff48f43e6774cc8a5acf66c914429253c90c71317a95bfe3
SSDEEP 24576:yAhGL3IFoiwtA5l7S53SsqjnhMgeiCl7G0nehbGZpbD:yAMUFoiq5mDmg27RnWGj
TLSH
T1B1359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4a53db2a0749ad7b2d8d00845ece05041242e978019720a79afdac7b465c7cb7
MD5 8292a14be0cc4a575c29508dee84a67e
SHA1 c311101d455aa0694bcbf368672ad5b8c0b0e55b
SHA512 82349d9629ae635d19c5e66a8285ef027ece0a420f7ce8083fe359464fd112e96df35cb6508f26ca801d56aaeccebb63ac1a2a9efe58a21e699b7fd4abae5841
SSDEEP 12288:Gmw5HEjsChNVBFgl0WDm+C+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:fwu4OWdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A65F14A76A81CF9E9674139C697D136F7B3BC122A20DB1F1760C65B6F33250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 75a458de1665a3b490739345529c17b8ed3b61d994d4e169d526ac375cc76f7a
MD5 824c694b1fe1beb80fea1adf0e62079c
SHA1 39d47fc5ff8ab6e122345795ef1cf9b8c101c755
SHA512 2536f57093e3e145991a9ec2ea4b477884ac4c3135188bc46b2274830ef1c48955f5c406c057fe54b343926073f3035ab204a45b9fd88cc5fbb42f9bc8384e02
SSDEEP 12288:ueZ1IypXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zZuEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1235512AA239820FAE1A3417CC5E5D609E7333C62673043CF166655AA6F73AC44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 96ffafbb4dff0244b5a27998ea965f43406de69c682da4645dc85edb2637dbad
MD5 14ef23be25f9c3a2d156030a88f7fc87
SHA1 c7f57d45bb0b4f054a0b1a7fe8f01e5b4787c77c
SHA512 b2a78ede5957445ac528af59bde266e777854b2ff81de7926ea82dc21626732e1dd5f2ebe574ad1cb0ea150eb51a404d03d1c90ee9f7330a5201edecdde7cc6f
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3PD527BWG:pQyiKa/X+PNfVQBWG
TLSH
T124667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e46c81fd8fdf991d9d60a6859ffd4b06e14b21d6ccffec096a2baae2b8a3fa7a
MD5 ff826fb897736c133b68aae6b723b792
SHA1 98528d3aee853657d335329ccba0f65a9790d22d
SHA512 fae392ad917c3c6e98857bde02993e68098fac7e8582ccfc4dbfb424f4cd69e5cf6dd0689882ae9642d842c92f2938f144ed97c99d2226b314240b41c927ea5b
SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN3PD527BWG:uQyiKa/X+PNfVQBWG
TLSH
T174667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c0add9db6cdc18e553128035e82c36800bfc309984a48b87c27047a64a060ecc
MD5 c3f14bb94bfc216713f364d52eef3c78
SHA1 fc33c20b18aa0177f2058e1935e4a97a254aed78
SHA512 5b9bb474e177373c8b16b5bef19568a2fe38fda6b1cd267bac16c04e03d6c26898c0e5fd620d3d61ea45b6b4789eec251373d67c110333145457e9991670dc35
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0UsqjnhMgeiCl7Ge:d68Qg55nhceWu7PNU3/NDmg27RnWGj
TLSH
T124B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ba436f469f20e8fe656e912767952d94f548499c8ffc70a2b6fb00d6fabaa59f
MD5 ff32252ef50a2bfac51f64b8519fe976
SHA1 33d157ae58cd8c8d067bbb335a8749efc627b816
SHA512 fd42ba5ef119e0044ab88310ebc0703bbd9e8589d0e218ef1e902d8f60dd55c2a83e804e47778028d6c2a7e105efa6608c9fae9f90d9fec213d3e35aee4820e4
SSDEEP 98304:ny5112gYy5azzVvt69nLKnhZUD527BWG:6LIHEWhuVQBWG
TLSH
T19C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b95ed589c84c557ac8961a707d16397b619b42c9b39d2a94c3374220cfcc6f4a
MD5 ed6e0a7c57d01af5307ad03514e5e86e
SHA1 de56a6cac14b3d5ef1d79500c646ebe50dd5265f
SHA512 5a2bc38ed4146fb3afd9c52f141b49c7d286dad75db03680a7e20e39edb24b3c07ef05ced42e7e40f01375c71817d4fa46fd3bb844f2013c0390c71cb6474d93
SSDEEP 49152:uB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3Dmg27RnWGj:8u6Jmdxd2d3D527BWG
TLSH
T1A7D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f5e15029b160749767708d3eb86613ab0da89815e569adfb21cb5dd13aa8b0a7
MD5 56bdd467e05128b3ee3baba15c7419d7
SHA1 20505524d62b92de1466fdce8c12ae8c2542c46b
SHA512 fd1d7700ed4e5b74b8af08bc744261580d079f4cee791f5d41dc7277827db7d718d64019b23a55a7762cc74a134c781abf985d13b8059b7fbc7f7141d10fa015
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xbDmg27RnWGj:JmifPWR2D527BWG
TLSH
T14CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c517d94b79acb89d07636956d438cb3cf915c6a166f1b3cdf6c2f29353a479c2
MD5 e46593c8e3f34dc9130f872e54bf7b95
SHA1 dffdb666158ef998600ee7c88c3683368f02d0ad
SHA512 f0c2c0680dace231237518c9da9ffa02357c5b1ade6ded046ec939a21be9d959cd02e28148a6ae50070f2f6d829845e7d4e5b0c770f95707b28ad1f57112b9bb
SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHqgDmg27RnWGj:k5dKii61gD527BWG
TLSH
T19AC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1fe5d4df43b5d27a17c496dcbb2e67e1a1e0e41b2b2409b05c5a715674686e0f
MD5 2f0b4ec9bc38fa5dda6fb036859696bd
SHA1 cb93b0b02c410c2e8b5e87746499a0eb9a71d688
SHA512 7bf43e8861c362a07f91ecd9ddb17d5beabe700690036ed8e855c9cd1ceb5af180189220c5b91d1430695a5adbd4bbf4c4301a2020f4efaede6941a8957ae50a
SSDEEP 49152:YhtSn8EApI0fig3giDn0AP5wnDmg27RnWGj:JX2imphaD527BWG
TLSH
T1FB95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2884464cef4909673b706b52a538250d6c4c437465e210c9fffe89b7c8068993
MD5 77e591f0e3896c6b480b8c0c3f062e92
SHA1 20d4b61bb6d62b8a1c1a5d13ae1c54677bddbbfe
SHA512 5e309c34eb25eb33fcf8b7de25a353ffb7335f23ca8631f610835990b923d8ab46f530bd8145bb8b0bc3a19e8c999d459ddc37b156f3a4aac9b8039cba4b2787
SSDEEP 12288:oAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E84523BE965C41CAE52644B5C3E5F10EAC073E5BE92004937AA778BEFBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 621b52083e3fdd1e45a4f76729066396f1f976a9abe162a3b49fff45a76fde22
MD5 f9848424cd4622cac7e55a23251d7254
SHA1 cd20ddcdd015e4440739fa0ff81ec6d22bae15a0
SHA512 dbe795366d7360b778a7a31e497e7020a2ff043eff7977eeec14292476f83ed718649e3b0ac25e74849beb351fc13e773ddef0c6f21e8947c83ec0385930cf0e
SSDEEP 12288:1lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1lsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BE965C41CAE52644B5C3E5F10DEC073E5BE92004937AAB7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e4a48278d9c1b18b86a3990e853a9ffcb827764585f10c6be49919fd384fa5b2
MD5 500d226b32fb2e283c3c875e34750b45
SHA1 a6deb81bfda74041e44b99b7a9be3f32c588eca2
SHA512 e1a25059b85fa0e29c117d74d4ad15f53cc60c60621ececd90df6820de6d5081bd83bcc1d2edc71bd935a9d5456f606099d3d0626b08c7e328fe6c0690be261f
SSDEEP 12288:5fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BE965C41CAE52648B5C3E5F10DEC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6fa25539230f39a487d5722c39fd761d8c99abffafc051df6e7413c60d7fe871
MD5 c01006e9a8eadfb64d0b8c92f00a372b
SHA1 ceb45f120e704bf0e267b04ae3174edeaadfe80a
SHA512 f547fcb0ad2b3d09f5dd657c157ee279ede3e6986b5d9b261f1f12ddd56e379a82fbe5dbfd4bbe2adacca470479cf8fd90f5460f9be2d4cb9af7f97a987dc120
SSDEEP 12288:3VyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D45236F675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7617493b1af640afb8d9bebd342ce949d5e77d458fb5e380d0b2052a2565fd43
MD5 a798b58be4dae330618d4592cc9d477f
SHA1 50b31c4a77a50579e2e8a8e70696ec1883a1320a
SHA512 66abac118bfaaad5acc70275228783841ce532a8b8a14baf64b864e754755bcb2592c07dd6d29ba407a1b9d46574f7a9e691832cb1eca46df2792ee8da965009
SSDEEP 12288:Y6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF4523BE965C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBF18584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f870dc18c2c21f14e68b727b62df2e3183ad20f6d7685e3faf36d83b21e2c4da
MD5 3d694b5072d2d2a4a213fbb5d6b1c86d
SHA1 8eeabfd3511055c0693c8cacfa049e93b738e43d
SHA512 e69829e3c5d71ea2b63ec90abe56a205171f6c2649448ed733d0490958d85a01a6a5db7e3ac6fd2caf7fa664447b72f2aaaa8b0cd1f51f283975a41f66ada6ba
SSDEEP 12288:IxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BE965C41CAE52644B5C3E5F10DAC073E5BE92004937AAB7CBAF7B18584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7d2be85db43edce123c7297f1c791cbc0ce516ef12d2ad8dff46d7260800b82c
MD5 ace17463398965bc7ea861a0f2b8661c
SHA1 816f4183dd0b1e5779c801ebd86b83a76a657c11
SHA512 f15a61e1db7049df6f9343c67b6bcede99622df1be6104468284dc18bf833e9e78b91414f62a718fa1fc451650a027c1ad932322fa44735bae1297da708eeb5c
SSDEEP 12288:LtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB4523BE965C41CAE52644B5C3E5F11DAC073E5BE9200483BAAB7CBAF7F14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9a81e8d6010280483ad8af4d6165f13287e7427ab75f7737e6de481330d7b923
MD5 b8c44d230d65b82456c3b243c42a4730
SHA1 115b214a46bc15759b555e9af750cdc3f433c30e
SHA512 2a5a40b8058adb5fa1d4f342fa3f7c1bbaa342cd869d501fb536e7358e48ae1950166181ec870decfc00fc82ced21bee34b9e0698c89b2004f2e9d087df260ee
SSDEEP 24576:PZMRzFVSOFsqjnhMgeiCl7G0nehbGZpbD:PZMRzf1Dmg27RnWGj
TLSH
T1836501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 df9ad6ee2ea2ee6d4da38cd2634c677041c9766551ab905bc66cca10fdd1513d
MD5 29fa5875fecbd11418312c3383845488
SHA1 1b896a7b73a9054c3648da16f350c2caafe1187a
SHA512 6ece1f1b02b2f46a0f2a8002e25d16e1cd14087887a31ba77fcf6b7634bfb7a1faf7af11c316bf11e79290a9c0983ed9114338eb893c2e67f43c31fe5f950a32
SSDEEP 12288:A0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BF965C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB18584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ccb0fba172daabd9b953333cf3650d5222927646636c0e1bd8ddcdb07399fb9b
MD5 4322f5917c8ef874a8eb4db574a07bb1
SHA1 8846186c529a882eafa821902714cdae5e35dbb8
SHA512 b14f0a07aa2aff29e49f29d7b36cebf7f2b82ef74204f07842441453d0a69414e8864c09163dc93a4c95df66f2795809c9784aa1551fde42629335790b70dfe9
SSDEEP 12288:kYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BF965C41CAE92644B5C3E5E10DAC173E5BE9200483BAAB7CBDF6B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 eab5c00132df7b4903a341419283338c894e489882ccc3344d87482cb7c571b4
MD5 b71602abebed4211618bdc3026a0b0a8
SHA1 d79d56822a609cbec5ee6ba679383b43faf7524b
SHA512 403c656bad161c6d86b5f3ae32dd9af9d86d1a278ad8a490809e2c6e5c7c79b3dd1efe7edac3a5b5c8984f0b97e53a3bd2e0194db9d8f43758b1d342b87fcfc8
SSDEEP 12288:NyPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kzypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A455125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6624a061903dd4d056dc396a55842b6886a0844198ddb18ef91cc54376c129be
MD5 2cfbb52839492b5541eb8f42172ab737
SHA1 e4c4b7bba61aaffa2049506f18fe78e81e9ba2b0
SHA512 83db30bc7e58fd38034e28073e86ce6724ac39f9334f226602d357002aa234c6edee21626cb623f01b07e2ce15b808cd4264ada16f0c8d074810652771f6c8c1
SSDEEP 12288:O0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BF965C41CAE92644B5C3E5E14DAC073E5BE9200483BA9B7CBDF6B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 06f0f465fd69670089343e281788fc0593ea38905bb01beac9db9281474f72d8
MD5 23598f7b4946e0557c8277006b1cfe8c
SHA1 ac91aa16569d2614d1c9b4d9e5163e5d4a07b20f
SHA512 5f650f3c2ab04c97aa10a7449694785902224592b2f2383dde49bbe19ebe5293ab27de906a0bf903e6814253822e372c279efc8024057658558a4151b433294b
SSDEEP 12288:p0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:p0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BE965C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 79eb3767327f71c6a134e33584249dfa6d68490feff6a51b39e2829c4b7299b8
MD5 a171648b53d950f00ec679d6e5be7a6e
SHA1 fb55ef1c4e0837d57047da9b58eecc051bffda54
SHA512 b903a50d9ec7aaa0af4d549974173b0ab76359a6e3cbd4c282623b4d40db598719437cac0677a4ea1319899d5987b2144016daab611446d4978f640ab03f9b02
SSDEEP 12288:PyPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:izypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11155125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6c4436948b0b6d299cc49cc2a3c996eb529930d3cb47fe21b4b6675d3650915a
MD5 60dacdaaa59bdc356dc8dfa5e13ff382
SHA1 7027b3dd1cbe8df9dba03595b0d0db95b9ad9edc
SHA512 a89ff51beb41d62d94084b30be0acfda7c1f22b5da45cee5059f5f6af7d28e7e0eb81b23a7687130bd67944695379ac79f9cc9559e44204f35842f3bedddaaae
SSDEEP 24576:cTDaLl3z0zDvsqjnhMgeiCl7G0nehbGZpbD:cTuLljyDmg27RnWGj
TLSH
T14A6501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 918b5586332a1788e19e930daecea7a59bc601bb62b1a039e6a35827e3c4ee6b
MD5 8dc5b7bb8d67abd777aa6d02fef81e0c
SHA1 037b5e428dc8e4244ee67b3c8814dc5a1579be41
SHA512 3fe7ae062d9f9edae9e0388da53d12288782673cfdf55ab4f3845716ca508619e2f3bc48d2da6db327a0ee33f7a416bfb114d3830f9c5eefe312af77a73bc929
SSDEEP 24576:13vd9CHKy7GZ7sqjnhMgeiCl7G0nehbGZpbD:Vvd9CHKya1Dmg27RnWGj
TLSH
T18375CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 efd5583f66b0dbb14f074f5895d74badd82105e7aa9a42ff3a8650b4b874c3c9
MD5 bb717858e1fb666cbea374b52c92687c
SHA1 31acd5ec5a8eb5c4e807b823f4fa6ad377838539
SHA512 9054bc395e95c3caf74afbd65c0057490d2dac4a5a41f21609fc6d9e089008c452812b308f2e20d9f595fbf914c75764379a565768121fc561d6228924659a93
SSDEEP 12288:7/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E4523BE965C41CAE52648B5C3E5F10DEC073E5BE9200493BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 015711609021d29b4cafc50382381f4348a0017cf680e7813ceb0808228c203c
MD5 8e59fa817a92a928ae3ca44eff2c6d8b
SHA1 e4c97543dc8a64871d73e57a8795f9f76cbf74f8
SHA512 9301292b67724f79912c970463d5bc29fbad5085a27af99e832ae17cc1dde8683bdb38d7c58792d2e648f7831c6c8ac9334b165f9464d7335f888814c59f71f4
SSDEEP 12288:ZJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BE965C41CAE52644B5C3E9E10DAC073E5BE92004937B977CBEE7F18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b17485f9f7e9081928c4da6d0eccc63d7f084c634003a60e5d26d294c918cf04
MD5 1efef250914b0c535ed1c6e1a813b233
SHA1 0dd81115385604424cafc0b6a707b3041c61eb32
SHA512 ea9c7d1e23fe9b72a80043daff7e9bbbaaba1f721c828f9dc5ee4677c0d1993fe9939e131a9082c6d3ed5c2301ac75e9a0d99931a148a01975f1964ccfa4fc98
SSDEEP 12288:dGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1714523BE965C41CAE52644B5C3E5E14DEC073E5BE9200483BA9B7CBDFAB18584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 be3f9cb7c9949d6220566fbe961899e97bb78af004b5c56e99375fdb00ff79cd
MD5 09169b3a9f80234c7026cc8137c67698
SHA1 03ebe9ee4466822e94c8e3516a6668a926bf4b20
SHA512 47d5979b6eea2a57075fcbe76913eb2462a5e3d1996fad64807c6ff76f05b474735420e1942828bf1ee28ed26daf8b2fb221846f648014cecb02ce45605cc4a0
SSDEEP 12288:c0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:c0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BF965C41CAE92644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 003c2764d833936580609f735881bd9dce35fb4b3674ce9297ec9cea8b08823e
MD5 6f36d8b3c4d8357df00ff29e28ed280e
SHA1 8c904de4931f1a878bbd47f07a413199f69dfb67
SHA512 943d31e2f1bd5a1187954e0303eabc92dcc350c79a6bcae83c30a2148aebbea84069cb775ceac45591f0808b0ca80599fde494884377ffe7ea3ce3ad3e382d8a
SSDEEP 12288:I/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1394523BE965C41CAE52648B5C3E5F10DEC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 adcc8241cdd2cab5efde5fcb568fc2f1d03d04b562a13b3e5d3c0a2c5055d841
MD5 6f2c4a255b06caf54fa640af7ffe44a2
SHA1 eb8799356678a7d4beec1ad12e43e2f7e550b702
SHA512 a0fca6233900ff26b6d7d54bd4ed38369a766ba7d511edebe9d65fc30f8be3a39781f81b2d74848ef757526ff4c08dd0b7344e52769179bc7eedaa325ed6070e
SSDEEP 12288:ScXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEQ:ScsqjnhMgeiCl7G0nehbGZpbDK
TLSH
T1F74523BE965C41CAE92644B5C3E5F11DEC073E5BE9200483BA977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 cc49f2d5db22fd185d873012e7ae8abbdabec1bfb672612cfed32f33b99da8ec
MD5 a8c837dc4496c5056f2ac3889043b0d2
SHA1 c15fdcc32d19b5772be251fbc8d6067fdf2fa1d1
SHA512 d97eeca2c9c09ed6b55d46cfa5ae9e6975a1bf98d5e737f33c975d5119e45b2f23ef5528dd5ced6c0ba97e8a51544bb173d14bb59bffbd03a77a93f7b4628551
SSDEEP 12288:H6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1644523BE965C41CAE52644B5C3E5F14DEC073E5BE9200483BA9B7CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c69e9afe3633867fe89ccdd438abd6ebd6d57b3c24bbe23abe009fde47c1e354
MD5 685fffca89231cf38e7d9a6f4386020e
SHA1 b671d8ed6b088ab2600f69a9650cb930cca71aa6
SHA512 96efc51a4d167ca75df70f1baf4355e133e4284287c629fb59ba312ba8dac10e7528cdf8f1332e4897d7e734b6224a6120a3e55c6c7cbcd7af87b95c0eb3b5b2
SSDEEP 24576:efwvUk9RX6wkyAIIsqjnhMgeiCl7G0nehbGZpbD:GMnYI0Dmg27RnWGj
TLSH
T12585D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3187d4da991650d05b217d0636f41387ab617ab72690d209edc0a317b1d4e7ec
MD5 cacbf3323b398700dc6b1d749f38b0ff
SHA1 5286c02aa63f7682dfc3b7744347bf48b3e6f918
SHA512 d1015457437029f24f5eb10770fd4783af0ad3822a1182c1824d9145375bad55f046276c9fd2e5f163e5d60599ebfaa6f971f11b6a2ae139f4791a05c4a52298
SSDEEP 49152:aYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HDmg27RnWGj:hySzPvD527BWG
TLSH
T138066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 429a7aeed94f5d33cf24ee60b33f7c77698162e4f316706b01468ee20bceb70b
MD5 60a1663adf0b5fa93c0e29906bd3517e
SHA1 d841b9096c8772eab8512fe2b13a9f083f023225
SHA512 67e704e427587d3b5e988b4c9f07db43cc54f193caab9f0dab5471cf934ad1ed70f3584a994abb64b0a0ebbe5ea6f69b38943c731714690294ef9530719d038e
SSDEEP 24576:C47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY1sqjnhMgeiCl7G0nehbGZpbD:C47JUQjTirIhCnDHUPfF/3Dmg27RnWGj
TLSH
T1D165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c7986f9e71d70b80dad8ffd18c98fe9505203fe58139045df221288d9c580c1f
MD5 27514b34d503ca7b10a1bb8f67d1a8f7
SHA1 6388a1707031837c33c36102ff4926c112b5ac0f
SHA512 7274505631557c54665d942843cf4a7261a09dd8c3713d7c51ea0703036e1caba878ba3fb9af8ca1d8e2dc75948d5203f9d450aa204133b55c8a75b02b67761f
SSDEEP 12288:1bsfEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11055015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9c6ff1a9ba669fb7c404ed2a373e26ab8f33d61bf632b22d1c7d4789a5cc6ce9
MD5 3d365beaf22c590f23adc7d9b6eed3cc
SHA1 e99649f28a0e9121f20aae2b477a7663cb383d23
SHA512 f360edacf905042713012a76fcb239585a4f78b0ac9ea08e74966b7e148807eafe5e74b1cb01c990b5629371e9bc400e764b3e824ec0ef788eb66b857da6fa98
SSDEEP 12288:AmkEU3f7n6L2cBcdEXwtxRRWCKXUrqpo:AmZUPkZBGtdzKXMqe
TLSH
T10B452841766BC75FC6A940321E32D2CCAB707D01EE456B0773C9873ED576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 b9cbe05d5384a91c65a76674f060d0d1077103e4e085b4325fed14f1219343f5
MD5 833d8904b8dfd9529f643416d830bae6
SHA1 84557656eb34f6a2fd92ab3350cd6b0a05aa02ed
SHA512 2c91e1151152aaa9533b84644a831d361474a07590dd94287d7f86f7e6ce6744eca7d3b67d0add96262f086a4492a0546efd802fadbd703bc6b0fdb33d170bdd
SSDEEP 12288:EdLdo0ffCttblbQlVrL4Qy5zT4lW1JE7t47H9vgnRU:KffMtb6F4j9vWRU
TLSH
T1287509819537A38FD1FB607207265F4CBBB4EC0677096F2673C84539D82AB25A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4c6bcdc696b1e836f23aca6a47e41758361a0e70d6b5986bf8c0dbc4da09e85b
MD5 3810a14560852a3dc49483efbf284291
SHA1 145578d30e47204f8ca99b604b987b0e0f36ebf2
SHA512 28028cf2dbe7430e3880e178d485a1fe7b8596fdfca979e1257138fac077b42b0c56b5df6f4ffb87caa166a086aa561673cdec3a91fd12a1e192be3f2661eab0
SSDEEP 12288:607sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D545237B934C518AF93605B482EAE12DA80B7E669F1044C3BA5778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 59e10351bc237814015363e00b4aeeb0a311774ac79429a10d54153977da971c
MD5 ee96578fdc4cbf3f694403aa95a82197
SHA1 8831182a92398c04e530e3f3896e97526fcffec0
SHA512 f3ab5de5050443026d9f76de16d133a68b395b4a0cac1b048774032f109779c1a8f916b995dcf4e4162121910a1a967e93ac289ec19516f3cd6006ce4f81a081
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYesqjnhMgeiCl7G0nehbGZpbD:ygb4mBIBhGFpDmg27RnWGj
TLSH
T14D659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8c60feff0d07ac0c6869f284cc79c78925c5cd2cd483a883ecff0bc2d848f0bf
MD5 9c3975c6c2dc736f29a1002977e30973
SHA1 829f509b9f9f20bf8042f8f0ed2307be67807f7a
SHA512 fd3368bb1e59a808971ef22c1587a9c63dfce5c402d146bd09dc170db06f5591f668ca066de926dbd722a3215160a6657e33b048a89b43182703a6e9fe49e97a
SSDEEP 24576:9G88u8FpJqH1bzria7/mFsqjnhMgeiCl7G0nehbGZpbD:Q7ZFPqVea7/qDmg27RnWGj
TLSH
T1B585016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 942a1182a079f03a85c1cefe6ec4b5dec12a5a19d5d0b856145e2c5bbd7645af
MD5 35894dff1b8c23e300c1885210ac3362
SHA1 2ff05e9389229e0b86201ca148d4e287d7fa959c
SHA512 f086377bcca9b90df1cebdce9ac1836a90e6028f97e9b61174c33e5a97db43c3ee9f78ca41e01230d168603db378cbdab7df4d28493baecd6536729d4f7cb404
SSDEEP 12288:MHvUrBFrEjwaQhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:MPUr+NQhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E565F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 79b3a5666a8c872247cf14ed74c4edf158adb15d23c750a459e3e1cc362dff47
MD5 81e09268b63c5679bbe406c509369b6f
SHA1 759415c1cfeb0a52822277c550575a440ec77b18
SHA512 4010f19aa7cc4e617136ddcfb6833a9092906ef2fd103ec8157678440f6cbe67adf1bb650b5ca4e0cadfe04116e1f56a3c5844fb6a1af9e4e94a49f82d2deac3
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFDmg27RnWGj:2G05lO43bsD527BWG
TLSH
T14DD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 955040bafea732350301538a3e98118148c56c822a464cae7b99ea4dd9364c47
MD5 353e07076df527f0da55a72eceebe1ca
SHA1 d5562fbfd9cb2b7de30d7fc782118436248640f6
SHA512 ed463bb334842cae2568e6884f4f1adfb20283f2e13e0e0f06d03f503db205440db65f27a6ce0a1f1bbed80e2739699cf340922e033698c1816d457680ffde78
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnDsqjnhMgeiCl7G0nehbGZpbD:xa5POZ3BJt2pasx2+mNDmg27RnWGj
TLSH
T10065BF5EA3FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0a52e690998ceadb833ca8c11ad3098d78cd1a690a5fc0b8bd349b4f5725a8ba
MD5 94c78f5fc0ce5cc080982bb6e65a3cd3
SHA1 59f7ae7aea16c36ac9c4b74a130cd9dee1a90735
SHA512 5db509dc768860bb9a1925c5c2df5243723f30a2ee8aa2b9596ddc4d5efb75ea4e54714e92938f6ec211cdfd8161a6328114325af8fea50bf1c147f80d8f8db9
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7Fk9sqjnhMgeiCl7G0nehbGZpbD:hNc/zEOVHFKDmg27RnWGj
TLSH
T198857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 98a9d681a5d6c32f55ce81ea85fe7c0388ea6434c6ba5ec5ec5744a52edba114
MD5 7c5f5606f07eb1abed1b721064fb7a6c
SHA1 0dc57eef4accd0f49a808cb587eca28cefdc485e
SHA512 302ce7891a47af7a913764e36f14398aa66999f899a40cdd18e5b12e55257de6a31166fe0aa087b8c2c7bd0e90f462f48d1c32eb1f26511de46cc254964c1a82
SSDEEP 24576:xTkNvNnaFeYhJNtmZBmXsqjnhMgeiCl7G0nehbGZpbD:xTMwBtOmrDmg27RnWGj
TLSH
T1E555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4d3c68bfb33efe9bd7747b4bb1a0cc3381e8410c305a21673a5566713b1c09b0
MD5 c822232b2ec49b9c183e4caf08526c05
SHA1 8b8e0134c7594a7687a97c73175a2ea830901ef6
SHA512 0b313c7bce56851d7c821deb35c09f5595d1e7e86cc9fea658e90e2c5f171c08ee7dd2491aec8dd995b5f68183a71390b4e3f7fe22d995a65226ba3cdb7d2173
SSDEEP 24576:eD3FHshBIYQgAgsqjnhMgeiCl7G0nehbGZpbD:eDVHeBIAAcDmg27RnWGj
TLSH
T1D975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-63-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/872-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/872-260-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/872-65-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1200-278-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1200-75-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1424-303-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1424-112-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1424-106-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1424-104-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2628-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2628-59-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2628-222-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2628-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2676-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2676-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2676-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2676-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3248-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3248-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3248-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3248-13-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3372-78-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3372-1-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/3372-0-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3372-6-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/3372-8-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/3412-135-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3412-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3412-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3412-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4160-318-0x000001CBD5650000-0x000001CBD58DB000-memory.dmp

Download

memory/4204-99-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4204-304-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4204-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4204-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4204-93-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4204-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4704-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4704-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4704-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5544-117-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5544-123-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5544-116-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5544-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5544-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5804-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-86-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5804-80-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5804-79-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-320-0x00000000007C0000-0x0000000000820000-memory.dmp

Download