520de970bc0f0a040456bb6f2854ca0a4f8f62749220f635c342c87154e21a12

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Size 2.2MB
Sample260822-k3afvsxta1
SHA256 520de970bc0f0a040456bb6f2854ca0a4f8f62749220f635c342c87154e21a12
MD5 a15e985072d4e1e621328f04a8a42c2a
SHA1 c87e10d905110b2085b9125c061fd0c71d3f2bda
SHA512 399da371f24a6d971a93fdd9aadc87a645c0c44aed62b7f0c23e0765704f17d120006a15fff73b10adde5db0bbccb32d76eb9b15b4a0632bc1928c6f6c4ae956
SSDEEP 49152:HtCejjt1nAV97yKtFnFK2dstEPObWjBqLrH9pLDmg27RnWGj:Ht7j2AbJT9dD527BWG
TLSH
T13CB5BE42A7D340B2FD866633112EA7139B39AB094313E5DF96A03D7069712F35A7E2D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5704	elevation_service.exe
3040	elevation_service.exe
3560	maintenanceservice.exe
4856	OSE.EXE
4272	PerceptionSimulationService.exe
4144	perfhost.exe
5748	ReFsDedupSvc.exe
5724	SensorDataService.exe
252	ssh-agent.exe
4724	AgentService.exe
3884	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\M:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\T:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\B:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\G:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\I:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\W:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Y:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\V:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\J:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\N:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\X:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Z:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\R:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\S:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6abe7f0a5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000195eea21532dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd9deea51532dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d05c0ce71532dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f63dea21532dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d855b0a31532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b945aa31532dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045e7c6a31532dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089f68ba31532dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3c842e71532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5dfffe61532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	4724	AgentService.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5748	ReFsDedupSvc.exe
Token: 33	3884	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeDebugPrivilege	5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	5704	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5860	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 5952	3884	SearchIndexer.exe	100
PID 3884 wrote to memory of 4968	3884	SearchIndexer.exe	101
PID 3884 wrote to memory of 5408	3884	SearchIndexer.exe	102
PID 3884 wrote to memory of 3960	3884	SearchIndexer.exe	103
PID 3884 wrote to memory of 3880	3884	SearchIndexer.exe	105
PID 3884 wrote to memory of 4668	3884	SearchIndexer.exe	106
PID 3884 wrote to memory of 4216	3884	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4272

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 935327f61075b3f5a1c617a05c7b56df8212de475a0fcca0269b33f3826530a1
MD5 b4f0a21a0c8cc15c1f59cb1b4ed8ba1e
SHA1 1eebae8b84bb67f1734f884b6b35878d2e1f892e
SHA512 b648f8c1f8f4020562586e8075522546e57b25f8d53dc1f7d5ae06436d3ebb103f7c079094ac8387af441834d9eb4b3e99be1067f99d86917a5c34196c0eb89f
SSDEEP 49152:zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4Dmg27RnWGj:R3q6sjBXD527BWG
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 9e200418dee6dd6dd690a277eedeed3dc4051ec2359a2134cd3b76028d581fde
MD5 8ee600d574799df6c32cdf594a9155aa
SHA1 c0754f7f584f9401a932687d9c76f5b0c329c5b5
SHA512 fbde6a95cbcd22cfc9cbf830cfefcfaeb39726d86113e43213a43b8fc422cadf6ca65fc75e4c7d79a0df2510c43d003b26b92035c592e60a9ab9825c1bff3c09
SSDEEP 24576:yXYfDtczA3sqjnhMgeiCl7G0nehbGZpbD:ZtcqDmg27RnWGj
TLSH
T17385F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 35334e7123297acd2db48f40c88ef4c3d4034caf2a14f20a2246b88a5313af08
MD5 f8f5ca27dcdfa3b909312ddd3cdba3b5
SHA1 6b90848cdbaaa7d024d1993c4b786c0da180719f
SHA512 ec95b045fef76157f9c071cbb40865aa6d48beb39b1400d0714894951ce132d027c1e4af148c9bb48500c5e3bb88d0f1b72f809b3b3eeadb79d1152e4acada38
SSDEEP 24576:v0Le5ji0hmx7rMEsqjnhMgeiCl7G0nehbGZpbD:vPji0A5pDmg27RnWGj
TLSH
T191959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7ccdb83ff70b3cba0645b9b972d0dc095835f7b3ac5d129430e632a09b91feb6
MD5 6e7846481bf47098dff02977d670c63c
SHA1 7e5769f4c9f638e48ae337e28e02c398e778c3d3
SHA512 f55a3b8e62d0f52fa32b47da6a1ad567f4299e04f0284f0fdb1d6dc0ecc5979e62ead2cf1d9ce7041f7e8a41f2288963eff1586d8a30193df965c8689de84411
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWn6q8wyuWsqjnhMgeiCl7G0nehbGZpbD:R/ezSC6vUzPveHjy9Dmg27RnWGj
TLSH
T155755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fc6e9d65e2865311d352bdbc1a793c1bffe313986be940bf529ef1913b644f7e
MD5 24a0364020aa125a6b203df52ce4a55d
SHA1 1d46d9228184f6090e4146ea6a7ce2167907e7c4
SHA512 ffba5bb756cd9cae8de34dd88ae62f946d9062fbea7133a8742cb95d055bb013b5c03f5c8e8db2dda073b552fe184b68406e8cb09d702a084fde5e45fa7afc21
SSDEEP 24576:tVbqPb88hv/l+YDsqjnhMgeiCl7G0nehbGZpbD:tVO88hXl+SDmg27RnWGj
TLSH
T13A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 15c3290c0ddbf3a423ff3647b5a44a45af929e7853b3ba4b446ed07eb3a35cc3
MD5 03489e23b3546caf748ca760fb1b1a3d
SHA1 8effdce59b39522fdf196a2640a9f37d33d5d3f3
SHA512 96f86ca676db9f4e974f6dd1f2dd83ce3dc9cb8756c57d180279069bc90d445e3b1805f0090c7fbaf03c3fa1ca71f5e60e257e9c252f9153775e1d75c1545329
SSDEEP 12288:D9QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D9QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A6523BF964C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 0ec852419bb80a562a3670378932a3b69b4e746a5f2e94db36b5a439dc8912ce
MD5 369aeb2e781faf8e4229651aa3b31d35
SHA1 5d4bfd86926520bae8ff734d29c8aa779a6ae84b
SHA512 c94f1bb339967e42aca7bcc9e46b34cf2cd142077091b45a5a666e077acb6b96cd8543740aaabf15adc1602bf71b666c3becf05bea1ad6fd13d3052a63bca17d
SSDEEP 12288:qeBNUbTVO86U7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:qJIU7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A85CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 755b781e6bcfb84a18ea8e5ab90125242e6c74e58441f2ab5a1a6e2d05ff8c86
MD5 7cbcb036cb03166afc469954addffd79
SHA1 d1f47263a35a81655210c0b22be5ac128e5fe88e
SHA512 0bc4fc3c4df6502c802bc590d46661f3e17c81f61b48197e27f219aed29e42b7d905a09932a1d6f2ad2b2c2d4e3a9b092b9d9cf041bb8e22a9eaf84fef6fac39
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THm:AQvGAdlCEL8c/DRNw5CKD527BWG
TLSH
T18F266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 b276e85afca8f17088d0aa85620de772e1d4b4c183e1ea508b725c6485109124
MD5 e2b8a5c5aa7d96fdc24235887e9365b3
SHA1 fcf1ed086af5ad8af0962fb258d8bf48a71b3e69
SHA512 2b04ad89bad7980c47c437c4f4bc2c2259f38a32ac4b4329b84d5dd6b03dc48be4e5d6fc7160e26e7cfcde08e35c7279bae01a132b66d44551018625e9a2dd90
SSDEEP 12288:sAwSfxL/2Dc3DDLLmt0LDQewsAjlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:RSewsAjlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A585E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f531fd7e06b295471e970151d63f824671833bb04c84acb249d59fa36eec6877
MD5 62e78a8e94be06acac6d2c1b816f00fb
SHA1 31f45da596718744b1bb438c07a3c53d5f981d0f
SHA512 91600e7406b91d1ac23ebee0e0db0c3ebc01a97a1f538408fb4eed58e91e24847c7f86b53bf0a39e3e7b05bba1b8f930531a188f22c9b82650bf798c95974c22
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHRVQBWG:LUEtQevvqc2W1cpV2tI32cB
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 89287256487e3dbce4c35a714d25a880c7e5d94462c36da02884905e2712a2fa
MD5 26dee2f03ebc03506a9f1d9a9f5d4f49
SHA1 fc4f7067058dab4e717fc5cb8e829fc83722b12f
SHA512 63749586d17d0adaf3f7c3026c429c4b2573c3da74217834dc25687eb04f28fc87bf65f09f853d741ae3f723edff7771589a7a1d280b9bb7bb29572462d1c746
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/z5Dmg27RnWGj:9oquVjnmuD527BWG
TLSH
T1DCD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 380b35e21232e67081f03e640650d9c157ef9a0f92b099a9d7b66d21e4c78ecd
MD5 049cfb4cc71b0e2505656f525b9baf21
SHA1 64e37409e9ea33f12f91ba98746ac65be6a845f6
SHA512 290ed9ad5aa985107ec44ecee6a2522a88f92d126c1ecc0482d8ee318a55737b8fdbe73c6bf33d063fce3c26a67993451adeb87da947065a376ceb9c192e421f
SSDEEP 24576:kAhGL3IFoiwtA5l7S536sqjnhMgeiCl7G0nehbGZpbD:kAMUFoiq5eDmg27RnWGj
TLSH
T195359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 6a4a0de2c749e89706e13a708ce8bf8457538a938933f5842670decfa04579aa
MD5 4cbab47c7feb7a1df3cc99915502bb9b
SHA1 15111d2bc4e1be4e82507047789be6bcd002095b
SHA512 5ea5139782edc83605ee4635d81a469b9eb9017839749260e221dd04857d53ac163dd45c3f49be5a18995306f9f4cccc7852d03d3624b26b02357e5f719655ed
SSDEEP 12288:mmw5HEjsChNPBFgl0WDm+C2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wuWOWZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F85F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 a0edb592ce781ef973e14dc3139eb773fce532501f6ca313e2d05055ccf2f361
MD5 db568d3c6e816e49ee0fb68a9bcca19f
SHA1 6604c876ded3c9a01d26eb2bb140fc7591c18a9c
SHA512 844d86fc7cd80624359d8c2145acb2f807f1e58b324c482a7d931a9512fcf5187bf19ab47eac83236f1423e94b2aadfb1fa1ef5b33fb6ac619284478063b0987
SSDEEP 12288:Z0Z1IyVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GZu8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1557512AA239820FAE163417CC5E5D609E7337C62673003CF166656AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c94e2af54a073380bcd567c55fe035f9324601bc65902203e4e821d0f8d999a6
MD5 5a70d123a00ccd749250337a3ddf377b
SHA1 3ce0c2dc577425a6698bb79137f47d6553c60017
SHA512 2cf170f0d88d03a8ad2d161141195e79b88b06bd09adc9a552f0acd17cda3559ebc1f7be81c2d252a88f73bdfe239465012474607b58f94770a147eaae61e9bc
SSDEEP 98304:qQRQyi36YOcPbLvw2gAf+PN3TD527BWG:BQyiKa/X+PNjVQBWG
TLSH
T140667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8416e17f1d3f9d665bcdc7da9b681a00cd3c52480fbf7ee3afe663c62bd493db
MD5 fab833336f52a66af4f1d34711d065c6
SHA1 73d81b52451ec169b239ac76838bd30e862fb4c9
SHA512 9c9190216a0bed760f2782a25f89e8facc3d69eb25c4d6a6dc170b16dd46c93499eddce64ec39d4afd52864b54c1659d200aee5cf3b78fac2ef185759f58e894
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN3TD527BWG:TQyiKa/X+PNjVQBWG
TLSH
T1BF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 62ca39642105d5aa1722b819268be1ec1afd3a600e6afcedddab3a0c4ffab50d
MD5 a5c363d3a34e58e4cfbfa01763ad6b6d
SHA1 90e869179eb8f7ad358a69f29c2273a34e46b638
SHA512 f2d9ab3aeb33184c10d42a94c5b1c2e3f0575c56f326b0a34b9e7ee358ca1a46fc08a2ec66fb353b880a32496a755a387d67e679a60d05feb164ce0edc9773df
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0MsqjnhMgeiCl7Ge:868Qg55nhceWu7PNU3/pDmg27RnWGj
TLSH
T1C5B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e737a9980d68725b11ba98c23b4c5119a8d78181ae3f971d6035e1905863853b
MD5 72a9a2f1909da5da246076971ee8c7d1
SHA1 87edb493e72572eaa58671ebd020c66c7228fdf8
SHA512 4113917767da9837430bab8aaa7282706df7ebb733edd8d2a41de708cf75f4447ba63bc52b39e830f3e5bfdc91247ca843868acf8603009d2996afc53970df8d
SSDEEP 98304:my5112gYy5azzVvt69nLKnhZMD527BWG:XLIHEWhmVQBWG
TLSH
T1A2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a3e69925c4767433a74abf28002d3a557ec8929da6b026b86e7923da31f4acee
MD5 2c05ef6a06ba4c20b38e49b8faf12aff
SHA1 8becbe1c988e53fd1bcf4afbdf154d3df77ac70a
SHA512 a1de1c0bcaa7aba849c911310e50f8a3b7e4f5d089721ba08ca5c02d6fad0645493ac359a10d15ebb8c6faaa1d78ef017e33f957e901cfde1df10f476d4acb6a
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glbDmg27RnWGj:zu6Jmdxd2dbD527BWG
TLSH
T14FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e9d3e23c03d230d20d3820c3457a508981ba54131e373b8f1e2dc4416fa9988b
MD5 10b48f12d374f13135aebaa26463266c
SHA1 788aae9b4f0c6a9ffec3d197124e0f06b42f89a8
SHA512 e211556f8751891cde974525c3774ff149d63247dcba8e85b97644ae412d694e120f6fa01de580f4ca238e1ec36176e64834cd42897defbfed8a83d89e7b50de
SSDEEP 49152:Q1hpsNoJpF1A63U44CwH7R4xPDmg27RnWGj:QmifPWRuD527BWG
TLSH
T1FBB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 97c7aff885da2f6dde2eb912f21bb7575a5e6e25e71a6aac8b62d435c3a1079c
MD5 d26a9ffeec80eda6337a228761a69c10
SHA1 7047d5a6f6835409498c8f542d70d8317bf5cb68
SHA512 742c10c7611e022c3a9a20b85f57d3edbfdff734f1d778a87c2840a6623820d67ae7f76898bdd9625d1fecb6a8a6c86030cd6575a102a8ab71ef063ea2e9deee
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqoDmg27RnWGj:a5dKii61oD527BWG
TLSH
T161C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 66bdc14b4b7ce213ef908b27ad4a3f501c0425f137ee9b90d09c1302ab4337ac
MD5 a6110b40519232b857785982c5ffece9
SHA1 f28f7227f0f8e904288a285e291b7d9219b5db1c
SHA512 9e4b91d316344f2303c3ab475eb50ba28518dc69eb9c6536a6d314f633c34941b872083b179c9a4fb48d0db154530412afd25974903ae94ae4decf5817a1afbe
SSDEEP 49152:GhtSn8EApI0fig3giDn0AP5wLDmg27RnWGj:HX2imphCD527BWG
TLSH
T10095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9e465c7f5a2283886b14e520c50ad95e0bd7f2c846a61a6f50351b7efd39cd86
MD5 fe7193c9bc72de3665696c62aebe5622
SHA1 64fb8a9e06d9cf466f8c36029a18dc75d80b4388
SHA512 38926390b594ec22bbadafd718966a7931f0694134ee2800c10357cc631ec0cad5af8f493f3b14236b0aa61fb995bec80eca51a9cbef6fc25ecd9e49c2b556e9
SSDEEP 12288:wIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A26523BF955C41CAE52649B5C3E5F10DAC073E5BE92004837A577CBAFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5e1594a0339dde8e355d537cda3099a64394b2fd014dfb6e755ac4b921d41647
MD5 ff04bf46c80e116b82d94815203aa07a
SHA1 0af58ebe97835716fd7087f2f3ec4cca036df051
SHA512 f0a77b5ac714af25ee0d11a38d3cade82f5c4dd5a0f1b1b5edf70f5f0ed964b50f3e4085d7f2eb4ec419e8ec55f5c32f3b3154576621d3c6fac6c051907430c7
SSDEEP 12288:/BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1896523BEA55C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 726917d702afccabbdb1e7d9190ab8fbca738b7dce72e05b0b7db8f5e6ea9b03
MD5 b09d64bea7a32ba2c718e5dc9240f735
SHA1 4fca0ab12e7f70a925cca194e4bd6e09210f152f
SHA512 57b9210b85d1575af079efbda37230708a95c3e261755d588cd98f83351f87713ded96f818453419410537c567c6b9733f4f5de016931bcef6de04e51a87ab52
SSDEEP 12288:BTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D76523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 46557d919576a3d01592fa66a0dd30d018b313b0d5237a2acd8a4ee7bc2dbedd
MD5 cfbfa4ac3702770b3cf5be5836f8ba69
SHA1 9724282c512615b9c1ce2b10865158a4f9ef0c8d
SHA512 064f260bc6c7df929f23fb7518e1b7ca7154d545da272d51161be8199ab9680ddc7c58e615ac4a5f5dd0755bd8d30860ab43cc6c0556eb295ee4d516a6131b89
SSDEEP 12288:rVaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE65236B675C01C6D83285B4C2F5E11DE8237D96EB30059B6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 586ac2ab9c68ddac8a431bb5b9dd1cdaf6b6f2c489c451b67447c85e795db3f2
MD5 9ac3e2a8b8d09536a26ab56db2888f16
SHA1 19d6adaf1cd0f04923b7ba24ae1abe3b3bf0b9e8
SHA512 06b730c61e8500ec44e9d1de5c9ca75ef42a93390e7e8a33edd909fb683280f6f17cc3f6e471e77eccbf74bcd06b683beb8602f5f0dbc416047a6c827bf463ad
SSDEEP 12288:qCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1376523BEA55C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d95ef3925cdc228a1f7186ccab3fa69323f4e5e181649b8305b8e63822bbcd19
MD5 02f2b6d90f12d7b1c4c533262b5b688f
SHA1 8c10cec4cf62f343ca5fdb736e77137cd3a32e45
SHA512 0af52e7c839ffaa6d0dce939a70dcf91e0a3881001b9d5b1829c767b055378af8130b35f85639f23104fe62d5cef1876e473601eb2ecbb4773a56131b2545d23
SSDEEP 12288:QdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB6523BEA65C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0709e3f0b1f8ce408b0c1447d6b0fa505460278158ce9f9db3169f48680e2485
MD5 7d09f25ca62e2d74898e8dfac49ef424
SHA1 8c1654f822445364c89f9588a70ba611daf809e5
SHA512 1a1fcf17e5ac7670d7404b835592cbbd2bf890f4478543648ccfa3e1524d8265f644c0fb713162cfbbcc34942468312a04bbf53b5a65b0ac9ed0d5a633a0b173
SSDEEP 12288:cpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B76523BE965C41CBE52644B5C3E5F11DAC073E5BE9200483BA6BBCB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 cce415f635ac8e138519e0beb46f329f94283d20a9ccf5a050efcce3a58bc820
MD5 a8d48d91186e3107ddb325f745e99fe5
SHA1 80db289362a439db30d1067c95648b6c90182f12
SHA512 28248dafb0d81028f39fe121a22e483f4b6bf64fd259c549fa3b82cb033ebd4f1f99aac6c590718ee81f11b245d21a71470c376f170e76485cddbd2f843bcdb2
SSDEEP 24576:2ZMrzFVSOhsqjnhMgeiCl7G0nehbGZpbD:2ZMrzfxDmg27RnWGj
TLSH
T1DF8501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d1454206a2eba13ec5ea7d130483eb518158fd5ba62ed1dc6ab3711e7cc7bc8e
MD5 4ff37048de6ff235f06104b65a321865
SHA1 4ddeb4c1429ae6c3ef587a85c45ad6be6df7e826
SHA512 f8b0775ab7e4cdf18238a11e0f873ee6702cd7bc4731186a3451b1098b9789e809e2f5e03a762bc7ba26b81c08974ea34fc38521062d710162ff3a40758a28ec
SSDEEP 12288:7sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA6523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 9bbde874cde531291ce1b832e6f979a2e8e549ce1d7ecfe0aa2eb1c452607000
MD5 e2228a45dde6169184f3891f64321dac
SHA1 0b1270cb63212e8f1e26928132300b68622cd41a
SHA512 91d8ce9e98e88dd689bfde5316039b17722052edc43f4d76ef8db07a85f794314a8189b14d125fa28485820d25c79346c7eea5d4aeb6e4c4672da118aef56797
SSDEEP 12288:AAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E86523BFA65C41CAE52604B5C3E5F15DAC073E5BE9200483BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2144bee5a402deb272af56180f084abefcc0aea7a84e3e9f05d26cba54d5244a
MD5 3cac8a81119be0d9a616bb4c269b5806
SHA1 94fa7b79781c577c171ed3a2e64f330df2ab06f3
SHA512 5516f1b4280e2e4e7f5b9a02d5b9f32391fbd0b165ca1a25afed034dc11d92604287e906dfde97b8d353b21655ab64b43a3839027a83b2aa6f4177e13d88b44f
SSDEEP 12288:pyPz5L8VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IzyVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16075125B73A530F9D1368138C5A29A06F7327C3647204A9F17A516BA6F736D08E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b27cd7d4906317f3fce11c71383fbb03346348fc9cafc5b980c5f0cf7bdc7a34
MD5 ee4777a9ce8b7a22aec4dc0e7f91a55b
SHA1 0049b2fe61905b5b36e47f4e1d156166bd53a509
SHA512 7e2b41b803dafb6fb9925ef8379367d4aa84a13fe62a5a09940352e44cfd73c4caaca23768e8021956dc1ac345e4a410a13133b1e27d886c9f08e868e524d62a
SSDEEP 12288:7sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A6523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 dbb56796ac9f419de61df3490300475db577d8cec5fb285f5c46723b23f8aa24
MD5 4d1ebc12273294d535babb80a442b601
SHA1 edb70d16ad5d7097bb8c087d3b05f1d2719b2275
SHA512 6c3e660ef39c781d166ce56814bb9c87f71189ed5f2f49d5cd90f18a068367354152b73f9cae0a3e453c7b35f7a3defa8fd88b3e2654e02815aaf9a7716225bd
SSDEEP 12288:/sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F6523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 aaeff5085416054747a36f38239ea09a260ec79335c1ddf4c8fc711da77fe144
MD5 01f81628873a4b2163828904bdc72ecf
SHA1 36a9935fe09b2469a7e6679cc01aeb817eb80b26
SHA512 6ebe8dae54c1dd9d8a8bd5dd6196675e6ae302b5905f6b9ce88b5c5b1893cad1de67105e0fcf8f5d616d57b2e33a7b5ed1a26073e6af7513ef2c1ce00a708443
SSDEEP 12288:LyPz5L8VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mzyVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E75125B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736D08E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 0b7e4eaf4aa43add96d2e68867252ec8c21a177238ea1aa9a88c38401c5ca9a2
MD5 1a43c3faa02fe8d41fac2be935eec217
SHA1 238331e6b1a6f7e2889e329f04873d72b0f02595
SHA512 b1cbe4cfb2ae0c0c590f16e188aada49ca8a65aa50d19419e6d1c662d93f3b7ee48305d55d3909b2b36a96c583f152405443dd2c30054154b9b01ce120cb75ca
SSDEEP 24576:nTxaLl3z0zDjsqjnhMgeiCl7G0nehbGZpbD:nTsLljaDmg27RnWGj
TLSH
T1B98501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 6d9fabb0da707a101947e311b32c051d817e73d4f7ea67fd1ce5dd4660e90e23
MD5 9613840ec0f6d611848a30a788249df2
SHA1 a4d3a5dd4a73b132b1851ffa0f583221015c55bb
SHA512 c0a1aaa29502ae322c719d1bee8d9bdf640e8becf06edb83188a2287b6a6ac8d35810d2cade5bc4b42e72f3fd1c686e1b39c918a34bd1222416fb44474cdd48b
SSDEEP 24576:v3Zd9CHKy7GZPsqjnhMgeiCl7G0nehbGZpbD:/Zd9CHKyaxDmg27RnWGj
TLSH
T17595CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 ed4da61944b70c8272442b0fdd7c718b29a7e7de56fd45e4ec7ebf61816e5209
MD5 b5352b0d8750731221350161fe271bc3
SHA1 2f4396a19987d293e0e41d4036695ff5d2e07ba4
SHA512 a7d42f7ff4980faf9333a24b65c21d29ea931eea06f679ff9c0f2d1f18da6a12ff416a452cbc77505637a1d8944bbaba0a733dbadbe68f28affbaa40715688d2
SSDEEP 12288:EzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1066523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 8d1a2429750e94cc019f855af58cdceac23dc9c09bf5bcde292b53a866bf7240
MD5 c21659413444963d878f4f1fb5a59145
SHA1 17ea30a7899d2dce4333c1f6d63602b0df3ece5d
SHA512 ebb9287bf732ee71dc69ed7121cbea0cdf5551b7ef5efb8df0fa42bc274ec8d9b99dabd39b0957daea81cbaf09aba7f771ae1df864a58dc80c86536781182435
SSDEEP 12288:g1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED6523BE965C41DBE52644F5C3E9E10DAC073E5BE9200483BB977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 0d556c1c3b689985e0d4565cfe8f190738003c0514efae4c787dad898a718edd
MD5 670f32f16ee1f256555d65c983d32d8c
SHA1 636fdeec6c58d8f977f2c8eac61f3430b0c247d5
SHA512 214cff8b66cc2ee8ccae6e81082bd52abe22fc62778d5bd5ff22c17a5d255b8b689d51c491fdab708c669f2e06d3d0f75d5a17ba3cfd71c4704632c013fe913e
SSDEEP 12288:8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8esqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F6523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 3e873cf3c08d8471f6cbc2fe06bd8c8205caeb0f6b3b0482868147e803e9ee15
MD5 4b83c12dbc068a0648d3e1c5baceb558
SHA1 c77d7ccf116ca531a5888c72bd2798ac28c37e78
SHA512 ac385ae363ef9a7d24eee629a8fd1be084f2c6ae2b5e0c95cd0f88f83b311ff08ccb6c9e1d1361a0ffe1982d1879e8f4f4170191354e27e7908233abecc40b3e
SSDEEP 12288:lsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1336523BFA55C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 dfad3f2c6e7af564f923acf2bcb0a02d9745b381081fb7d9838916b8759238a9
MD5 a283d6e228fc63e503fed4b10850544e
SHA1 1c1a5fcb5cdf9653f21adef0247a1e595f5864d9
SHA512 2a4f1b5b5523a9c50260c8861fd303864076c9ec69612d722aab82be4adbd11aa86c5f4c133436d5b2ae4eaf2ad9d6618e6fe1bea4e6404575f80fb446087274
SSDEEP 12288:QzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1926523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 3e53ac314b89cb401a4a13b94bd64182623aced6e13529a0d5d1e8ffc93c0b45
MD5 0221df0074645be9e45a1748cd2d8d0d
SHA1 058e5533cc7ef3b204834125d763ef742028b64f
SHA512 c21c92f698a2652229313dd0bf9396916ed96e42cedfc276246f6d60f261baac7c8985df23b69b2f6e8b2fd3b6ff32c64db7566e7c93fc695e3ab7bfe6754324
SSDEEP 12288:vUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D86523BEA55C41CAE52648F5C3E5E11DAC073E6BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 cbef681d8b71f530ff3de9046bccdf3ffc42e1b6d458f0d598c2aeff3d070fee
MD5 74ab387943c6a3fb251e358ab9b25e32
SHA1 3e27c785ab33122aab68b4a8871a66a66ea4d73b
SHA512 9f0b1492465ab40c9bb552a20133685fb2a39867beb60f2303d6b058029d89794903f8aa563a5f6d2ffb1b5907601c9b65e010517da0ccbb402ce4667b0b436c
SSDEEP 12288:wCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C66523BEA55C41CBE52508B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 ebdbea4221b0c4c9025375f62473895dcb49ffe2056a2c3760dfbbdc93ccec7c
MD5 b86cb6e5a30bb24812263a2343ff2d98
SHA1 1de677a1417fa6b1f3d2f0ab34f10fa4d80c2930
SHA512 c8341629871fb237a9a4a69862706ab0e8f9a5ef2b6a931e9f7fd85febc04aff2f03372a537b60cdc95c44209d061071183c233922c42c8676e9270c2658b559
SSDEEP 24576:Ufwv2k9RX6wkyAIwsqjnhMgeiCl7G0nehbGZpbD:CMnYIsDmg27RnWGj
TLSH
T1B795D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fa33c24f53470f096ee3a80e5d025bcc33752261d66225b5eb010b851d2f91fb
MD5 090bf30f086ea4aab3938fdd46236c03
SHA1 9450961252fc93f7c55f8d3ab5c95876471822c6
SHA512 f6d79bdd9fd31c517d95e3aaf38b5d6ef506f16a33b2425485454861b219a826b03e01094be0e4366a4934edd49dc574d12c56419f1b8dc448064f5f9f0b57c5
SSDEEP 49152:ZYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rDmg27RnWGj:0ySzPzD527BWG
TLSH
T182066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f7cc0073ed3e00e9ffff2b072b471fb8848c888dddd0881efff9898b1c311eda
MD5 f49ca6d0118cd36ed860015d5cb901bb
SHA1 96eca6d5082f5e24e19f1e304751f524959103e3
SHA512 07e8402651ec6748783ce4d20df1f0352c773f01b2775ce5da2205784821c3790c77612ccf75fed9ef47c1bd69c9545c101740613931bb4ca3de8d107be80707
SSDEEP 24576:L47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYRsqjnhMgeiCl7G0nehbGZpbD:L47JUQjTirIhCnDHUPfF/bDmg27RnWGj
TLSH
T14465AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9738e218e441d368c758875f1cc767160425306efb8c73e733bd4f7ab455484f
MD5 1caae606c2e006536ab5f7ccd035c17c
SHA1 d3cdc742133ae979bb1f88f89048165576df4905
SHA512 a4a908789ada87612f17d44997946293a53dfdee523541fd7ea6663d4102f5b76a4f631e1f4338fccfc7945c38ceef215893842d5037dd3a080849f5a6256129
SSDEEP 12288:BVsf8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D475011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 de88bcf31a695f182ea703f89b0cfbbd63c71eddb1f6442e3157437d9b3fc5ff
MD5 fd78d37441b4765a0ed2e4f47d245d42
SHA1 c75ce0b5568d57b2737218cf397492d5eea465b0
SHA512 3af010be221e055e6c9bf047cf7542b167b0a65e73984e4a212e605410ee00a44be94549995a4066d5bb903b14463d07b8af326d4166a5f61f5056e45fc977a0
SSDEEP 12288:zL12PDU3f9NZ6/HnXTehd4LOgQMTPtLsk7NdQ:zLkbUPCCd4LrQMTP9skhdQ
TLSH
T17E451641762BC78FC6A950321E36D6CCA7707D01EE05AE0773C8873F9576668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 e772de7d09cf1d6d61ad2b2487c4daac06df871e5955059a6a3619bb8123d7cc
MD5 4a7999b9172f9ff3fdac3756de50fe6d
SHA1 133525ae0d90a805fca5fbc69c495cebd8ee30d3
SHA512 4305053bd652a034b7e3b650c68683bd7f596ca49a76f2344a879679931c40bcb57fd6ee8f00d75de42161335220cb992e6992160b8d6cbfc6c339c4e73ef5f2
SSDEEP 12288:qpz4ulB2A/12v9JC9awa00tJpoFs3M1LVXTgsLGaWK7I:qpzcHR3TSxjgI/17I
TLSH
T1D345294164A7E35FCDBE9037033686CDBBB45C06B7463F0573408A3C9866A7EB5E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4802c2ec4cf2ddca53e04a7356f04315cdbef2bd3065b70b3bf9aeec927164bf
MD5 007413dc21901fb34cde9eb65e0ab34a
SHA1 de7fe45897ce0a64fe44c62925a4851f0805ca5e
SHA512 abb418bc8e958998d8fbe7f140b24033a2ea0aa28b4ccb7cfc68d91fcace5bdf8aa45a1251306dc0e66d62e5a3fbdbf8615aea3ef84e891afd61bd4070c554f7
SSDEEP 12288:TO7kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OksqjnhMgeiCl7G0nehbGZpbD
TLSH
T11565237BD35C518AE83605B482EAE12D681B7E669F1044C3B90778FDFAB18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2bb29ec7b2406f30f74cb478c27e91fa69a087622852387ecb52c30af7fa219b
MD5 7ab837a5a20af59faf765b68e46424ab
SHA1 2e8782000c5655058729a7701ce97049be32ec25
SHA512 244101ecd3ae32bdf51f9029b6c52944c9fc512fda508820fbde4a9072fa364fdd1014b0e851f059437a22be86ceb4cb59ed4c1e3079a0a1d756f9bf1e1fd31a
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYWsqjnhMgeiCl7G0nehbGZpbD:pgb4mBIBhGFlDmg27RnWGj
TLSH
T14A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 9205dba714f45462e77fc6749e2778621d38dda907e93ccbc0ac468d8a2101aa
MD5 cc36f0d70aef9e53c344d899e80cd75e
SHA1 df90fac4eb7daee2d419da0f363fdde8e45da10b
SHA512 ac6dded9c7d23bfb171e03398d857e6a64e9031a163b4360bdf67097089e9676082034ec66da0487154a85d952e25db725b015c635d412f7030c5e5fe3527f4e
SSDEEP 24576:rG88u8FpJqH19zria7/mhsqjnhMgeiCl7G0nehbGZpbD:q7ZFPqVka7/SDmg27RnWGj
TLSH
T16195016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3a3562da5a7f19a14ba8de94f5cf23a8049535be9cd94e272ff861cdee40eb84
MD5 06c41af4242a2cabd818ab8656c09533
SHA1 2fcce6df5ef3d310cb0058f49c4da78fd61ec811
SHA512 5589e8d5ac2ac54f21d3cd86cade7ae03d41912bfe3491cb475c1f2c7cb7ea04152766fe01b2ae0120b9a59633c1b1bed2bfedfb45b83953135ded12a1263f7b
SSDEEP 12288:eHvUrBFrEjwaQNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:ePUr+NQNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF85F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 edaaf30e82ecc1e0976ee4e132273bb1ba2d379c7b5c300101fef6f900cbac09
MD5 ec07ea9ad219dea59fb0fb0cb6092bd1
SHA1 4cc7855f0b7b41e062fe191af2428bb177d1d296
SHA512 7ed4ac51204c47c9d5e70cedbfa18933348da687045fc1fc26ca1c972caea70377f12760594901de93185d8f055ffb4201823079ec3afa8e0f479362d1d312cc
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBDmg27RnWGj:AG05lO43bkD527BWG
TLSH
T1C8D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eb2e1a4bac673b38cb5ad1abf51043948a8d6f925f46ba9b97c1ce9ed711edee
MD5 7ebd2138e636a5133536f242a95aab68
SHA1 b450403919b44edc709db54c3bb6a7a3ef8d8f04
SHA512 e5d00c23ee49cd1fd406e11227cfb5841e3a48d5989efe16da8d8efbd5d2927a379a79b947bc5b65aa42506c630cc3e70b384078120c71de3ff8ebe3d8dfa5c1
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXsqjnhMgeiCl7G0nehbGZpbD:3a5POZ3BJt2pasx2+mpDmg27RnWGj
TLSH
T1BE65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 99d95d949800fa7c4c7be5efc7907c44b2d9e1f8c7f341fe5a148604e7c5fb8c
MD5 b435c2a2484d4b0f698f633aaa4776cf
SHA1 b18234edb9a1831054b981349af7709b1e0cd871
SHA512 3f876f51080c57cb1273b731d7bc40551a02d5466c662c254a20aa96c44d107d30bb5a82cbdb0f86d239411ee1b5a9647236abf9be1a8e5a5c435d6d9ee75954
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7Fk5sqjnhMgeiCl7G0nehbGZpbD:rNc/zEOVHFyDmg27RnWGj
TLSH
T1E8857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3148271cc0cf19e57fd070814bd299a67e089be771f838888580ab21331ab6ce
MD5 bc603a57428188ecb1dd12fa59f12bd9
SHA1 ff2bae0f8aa3d4ce8c7ca4fc76cf10845a41c65e
SHA512 af186f8bcd2c0842d43a40dbc44a3b42ec8a019fa79f6835ee575b54157317b29878205979bc8cadf95329aef500f164ff268622d3d1408b1c01e500539dbb87
SSDEEP 24576:VTkNvNnaFeYhJNtmZBmrsqjnhMgeiCl7G0nehbGZpbD:VTMwBtOmfDmg27RnWGj
TLSH
T17455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 5e3e016b1871dcfc0aed9fd528639c8f9439bc3d41c66bb1f04b7076dbe0f4b2
MD5 49c15cc50aee862dafc78c52f58c5abe
SHA1 957ff74344fd827ae78c3549c3b03c9edb875cab
SHA512 8ce90509e9075284604f921d8c54b1e8017fe75bcd58eaa21ccf11924257e5835fd0644c491506dd0346447b4735a939b244dc6f28b3c25d8926337e7ac7b4af
SSDEEP 24576:vD3FHshBIYQgAosqjnhMgeiCl7G0nehbGZpbD:vDVHeBIAAUDmg27RnWGj
TLSH
T1CD95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-304-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/252-107-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/252-113-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/252-105-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3040-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3040-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3040-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3040-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3040-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3560-38-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3560-40-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/3560-45-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/3560-49-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/3560-51-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3884-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3884-308-0x0000000002FC0000-0x000000000325E000-memory.dmp

Download

memory/3884-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3884-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3884-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4144-78-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4144-272-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4272-64-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4272-67-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4272-72-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4272-240-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4724-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4724-120-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4724-126-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4724-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4724-131-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4856-206-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4856-53-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4856-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4856-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5704-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5704-21-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5704-20-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5704-13-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5704-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5724-100-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5724-94-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5724-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-305-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5724-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5748-82-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5748-88-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5748-321-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5748-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5748-288-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5748-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5860-76-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/5860-0-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/5860-8-0x0000000002610000-0x0000000002677000-memory.dmp

Download

memory/5860-2-0x0000000002610000-0x0000000002677000-memory.dmp

Download