a4819c26cc15c186f750759051533129e4ec926bbe70491222ad2cfed0ef7216

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
Size 848KB
Sample261026-rmkp8aet8z
SHA256 a4819c26cc15c186f750759051533129e4ec926bbe70491222ad2cfed0ef7216
MD5 bbc71e5e1b72e15b2c0272551d4d10e6
SHA1 d8595032e37d0ab6fc6d4ff407cf684ee97875f5
SHA512 0f7efdcc88080c8057dab873dbe1fa65bebc0ce11314da0bd3ea31ddd0e353a620707263753690a9da7ba47be88158272387086961dc646f4d5b81bba4453a89
SSDEEP 12288:GEjjq/Mk1OlpjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGY:GGi1opnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T12505E11177B0C831E56A35B2C817D2B56ABDBE605B3166873AA43F3E7E381C3592434E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2552	elevation_service.exe
1048	elevation_service.exe
4460	maintenanceservice.exe
5340	OSE.EXE
3364	PerceptionSimulationService.exe
4852	perfhost.exe
544	ReFsDedupSvc.exe
3472	SensorDataService.exe
4688	ssh-agent.exe
5132	AgentService.exe
3236	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc3227e73a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000225494f25465dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027c2dcee5465dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4b920ef5465dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008be4b7f15465dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000406d4f315565dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeBackupPrivilege	544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	544	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5132	AgentService.exe
Token: 33	3236	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3236	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3236	SearchIndexer.exe
Token: SeDebugPrivilege	5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
Token: SeDebugPrivilege	2552	elevation_service.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
5548	2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3344	3236	SearchIndexer.exe	100
PID 3236 wrote to memory of 3308	3236	SearchIndexer.exe	101
PID 3236 wrote to memory of 5184	3236	SearchIndexer.exe	102
PID 3236 wrote to memory of 2440	3236	SearchIndexer.exe	103
PID 3236 wrote to memory of 756	3236	SearchIndexer.exe	105
PID 3236 wrote to memory of 4932	3236	SearchIndexer.exe	106
PID 3236 wrote to memory of 5816	3236	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bbc71e5e1b72e15b2c0272551d4d10e6_amadey_elex_icedid_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1048

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4460

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3364

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fd13d327f48dacad51f1f0a6841bdd66df7571afef43eceaf64a620218a12581
MD5 fda4daad66ddcaaa6de4faf3ae446c40
SHA1 54472688bd8d204e5587b26b6253adc9e4a928a7
SHA512 f25ef7cb05343f26dbc95845b568b2f0d9814af733bc7bf2adfeafee3c6fa9ff0db1d90f7660b08e59d65d7e5dc20f4cd969977b1a7e94f32fb5b355d720c1db
SSDEEP 49152:Pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZtDU42mLsZFQw:N3q6sjBiw7mLQuw
TLSH
T116D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 12e0bd29eea27e89eed438bf58ab94457ab8e3c91b3797d3e7d4d5ca714ddd12
MD5 317647f461a88f1c749e531a48f08631
SHA1 223307e93f9fe8ed6f39230fa83304e4c7ba4242
SHA512 beb0c291997b2c8fe3a317de7a3f4adf81f04f345ce19420778e0df821323bf25af5b2b441897a9d373253efd5849aee33f21467168baff5a92ca22543eb4d75
SSDEEP 24576:+XYfDtczAqnAUz5DFs1jsLqmVNPEZ+OQw:dtcbtDU42mLsZFQw
TLSH
T1B405F12873A004F9ED67817CC9A2D505E672BC854760E79B03E49A3A1F377D46E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a6ffbbaa54720e75ab9ebfa90f2db0ff5361f9e61acf9a121bcb39b07bb7e9c2
MD5 624b0a8cc6931b58f746248366a8c33b
SHA1 aa1668e8e6afc68438254ccc1dc1f05a027a99e5
SHA512 535b64aa69230bd21254fb909101f8ea2622431061fb34ba979a8cc6132e6d678405a8a36d68e06c208015a8805c24eb1410be9ff59119255f0a80b105d611af
SSDEEP 24576:i0Le5ji0hmxxrM1nAUz5DFs1jsLqmVNPEZ+OQw:iPji0AjOtDU42mLsZFQw
TLSH
T17A359E16F6748335D073C0B9C5D2A68EE97130865B308ACB4296D77C2F6BBE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b5555a974f52065d9a336c90c699504f8d58f3fdfbdd9d63fa53d4b23545d7f0
MD5 0770e000020b2732e174e9ef1a89e613
SHA1 c9dd1aa240bb0d6263d9934d9009735d1082bd84
SHA512 0ab01e0beef49a04125fea34ba28fcd7af66c4e709fd5c394af3af7e0e97ace2338932ac1d82d4f05350a6afe53791413a29904631d5856df333d418a8ca4751
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWn6q8wyujnAUz5DFs1jsLqmVNPEZ+OQw:B/ezSC6vUzPveHjyStDU42mLsZFQw
TLSH
T18A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a8f1f0b9cd99444dd74deb30730cd90eafede9e0d5f6c6536cd99438077f6851
MD5 62d2ea6c6e2e15fdcbc3781beb8e2dfd
SHA1 9da896f8fcbe5e6c5b4e8f847354ebba8181621b
SHA512 d1041c54842121b58bc9a7c0a2cc23279770708770391e1f087b28fbd55b9a75a4b40bd0c817845a3b6b05e31881274fc53b4445832a471d5fb7dcb9fb3352eb
SSDEEP 24576:lVbqPb88hv/l+Y+nAUz5DFs1jsLqmVNPEZ+OQw:lVO88hXl+jtDU42mLsZFQw
TLSH
T15A559E66F6748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 dc2d48737c4d0dacffdcce555f38660a2b52d68eb420cb767339ca5b1af2f675
MD5 f4f910691ede389252a39fb9aea11456
SHA1 2fc09cf157cf625d536a64a24433d118b10a7106
SHA512 33ac9632e2cf27eb0ac1260b1ee357484adc8bf650c5a6e05842dfaca6eea7dd568b945deba8f3d17a879a3048ee994569e4d9771cc5aa6fd5cc4216716c1cdf
SSDEEP 12288:QLZjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:QLZnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T167C42386A3306056D3572D75EAB6F54930B0EDCD6921E9270EE2373F05BCAD2F456243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 21fd6fab113b20d8c8dda45c13aedfd3c1643d5ad45d33965897e6e0431eb968
MD5 494089bd605a5392a7779fca246da941
SHA1 76fcaca9b821856aa9103926eb63d0ef1d5e791a
SHA512 7fc8a2166de341eb439880ad135b72aa0e79b62c53f2132f52a5857d053b316f7e9047917887f50c83d75948dddb5fad2d53cf28e6c562b1d415d0265754876a
SSDEEP 12288:eeBNUbTVO86UmjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGr:eJIUmnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T14D05CF3BEE28FCD2C27A4DB85A91C600A77278704F62A3CBD175830E9E275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d971ac2721d889c3e292a73b908aa924095f2d8c4c0baa49b5d157b131d5b7a8
MD5 1c43c50e1110dfa4df1d71253e499d97
SHA1 d1dd28681fa7e4b934b0083eb840556e8709c738
SHA512 c32949c2e9f336154d2f87fbc356634e429a072cfc094a66188a364f8092096b2cc17a6e521474d01fd8d4eb38b167b509ea22616bc77c2a3586fe66102cb5cd
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:KQvGAdlCEL8c/DRNw5Cxw7mLQuw
TLSH
T1CA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 46566582458cda88cb0b2422885f2bb323d845ba5481bc7cd18166302f3a159f
MD5 f0948365b77af12c283d7703ae6fd229
SHA1 c32485fe39def49c4af4a6256448f5e3440bb602
SHA512 54e91131fa94cb42205b2b6e12e72247abd03dc87fdce99cfcb14c93a525119b99fceb06677bf7f41dbf705a1cbe66b17f30f6b5e4c4350349b931354b94154f
SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAjEjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcL:j0ewsAjEnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T17815E031FB74E036C37B0DB21B36D716247CB9604B621AC3E3E85A9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9df6769002b266c55f24347ec8b23c170f759ec58a753ef41b0b78952097880a
MD5 826b98e4a4e740375e12344f2f6b96d2
SHA1 ef063881e4c06179a8b29120534c92d74eb2113c
SHA512 b8ab08d9d41398827d2ac35edb73f0fc217d78e0e1a324dfafcc866c316f9c673c9208a8dbcf87730fc7e8bdaf22f597248bcf371079f6c03f7a9cc0a1ce03e0
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHKLQu:tUEtQevvqc2W1cpV2tI32u
TLSH
T1D8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b2c119645782f115e5a53a194b90564f1af72f65dbcae2d447a72ce3c6c5a494
MD5 1eab6909678ed05df542c3d73f71f4ca
SHA1 01715a1398d886933eb372d7a4c571a740c415a4
SHA512 2346aa419b4b4aa69c8d0e7ab5e5b3a560c511b02210e5b647f35d49c9fc0cd24805f7221633c2da82dd0a5c3057ab5454f37ef84b82c0e9368e206a9918de95
SSDEEP 49152:YCbRquA/m2yL5zTfFiV+XenmE3/zetDU42mLsZFQw:RoquVjnm1w7mLQuw
TLSH
T109D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 692291592bc1463fc0463372eaf434767acd1c660ddff1f32d8e5672a60bfca6
MD5 ca3dcb9ebe0d76d9ae3529374278b187
SHA1 17a60a939c4fcfd90841118df575fa4b10b5e59d
SHA512 bc0eb05eae5812cd2ecdd9bd4aae9a48ef3c994b588d6b5e78f520d7f8b015eb68f6abbfeab5368cf06fcb1403778b0a76728508a0eb382f9bd3e4d14c9f2124
SSDEEP 24576:uAhGL3IFoiwtA5l7S53/nAUz5DFs1jsLqmVNPEZ+OQw:uAMUFoiq5PtDU42mLsZFQw
TLSH
T1D235AE81E7F951D4F5B3AA7899B69170EA76BCAA5E31C20F2160D21F0E37E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7b16514abae7819cf5761c21891752b04287f72940b99155ebea787e0c50a418
MD5 0c6971d1a0f67201b23c3df5460390ae
SHA1 ae07dff1aff9cec88629319533387d1720a3e3aa
SHA512 e71bca29b5711fe1d193046fe8ea2e4f6123872defd936bdd70cf6a45d14b5fdd0f4948549d563179f778afaf237a6dc43a72eb546be8247e26a3426777547cd
SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+CDjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHn:4wu4OWgnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T18905F04673A418F9E56745388697D136F7F2BC062A21DB1F07A0C72B5F3B261BD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 68f179c9359e49b512b098201881195a4921582473a1e798442739c6283030c8
MD5 2b90974f6eea37b910520bbced5cb35a
SHA1 0a4647951b298fcc64582ba090a796832944134b
SHA512 4fe62057dc018467bcb9b9c30131e568db9a6398ec51cc785b37ed87ee832f0f77db8771248ccf0ec60a62573aff531ea535e7664d17778d10ee11c4854c4b39
SSDEEP 12288:1eZ1IyUjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:AZu9nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T127E4128A33A470F9D263557CD9E5A605E3B1B886273283CF0665136B1F7BAC26D39313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6609edec9e82f047e0cb3f6dd7c6b3294631228fce0288aaedf6bd022646ddb7
MD5 07fffde7486f0514259a425ff889acdc
SHA1 e4f0cd70bb9c8500718b8d367ce0c4c0398d9c59
SHA512 8ca31453244b4c280dc49ba579d90e2db00771ed2c33732253a4f3b45d107e1c055cf1c6413aa8a201bcc35907ab0862fec0cd94f0b5eec3fc2deba29d556842
SSDEEP 98304:aQRQyi36YOcPbLvw2gAf+PN3uw7mLQuw:RQyiKa/X+PN0LQu
TLSH
T1A6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4596a65d295f718374311e8c178b0f937ec6a8cf5a1547fa10ecb2d31c585e56
MD5 8fa741ae27ff3782ae73a0f9a528cc0f
SHA1 c9e47f50ded9aedab9d5582f76700c121fde5325
SHA512 83e7e39ae2c10a9c30009909c57dd19d3191e5060751fedc0bff88ba67b59ce7fec4c95a3ce83d305829c1d485f1c227e1f62139806ef24ab4fc0c52e88e8dba
SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN3uw7mLQuw:2QyiKa/X+PN0LQu
TLSH
T1D2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5142eaa2687b131f5a860a62085ffd99d43a252e4f88193446dcb98ed9ede8aa
MD5 51d8873c7b8fe753b50f9beb55cf02ee
SHA1 3a6465776e5709fde0aa40fd8d8002b837b60db3
SHA512 b8de053dbdb569b3ef60b1a9baf1dfb2965c211f78e4cadfcb36fca50ad597554b7d7caa6c9457d0ad097630f1f7911f59c6658f16c18ee2b07a56b7735d3fc6
SSDEEP 49152:U68Qg55nhceWu7PNU3/OtDU42mLsZFQw:+thLRc/Mw7mLQuw
TLSH
T19DB55A33B2F20099C44DE1769F4A972196E17C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0af7a83a5ed4123e549c8d8eaf14835cefe6e8908f7440ee0cb39234f927616c
MD5 a493b5352b7e23e7ad8f7876713fbcff
SHA1 aa7235b16024d56a3a5b2da166f9b9964c816aed
SHA512 40c6b27efcd90115517077404962dd1b0d2d35829a0ea51b34eb9d42ebb497ecc2ba277b33f4e761644d883e9f3e403d22a60324e8b7323d753fb43d4990e319
SSDEEP 98304:gy5112gYy5azzVvt69nLKnhZDw7mLQuw:5LIHEWhZLQu
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 12b59d1f76f6b69d051569d8fb8935497b090a5ca0e4e0c7661e2e5d24ae3180
MD5 3fbef0c70d208ffb95236954fb31a8c9
SHA1 666d9652d36b029b6b8a0bd6ac77e26b6bfa5830
SHA512 4a8c5d689805520fc6d23e73c272c159b13f9a5b6d7b78c63cff5e05af6cf3185b08dbc0968152888cb549596582830523f86022ffc5c10abc8e06e05ce37de2
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glAtDU42mLsZFQw:eu6Jmdxd2dGw7mLQuw
TLSH
T17DD59D13F2DA01E8D06ED478974A9233F962BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5388e3ba7a39e389139e6ab43f399af226f433ee8c06131e6c14cab96c85b346
MD5 20e70acadb20b0abaab2e605090e7aee
SHA1 542a6f96c4801e2dabf1c2a2f65849f055893acb
SHA512 4b96faf804ef769c268cfea10846d3f6f2d6e5c6727b6f23ef76764679d84bf6b400dcd1317654a1927b11c8588845dc07ea58e73add50205a4a9be251d2033c
SSDEEP 49152:i1hpsNoJpF1A63U44CwH7R4x0tDU42mLsZFQw:imifPWR1w7mLQuw
TLSH
T1EAB5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 29061ea2b7ba94a70fc562d68d874cbc2e99bb5165008939307c7a951f27e1ab
MD5 133cbd12a051ea589e36e39620bcc9cf
SHA1 80602ec99ad848586f7fb5f44bb20a75a025ba74
SHA512 fa1477e3c849235f704a24e6e29a8bb3196585dbe784c7fa7fbd912e60821e1b933f04940ecdc97801f8a76a6a6b304f503827193c8aa7da17a5651aeb4c531e
SSDEEP 49152:bSuZQIY0Be2KcRVtOnks6NMHqJtDU42mLsZFQw:J5dKii61Pw7mLQuw
TLSH
T122C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c757db91de91ad2a6df67261acd5cd19f52589333939606630a4fade0dae3931
MD5 48787a8f5c45780681a5c5fb3d62831b
SHA1 d3f2651c1f4780501634f23dfb1039ae9d4897df
SHA512 2041d589a6f353ba9c25863bc27642519c739be02a4e7f818cd65ccfa1c3aaef1970b8002702bf9676567b5bf491cdf531407cbecd3d7a5afd5760a60d666c4a
SSDEEP 49152:qhtSn8EApI0fig3giDn0AP5wwtDU42mLsZFQw:LX2imph5w7mLQuw
TLSH
T1D495BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 26b75afafc33a5e96a464c92a7897e037d294b6e5eb39c1dde44357daae2bb35
MD5 89c36205b5ad039cb37d95009faaa415
SHA1 8a5158177e74ee65ee43d75b1b09703023c87b48
SHA512 e48f972b621264945a60b2955ef04df39dc561b6f1a90d140b61346c34c3a11fa64d4954f077f9f17aacc3bcbd06e4a259171a629fd4563cbb6a457bfa3f4fa7
SSDEEP 12288:ChjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:ChnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1ECC4238673319056C3061DB5DAA5F54930F4EDCEBA22952B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 330ffed63b00ef2796354de10f2e63869146b4a569bdcf05233e7328feee844c
MD5 2bd78f22bf25fe7f395f2c1eaa2decc8
SHA1 b797e19a9bfa6621df01e07e01535e896dcf7ab9
SHA512 177f461f3b15e24d4ee69398e2b271701c2860461ae1add4017787009fd46be6d6888eef3fadeb0f9dc0aacd1ad16a13fc937f0e6c172ef58b76001c8c0eee09
SSDEEP 12288:YYjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:YYnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T12CC4238673315056C3061DB5DAA5F54970B0EECFBA22952B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b4eca33fc7f5f6babdd0bdfc6222a5cfa98670d2c443e9f43738b47067871df2
MD5 730b8c906e7fce753663745196e15d70
SHA1 2af9b79e76aeacb46e00bc84039acb8176290e2b
SHA512 ba7807c3c52d17793561ca648eec526b44aaeec395ac93c460a895abdf4a11597ce7cb2c0db40076ceba24ea6c65c7a32e45558e4333b29a51a843ecb7435e61
SSDEEP 12288:CujvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:CunAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T173C4238673315016C3061DB5D6A6F54970F0EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 63934d49175bf9a6406070ad6cbb9fc1472dfd29cd6d289a55920c955b8403af
MD5 c019367b59c43b392aaadddb6140e598
SHA1 53d8ff831517a82846639527810dd56cc1406267
SHA512 6cc1813fe2d986376727132395a59ee1f04d1b0f2dda1dcff12eb5603b6b9f5b9e6cf3cdb5725516fd3479f4564679f804c3980774f0d9fead151a19d6dff697
SSDEEP 12288:OVfjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:knAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T193D4234673355096C1569975CAA2F105B1F0FCCEAB32A66F0E92272B0EBD7D1B835343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a1408605994372e5c83c7d74b2bdecae5e5923eb80a25bbe2101488234239f08
MD5 1656016331ce1c4102bc152313f3ee46
SHA1 128626a03eccdaaa72fc1b8133105d7139d36226
SHA512 8e0d4ce85281c212bd8d518935e4e74536103438a754026dc45eef77e4f80a4e0d4b245d13ee092bcf565bb2ad472fa8e6d916993ccf48064b39a86f408837db
SSDEEP 12288:TXjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:TXnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1C7C4238673315016C3061DB5DAA6F54970F4EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f47079e89860176a3c32471265b59ab88520f5f5e7950e74698dcae134d82068
MD5 f1ffd4d49ee3a93506295d84cbf102d4
SHA1 3d9174da8c368384e38bb418dded181d42ba089b
SHA512 74d38f7c174e22ebf3dc538cd8434a3f0426d7b34a2700626556dfd690dc561ac39b80990794cc3d680c6741c33fccf02ec7da2c70ed302be653a8604a57cec2
SSDEEP 12288:9MjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:9MnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T165C4238673315016C3065DB5DAA5F54970B0EECFBE22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 fb35005d8eccf3354ddb480e2c4bdcc80a64684e0893c39773a2a0ba920002c5
MD5 87f483b798e2bca27f64b17dc0f2064e
SHA1 085cb207702f672817317970a7a16b7f53b7bf37
SHA512 8b4a3a748a566949f85732c1c69c53ba2520bc8df514558c76c679ba12c40caf3ea1604483bdc6b500103e549494b087607083673b708b1e20442066c96ad542
SSDEEP 12288:oQjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:oQnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T155C4238673315016C31619B5DAA5F54870F4EECEBA22D52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d1e5b6fee96341c82121256c5244a80a2a6e9744f999c3a7e96f4e8bf17422d8
MD5 e212fe6c40f9981d8f8f35c47db9530c
SHA1 392d3c79b14dd7efe0a5520474d571d06423cf12
SHA512 7ccfbb099c2a16925a8a54a40fc0c7d1faaab88e10571b120940e2f07be868070bd13bce8d2fb7a63d180859a9ad8ccfaec3b35c4d74c765ebad10ca6874d9cf
SSDEEP 24576:hZMRzFVSO4nAUz5DFs1jsLqmVNPEZ+OQw:hZMRzfWtDU42mLsZFQw
TLSH
T1A8050195B36018F8DD67813EC9659906E2B2BC5A0B70C61F07E4362B1F773A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 04603ac1e2d00ad97a8844ebb3449f3ae8754fa3fda4e4cca614d7495625cc3d
MD5 716867f6521c03a80bd2540b65bbb86f
SHA1 e03ec991ae3e0d279e7a56b4db2f9640b685b263
SHA512 772aa94d31d508e95b84e7b1e17569c97b12fe3e09dcb9a6a2bf17ad836c4b702f5e9c1cb6d2713bea29c72dea1b5d55d3f9031e865d43fe9bc4811d0ec1d1a7
SSDEEP 12288:qNjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:qNnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1B7C4238673315016C3061DB5DAA5F54970F4EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e57553dfdeeb22fabc7aeedb705c4bd4fd8f2a0cbf0653a845ee9cca7bb1d778
MD5 6a11f1b194d2231aa5eafb51887f705c
SHA1 aace21e2c478cfc1e85c74f33adfc953758667c9
SHA512 0fd4701a37f478c1bded762e6d69a4f38e0ac5d3cb8b018bb34c47993d121276947c3ba4352e783b07515c2f865cc17e1575610b1659e781e7228096d57a4464
SSDEEP 12288:7pjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:7pnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T184C4238673315056C3061DB5D6A5F54930B4EECFBA22D62B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 07b19ce6ed782ec6948d38dde2ca73293299341113d84a7fec96a4347b356deb
MD5 8a8d87a801302ea60368f738a2b76698
SHA1 4ca233bd846ef1b0c037920ec4189c626fc0ebc4
SHA512 aa525c6ca6693cf1683aac8396aae787e80f086a635fbbea19b539de30379379e825c1ee3fca9d1abad9f7ea689e3bc8186b0f000d4f9c8056624e88e345f2ec
SSDEEP 12288:dyPz5L8UjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:UzyUnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1BCF41247736130F9D1275138C9A26A05F3B1BC761B208AAF17A4173B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8af004a7c7c31afa6d43b8c9210fafee98b82b21c8863576158f3ab6e4c8a1e0
MD5 641a1410851732228e00409357403543
SHA1 e24c72b056f50fee9bf8a0c9d76107225b1f1de5
SHA512 a2c0d322b1bec10f874eab407fd0f9e1ee2ee85eafab1d4f83809a783cc39ecb9f5b4927ec0dcad76484760a4f3723ad8b16f8cefe0e617acee95b741f0fccc7
SSDEEP 12288:VNjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:VNnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T139C4238673315016C3061DB5DAA5F54970F4EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 84f606ecacefe95b30703d9c3f22376a835a77bed9e53f0274a5e510f34411f1
MD5 eb399a939cd447df721c8ef938697a57
SHA1 bb34b50a281379056830f788caddf4c3c87b0f25
SHA512 5520e170f32c2c0c325db91444f49d30ad3a5dd94d1a9b2b4c15b0ff65b99576213d25fc42cb872540138c88e71b10606a8db900f92a43120097b30007e83ca1
SSDEEP 12288:7NjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:7NnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T169C4238673315016C3061DB5DAA5F54930F4EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 da764a300d104338eda044f153850e18963a09726fa2d2507831dd8527813fb4
MD5 a6e5409f203f64951b017a1115920375
SHA1 851e50b1d4e03e9b940819564a2c4f8228f81191
SHA512 4255408bb136fd63bcc4b7fb8a829597a2f01d0cdad4b1d191b59c46001d88800e825fe40a82f00e905804e83366d0b58db8b2a2a6d19903debd312e07d8eaae
SSDEEP 12288:RyPz5L8UjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:AzyUnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1B4F41247736130F9D1275138C9A26A05F3B1BC761B208AAF17A4173B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 30e84a87c9e0534a48d6d32d6318ab7a3d12ff62294c783b93c41fceb8a65247
MD5 6d72eee9cd35e0741a73cae12f389a50
SHA1 ea77fda3364851da87f7acabf2b78c399c86b467
SHA512 bf48d2129f82982b392963e5852b364fcddbb0cd0cef19102bc63910b10bd0b79732ff6c24013d0f1815f7753e8ec21d8d4b139b7887d9ac4627ce6406ea8c61
SSDEEP 24576:8TDaLl3z0zDenAUz5DFs1jsLqmVNPEZ+OQw:8TuLljLtDU42mLsZFQw
TLSH
T173050195B36018F8DD67813EC9659906D2B2BC5A0B70C61F07E4372B1F373A16C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 017dd2dd0517c40e77e9495e5c824b8632cba5dad324e9b1ad848107f755842d
MD5 768fa075af5110d68a9c47476609d95d
SHA1 6f135114079b1b0d4f08c12bfc3152af0ab36af7
SHA512 0d8f0736a84aaa6a0f5cce5ac9d21d4c2909553d366da8710f683155c31fa8cf5f891a48f4d70d8f32f3cf9f928f596f5c561c10cb415eed360106ce0d0b60dd
SSDEEP 24576:53vd9CHKy7GZSnAUz5DFs1jsLqmVNPEZ+OQw:Jvd9CHKyaWtDU42mLsZFQw
TLSH
T1BF25CF90F3E410E8F0B79A35C9769501DAB67C5A1B31DA8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0b140f71b619ffe03adf318a853363feafeefa207cdb7297ba0e67566a94e986
MD5 0fa76141ed37b9012dadee09feaae23a
SHA1 51fce1a68b6a0bda95a9557a97488769df0c167f
SHA512 4b5521a103cf4d9ab6a6108f329593eaf6c062b9f2f8bc92c38ff7b33b1a37b9085bd59eb7fac449c5e84d1acf5296db3f1c42a1f48b8ca50ef227537005d944
SSDEEP 12288:jOjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:jOnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T17AC42386B3315016C3061DB5D6A6F54970F4EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 ccf615e3519bba784dffa84dd245dac811d04de3a756c7a59d97d153eeb8ccac
MD5 cab4a5559ba71d7b7b133b08d7d8a9cd
SHA1 a93b2d929481d62d7e7a9b4d8e78a3bb1758197e
SHA512 dcc0409f84df9269447c6ef3a923a064a685f6d8321697ba527d38fd04d8b75a3161197962861ee8ad7a39701b6c942d938144385c61a652a50a3f8e0a5841d6
SSDEEP 12288:I0jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:I0nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A7C4238673315056C3161DB5D6A6F54930F0EECEBA22962B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 d3289c46884eb2f49dd387e84c8df98b9755bf3473376b51ee7dd8b6dcd8a569
MD5 1242bcc42a2ac78b72ebfa63f92c7945
SHA1 5a887e434c99680440e2f4b9de17d989767ec23f
SHA512 ff20761a08c6c3b52d0c4545aae737470ea0795900938af2862d5dcd09653f20f5a10b3370850e321157a22b4754871e75b561dfd4e4bcaefd62bc960c5a3bf1
SSDEEP 12288:ZbjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:ZbnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T194C4238673315016C3061DB5D6A5F54870F4EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 737e0e2ba7f88a92e607db4a83984851f40db7a5a7313cb0d8e313069b9929e1
MD5 01225ebcf4df46f69280005cefa4f032
SHA1 f800adfb61756c3b9de34fc0a4a91cec159bb090
SHA512 7ee196b372ddd826ee26f959f18ba6673f90d2eba4b6c3997002e9be29cfe6fd5025c3de7963e538a2e76972933185a75bb96ac81d646bc217e2c42faedd61ab
SSDEEP 12288:YNjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:YNnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T15EC4238673315016C3061DB5D6A5F54930F4EDCFBA22A62B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8a5e4c349d05885b6c370018e966c8121950491a1203a4d3d6c6f55013c0a534
MD5 18dd41a898d5fb97b8f9aca13c0f8025
SHA1 08d470c9d9dcab6264133f4493b5f1ddecdbd88d
SHA512 2dfec973e6547a3e9531050eeea013b8db8519e3cf1f93c00bcb011470a66c564db2686d52add443720182e2dc2f5602e9d5aacf89370f77f2b3d2d38ab67063
SSDEEP 12288:4OjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:4OnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11DC4238673315016C3061DB5DAA6F54970F4EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 a304fa5115d69f7d426a13df3efb9ce365f0267dd806d6628d080e73eb6425e0
MD5 8d881efb5bb3880395f5dee7a3660769
SHA1 5a728042275b4f7252d2cd745363111c1f87c07b
SHA512 bedddb86a45868527921c8297feef350ab4df6da37f6b812b666e360c1730496665991da6d0add4d942db65e7c58126d12b1381f94f79b1fd24058a6359b62a8
SSDEEP 12288:RljvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:RlnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T148C4238673315056C3061DB5DAA5F54930F4EECEBA22A62B1EE7333B07BCAD2B456143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 488a8d383c6c295e89ef10be80b8c741f8c3d5abe6f313fec98f33af7de59b06
MD5 2d204c6626b59b64f4026ae8f310ef55
SHA1 2c5ffb8403e8850dace23a3069588971fc3ee3ff
SHA512 6a7167c1a7e8c4de91d30d0d25ce4b360f132e3195957ff919067ce395176f9bc894de264d1eec856bd4ecb60e0afc9305289ea7855b6b04f8d5968012c6fb5b
SSDEEP 12288:ZXjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:ZXnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1B2C4238673315016C3061DB5DAA6F54970F4EDCFBA22952B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 f67a002618b7cedc693abb90ba19093a01633a9a19bd3ebd95d10b191cba6a7f
MD5 d69aa7e0b7bef55ab712259c501a7603
SHA1 bd97a563b23a7b30e210b95ddebbf91bded92c83
SHA512 668ec25981e5aae5b94143140aa83752e111d6675b5a026e0e62a62c3cce70db2263dd0cb1c1f7d244d6f9727d26327e8cd7f6dd8b444df1e1c5487909ebeab7
SSDEEP 24576:KfwvUk9RX6wkyAI5nAUz5DFs1jsLqmVNPEZ+OQw:aMnYI9tDU42mLsZFQw
TLSH
T1BD35D029EBDC44E5E177923C99B3860AF2B178591B31C6CF029A536E0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b8c37153bd292a4e123621e2ca238805d6a28d9e9443c28d7e6fe47565980b87
MD5 d2addedddbd17898ead0c56a94292176
SHA1 560e277ae363e5286f62e226d792f28f8c297be2
SHA512 fe9ef9d46184a25f809a2306587aae1450b76839f28a75d61ff864daa5e8f2b4d63caf16d16d98af64f42187622bcce527949a5cf74fe64407234aa48be8fc01
SSDEEP 49152:WYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QtDU42mLsZFQw:1ySzPOw7mLQuw
TLSH
T10B066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9e9eaef80d67bac1df264ffaba90785ca5a26048ddb64e33fb9bc9686613a2e0
MD5 ae73dc02d7af1eca96b4657451a2b237
SHA1 c21a53ceef6207b7955114cc641c8465f917b51f
SHA512 add0fd3f930746737f8178166bd622efe33565322d7ef363446f5fdc13cc503c6804cc9e12b36e1d5261b771e3fba7b347b0a513d55a9705d5e9b8163b4c8a33
SSDEEP 24576:q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYInAUz5DFs1jsLqmVNPEZ+OQw:q47JUQjTirIhCnDHUPfF/AtDU42mLsZl
TLSH
T13B65AE1EA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 37f5877eedd6c77d5864fa0342d6645ccdb6c35bba5c581350ee859a3896bba1
MD5 ee7878dfb2ef89bb369ef4e0d8efcaf8
SHA1 5ad246cf475edaba848f0e54aa3a75c3fc1dd539
SHA512 120b56dfbca998717b1ee35658d6e73f7437f0adabe3010e6ede2d54a7585f3fe0ae80bd41fbd1c735f38bde2a1ba6a0c73641ae351c0c8cbab86933c0d808d2
SSDEEP 12288:sbsf9jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:j9nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11EE4F00AE36401E8C06E6175C756AA41B373BC5997E1D3CB16D0F63E0F7A690ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a899abdc5c6ddd5c3b13f1b7359f02481cb89e535c0012fa44c3585ae74e8693
MD5 daf311e01979fba27abd0387cbe32de7
SHA1 4ccb3424932b2581c003754cc450fd1437bc98d5
SHA512 afb4a0c0c585cfe5367eed8b38dfbf4faf5a5d0c2bf4fe48e9612536f030bbde5ec3b65f92cf8053d6f61854e5fcd6f368d233ae13f2d484b335dc3331d9a27b
SSDEEP 12288:MceRnBqqj2TdkWc38uc7li1YnZIJvNPtSqTt1:MFnDWJpl+YZSvZQq5
TLSH
T17C4528107626DB4FC6A940325E33C1CCAB707D42EE09AF0773C9873FD576658BAA2691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 375f29ef3fbdd0c63150608ff01585c6a3f0822fcb3263243864ee8a9179bcf1
MD5 df3a7aad815f8d738dafd035bd405d72
SHA1 684f7fe70ac61dedf88cf5ccd379ea5635394f58
SHA512 4fe7d73da24669c9a3a5cf92f61bb40bb153aa6105e5553daabb30cf2ef8ae24b9d7f4c9a489ed81bde9ebff3bdd9a4983ed85694e6f5332b40e5fe1f7cfabbc
SSDEEP 24:KoMxykN9cQ5trkMMMMMMMkIllMKuVUygYVK0kYVNRu+UKnDgIkw3:87tHll+VUREK0kENRu+UKnX
TLSH
T11B021290FB90F931D9635075DC70E3EE533DF0A42D000347761869EACC6D2424E22A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aecfafa06e3d87bde8947f4948cf6f2a3cebe0bf877a87151fecb57cc990c2da
MD5 8209e01cb358b4d2842c1489427b806b
SHA1 1ca1b6415d8f51c4d694c46984a7899c06261a45
SHA512 28434a57306da5243202494adb6e6145489ec77ff41d8373a734fdeb8c721ad32643782c1467d6e53a32b399d530c4658d193cf810a84b62c494e928487aa0b6
SSDEEP 6144:taNLBd8FHx6i2MNTnD2NI11I1DI1rGtNqjGyOt0R9aewOKDeoHhOKDeoH7Yef5Rn:yqFxhSQwqiycg9aewNnYrV6JkUJmcMQ
TLSH
T12665E941A536A78FC0B72032073A9B4DA7B4EC0377066F2673C9453AD866B56B1F97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 bd2c7a414e28b41b0b4f31044fe412ec1c12e54d125bbb90f9a6fddeb8ca389d
MD5 905312753815468b5d7ddd57e18ec844
SHA1 50c26c25908824c50b0615b2a49d751f8f45d3e3
SHA512 b481467fb37e04dec0d6d91b91d1f024ebaedcb0ddf567e9141c26f9a96f89335ce07b7867cdfbfb3a24f4af7f9cd8b77dcdf22e3e18a2c25b7a26b6781889fe
SSDEEP 12288:E07VjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:5VnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T193D42342A334A016D27629B095AAF1143079FE8D6F21D5DB6D96333F06BCAC2FC76247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9686f16d8a6b12cfbe105884f89253515d953a7de6d8b67f5fd3840ba86a716a
MD5 ab07e4ae515d50a06ed8cf21db526046
SHA1 e7f959d71a748aadb71da32db7fd3394162b5823
SHA512 c0d5582ec2a67a76f84371077b5b38529d3c9c297ab01aafb3c593fb00960409e191f141350a8a66479ea5d6fa4be3fd9edea8c6905c7c1ac0a935850a1ee22b
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYjnAUz5DFs1jsLqmVNPEZ+OQw:Vgb4mBIBhGF6tDU42mLsZFQw
TLSH
T1BD65AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9ae38d570846c5055ea275da8d5cbfbb1a1257777f8b91788945347ba9d7fa16
MD5 185861d7baca00cd02402b546807f41f
SHA1 a719d6e9eb919356cbfa93d39c5dc99a99fefae5
SHA512 d1657e41ad9d8c9ea9a61301079bb21bbd951379f432c8a3894bac11e0eb6741e2cea01d60935e57c5ba18bf51a0029a2956d32fc7289538e63b3314c2d515b3
SSDEEP 24576:2G88u8FpJqH1bzria7/m4nAUz5DFs1jsLqmVNPEZ+OQw:d7ZFPqVea7/jtDU42mLsZFQw
TLSH
T15E35F16577E101F1D47BD1388A828663F6B1B8151320EFDF0BA88B561F23AE15B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 1e097383c3c712cc76b10c45a89b1fd31cc00ac289501322965f504e41c76dfd
MD5 3363bdb4981dfcaf0f7cd85cf999dd77
SHA1 6f73ebb1648eb7ed2a4dbd62e58e0aea5752c049
SHA512 a00e2364a874f630d755007bc1673e73765079bfce5340f544884a1db8e3eeaf986702e406162dec59515f3f0f97a0ecea10ee8e69b6ff96b3304544890bb4b8
SSDEEP 12288:aHvUrBFrEjwaQcjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhg:aPUr+NQcnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1AC05E11F23A818E5E676A17D89829609F771B8561712D2CF02E1817F0F67EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 36cecab3ab899110c2f64c2ced77544753dcaa31d80f90ce5808a54e00678cfd
MD5 80e103dee19528de09e9220a5cc27c8b
SHA1 f1fbcbf17971dbe87d561e38b590b1b1c4055e89
SHA512 e1fe61cb6b17a12211d5bb95058c5bd92115de7df747abc7c9916b844647012a7f67db0dec1798e0cb34b525a7110adeaec5820a5c2652aadbd848b4116be390
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmtDU42mLsZFQw:RG05lO43bLw7mLQuw
TLSH
T162D5CF6A62EC11F9D1BBD07CD9C6860BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7ee7d7a9544f3176b7004bee50e3d44a56a4db44b6457c1c72518c785d8a0894
MD5 22c021d7b54bf09d32b56aaa8635addc
SHA1 e61897e17294a0ab7bbdd9e673f84e13c7b9957d
SHA512 16f7aa388f2d5552f985f916120d69742adbdb56c74b2c919dfebf0455f1e22fcfb84372e8fbff408e7e68291eee10c8e1839e167b0a9782f57b080c6c75124e
SSDEEP 24576:nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnKnAUz5DFs1jsLqmVNPEZ+OQw:fa5POZ3BJt2pasx2+mOtDU42mLsZFQw
TLSH
T12E65AF5EA7F801D5D179D17DC583861AF5B1342653329BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4a7d658137dfdc35057370a0d399534dc1cb1cf7540bba4d88395b255f66b239
MD5 f67218fde6722d6367a390d0ff112860
SHA1 978079835dcf43fce2040de76ff5d5d1729e02da
SHA512 94f8c4d40c8c69b9a0e89d8a594a74ff56479ae84114636b937d6f37fea7cef32d85fd18fcebb66562c17dfce14a8061fe03e858540361319c19380fa3d83ef8
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkAnAUz5DFs1jsLqmVNPEZ+OQw:iNc/zEOVHFDtDU42mLsZFQw
TLSH
T151857C1623E901E4E1BBE1BE89779546FA717869173086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7064ee42d57a7a2a6162b83dca4058370e8c1e2c1cab4884cd925b3730f228db
MD5 9c61ef944e42b8152049ebde04950111
SHA1 fb0fd0508cb78055f753f6df012a2a21dd09cddc
SHA512 13764ad3d85ce8553aadbf34bce244e9b19cf4ecf56b8040d05cc65d812663bcc4dc39a48cb9345587cd89ef3ab9b3e991f55cbb74155099f56dcfc1fe842677
SSDEEP 24576:8TkNvNnaFeYhJNtmZBm2nAUz5DFs1jsLqmVNPEZ+OQw:8TMwBtOmEtDU42mLsZFQw
TLSH
T1E655AF6EB7B846E4D1FAC6B4CD238512E6727861173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 cc62497b5ac3e7a8055289656c90d227ec40db2b8fb706310f55145c5c72f3e5
MD5 c57ccf7d960bfd154e73e611533d4af1
SHA1 4acdf2eb4cb235708385ce3220401b478437fe80
SHA512 5b3a7579064e74ddf2ba481fbe456a298dbd2d60b5ed5fdd031c5e2eae7f0ab9138988a566b2b51fd8c587e77160633490a22d5609b796cb789e17bca5381f3f
SSDEEP 24576:cD3FHshBIYQgABnAUz5DFs1jsLqmVNPEZ+OQw:cDVHeBIAAltDU42mLsZFQw
TLSH
T15525E17DE75C00E4D57BD1BCDA639A06E67138AD032266CB06D481BA1F6BEE47D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-321-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/544-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/544-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/544-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/544-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/544-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1048-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1048-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1048-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1048-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1048-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2552-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2552-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2552-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2552-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2552-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3236-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3236-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3236-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3236-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3364-274-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3364-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3364-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3364-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3472-307-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3472-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3472-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3472-95-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3472-101-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3472-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4460-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4460-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4460-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4460-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4460-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4688-108-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4688-114-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4688-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4688-306-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4852-289-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4852-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5132-129-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5132-121-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5132-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5340-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5340-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5340-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5340-235-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5548-77-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/5548-0-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/5548-7-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/5548-6-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/5548-1-0x00000000007B0000-0x0000000000817000-memory.dmp

Download