b5e74671f4540a2b033989efc2b22f95caac152c0c6c6b8c1daf649b2b785561

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Size 2.2MB
Sample261030-ea3n2sdb83
SHA256 b5e74671f4540a2b033989efc2b22f95caac152c0c6c6b8c1daf649b2b785561
MD5 5c52ed1599a7e6f3b7ede8873ba4cf32
SHA1 a8d1715ef5593cef70f347fd94bb522b5b7b951b
SHA512 e4c24c87d823f1f6de6a7c67c3b8452bda7eb9192deb24aa4cbb004b2df88994289fb408df72d029a0dce7ecf5e07036fb3eb85c4c880970e1c7daf3df38f428
SSDEEP 49152:mtCejjt1nAV97yKtFnFK2dstEPObWxBqLrH9pMQ/lFTjN4:mt7j2Ab3T9FLm
TLSH
T1F9B5BE42ABD344B2FD866633112E67139B39AB090313E6DF96903D7069712F31A7E2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4376	elevation_service.exe
5312	elevation_service.exe
3684	maintenanceservice.exe
2868	OSE.EXE
3264	PerceptionSimulationService.exe
6032	perfhost.exe
2396	ReFsDedupSvc.exe
3968	SensorDataService.exe
4208	ssh-agent.exe
5896	AgentService.exe
5108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Z:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\R:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\G:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\I:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\O:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\K:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\M:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\P:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\X:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\T:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\N:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Q:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Y:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\H:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\U:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\V:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\105763244b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdf0b11a2168dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c0dff5c2168dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f9d445d2168dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000946961192168dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000107be5172168dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfa0521a2168dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2e3ab192168dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072a7cf182168dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeBackupPrivilege	2396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2396	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5896	AgentService.exe
Token: 33	5108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeDebugPrivilege	3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	4376	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2672	5108	SearchIndexer.exe	102
PID 5108 wrote to memory of 4704	5108	SearchIndexer.exe	103
PID 5108 wrote to memory of 704	5108	SearchIndexer.exe	104
PID 5108 wrote to memory of 5560	5108	SearchIndexer.exe	105
PID 5108 wrote to memory of 3032	5108	SearchIndexer.exe	107
PID 5108 wrote to memory of 1840	5108	SearchIndexer.exe	108
PID 5108 wrote to memory of 1660	5108	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_5c52ed1599a7e6f3b7ede8873ba4cf32_amadey_elex_pay2key_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2868

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6032

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3968

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4208

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5896

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2c20790406bcc5583cbb55973810f1b1b15dcfbc81561357217557889a5ed65d
MD5 be5e7ab79679d64b37a8f27c4d2676fc
SHA1 f048932177b08cad64823a23ff09b76803fa748a
SHA512 a5faeaa256059a54b2c552ebe9dd16d222dc1946156c703ae03e7adaf046b8ebd7484d317a56d45082efaad9595c3c527c0cc7d55fcc17571bc1e82d153c7507
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRQ/lFTjN4:73q6HjBVLm
TLSH
T113D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3d7ac8638e2198886960faeac61ac9fb08d9ed919e9fa177ca969a320e66b98d
MD5 829dffeb9f25abefca711b24a17e9412
SHA1 8dac470afe3d1a85674d5ecadf07b0abdfa02bdf
SHA512 4b3728173e46b4df0e0e847ea609bd820cb7199370bc77b1040256f5d7954f519f2b27324a0810a148b7dec895539228662e8a07762ad6db0e8459ccd18f6db7
SSDEEP 12288:l1XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:rXYfDtczA+nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T17F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b49c35b184caa6980d0c528ba3aedd27578ba07172f087d1e9e3319f20319625
MD5 178d2fccbaed58124a319d68b6ebcd9f
SHA1 0926c85c1e452e1457edc8792ed4d348df364d9e
SHA512 ba4fe328f3996a2ca876ba052bfdb6f096d18ff89c736828fd9ebc61ba472a506d93e91ff9e8bde29c1461646e6b4b7bb8c5625cfe0f9a8f888056f3e105e8d8
SSDEEP 24576:f0Le5ji0hmxLrM5nQ/tbw/2Mkjy6Fr7g0oz:fPji0AlMQ/lFTjN4
TLSH
T159859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d9dd06e97f991fb5309bce1c859238c8092cca836feccdd95205079f3d6c390a
MD5 b25e9c20266525970e2437866531e1d6
SHA1 e5db210d7474eebfbccf784250c01db8bdf5eccc
SHA512 a0aed9238750fd53f8ae2c2240f7b4c87e01d2ad9007942fc16b02d9cba7975619b0c9723804d581935c3aa5c847917baf464018f30aaadaa9120d79222b2405
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWE6q8wyuLnQ/tbw/2Mkjy6Fr7g0ox:w/ezSC6vUzPvxHjyAQ/lFTjN4
TLSH
T1AE755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f9d7d578bb9f1cb0f198cfde514157a122b020422b7740086b0c88d34538bc54
MD5 d88e130671e9ee3a3bc4f28808a543dc
SHA1 5d8b28f8f4edc4011d1303fdac767fced059f098
SHA512 abf3fac7eaebe71469516f798059bd6d8486b1acc65ad912edd83bbd20e5eb714c91b0f9baa93f6a47d1a9011d47ceeeb0812af77b09ed32338d66d9c3458d5a
SSDEEP 24576:IVbqPb88hv/l+6qnQ/tbw/2Mkjy6Fr7g0oW:IVO88hXl+dQ/lFTjN4
TLSH
T1BE559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c1de2533117fb69845c00e15e5d4d6e1721eb02e3f576f03b5d8089bae34b3d9
MD5 8006d61c444c7c250b55803659e55ca1
SHA1 0bf9e12dcb776965a12ff49560578c34cb27f1c1
SHA512 5eec66c7df8313997e124a4e628485e5f99ef688a731a079dc1cff449d5f41618bacb65569b1e8cc84ab05d38df1dbf90698c5af84bc5251deb512288f61a795
SSDEEP 12288:vz1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:vzVnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1275523796A24F897FF2B06B55CC284826B3B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 afa53c6f224bd9c2106e064f6dc1cc23037ded0083734d94d87dfc4856ce4700
MD5 90f581275a1fb84e846cfb66b06cb954
SHA1 57b008f277eef3c8fe34d348962bf8131e4e8944
SHA512 2a3512a8e9ad2e2ea068353da92514a5da04cc3cdf144b70e88232724e2e2ad50b3234d0104e7683bef929141433a6428e25593d00d3941f950f1c433b919e84
SSDEEP 12288:aeBNUbTVO86USGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:aJIUSnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1D075CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 16ca5b901388b086039714b11e7f0e22647424eebd1eaf4234f1066c14cde56d
MD5 4f289c5d2de912326b85e15c0204d921
SHA1 ca3cf0234e791ba089898bb4a2c7ef19187d1b3c
SHA512 1d681fa6125632d3c23031f0f6bab46644bace201878960c0629778a714d9bc4d8fa9e94aa86690c328418c11b447be14ff4690beeff7a4d32ced7284084c56e
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:HQvGAdlCEL8c/yRNw5CQLm
TLSH
T190267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 83725895e566a00a4d226c04a94c5f7d81aebea061e082cbbe36fd28e6de442e
MD5 629fcc20817366e1281a5b3cbe1bdfa4
SHA1 2b02d52a32cc24c1e74ce7e553226a1e08b3c11d
SHA512 f26dbb6bcdb940e82a410c82a27496b4c688233c7fced4837657b9682f47475d94018cd986ead704af4a19494bc4e36067e2ca71428e5335b53f1fe3d43cae24
SSDEEP 12288:LAwSfxL/2Dc39DLLmt0LDQewsAjcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg1:0QewsAjcnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T18375E031FE74E436C77F0DB61B22C706183D6A604FA11AC3E3A85A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c193bd167e4577e0c4e5adf9de4f9693e6cea2b63d2271fb9d94646d997fcd71
MD5 790a676725162b0b1e8395a4dd275659
SHA1 ba245843c3d484df19070d63cf4f08a5cce7dc7a
SHA512 b0a6b38d8f4fcc66045c2164163ed75286009bb54f5f7f2f93d313bf1909642dce668477785eeb4a7dc0dc150674d5252138f092407c81af836ced26966c8c16
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHHL:WUEtQevvqc2W1cpV2EI32
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 81e7695c01e584c8742d31b9a52ec48fc90aaf23504f1e8c60f2a485bd5cb47f
MD5 ad0149d049a9099ce57be6cdcef7f4de
SHA1 8aa321e3970c35638535104077cd3140ede671b6
SHA512 c32f61616300db1ea1a069f3dcdd6ca0940824b8215aed0dccbf4297bca51119260e27d4001160a5f03ebd82218f587e11ca1b5e81de53388a5e99821545f162
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/z8Q/lFTjN4:joqtVjnmkLm
TLSH
T157D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2e0a8e9336aa9da3b924ea99cd3b31efbeb91e24424505b1a8d4917c4635c47e
MD5 4ba3ca63765c2d57e02764547e52bb08
SHA1 9b8b194a97b813b822ebb5a5fd3ac2b45549be52
SHA512 74fe90ae52ffe2fd1ca853e39440d328e1cb8b7cf7ee90b6918fc1524ee48b89fce746c5c2d8d970ccf3ad5628d1a470d40b53018b7799f4db5de967dbe00751
SSDEEP 24576:vAhGLJIFoiwtA5l7S53PnQ/tbw/2Mkjy6Fr7g0oo:vAMyFoiq5/Q/lFTjN4
TLSH
T1F235AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e5bd0aaf9e9dafb1a0b162b2eb27f32aa57b5110a8c6fa2e13381e98fa642228
MD5 f35731c79a4b11bc84730f5e16b92d60
SHA1 79f1f89c28edbcb909f9cbc78540dc45d7cf40d3
SHA512 b17f424c8f7aceca6091690f61d7ac86ef0207dacbc7899291ceb5fcbc9677b130d2d57ba876f08870bbc95b3228a2e2673faf34f9508a7b6654459c4a393531
SSDEEP 12288:Mmw5HEjsChN2BFgl0WDm+C7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMG:pwuHOWgnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T14965F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3a05928b58bc4d59bd9b47c81e582ed1b73f1824381722a0785fa10e30ec931a
MD5 6dc24b86371cf2e10d0a2ec84482a170
SHA1 a995d2cf23cb5d7cf4d67890b3feb2e9c5b6c063
SHA512 4ffbe70978c24e464232f6896e0feae94b225b677d510a6a897c00229bcf158144525616aacfebf507bf16e64369a418737583b024de6e511bdff272952cae4b
SSDEEP 12288:0XZ1IysGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:0ZuhnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T14555126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2464f9a2a46c6bb42bb1ff69c0ecefa951f7130a5bb03563de08026555510ce5
MD5 5cd3794271605a51a4457dd4d769b437
SHA1 a4d966259573660fac49e1fe9b101fa9c9b1639c
SHA512 ae18f148ca02b637b5aaafe316a59c42889a160f8f72b1e7610046181bc58231974c78ef19892a53c29018d5e684f47aedbd00f8b40f8ca424e35e3c48ed3b19
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:fQRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T166666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 95171121ad19d56de9dd78a8a919def024a4bceb1dde11a2462e37d4d996c29e
MD5 84c71192969e6b5b9b53b6663f5860a4
SHA1 1ea3341bc80bd8af0ffd91f353a433b5a4afd52e
SHA512 a774585f8edd817c21d1196b1b877bcd464179755b0e1634f19efbe7cb686e0be8fab3b34e3d5774e096608598e794ac507ae996a5c126d9f6ef3566755651fe
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:iQRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T1A8666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 663a23a96ebcc549ebe27d737a92c586553b53c1a75cde6ef64881db93d050b0
MD5 93a9bded6366de58b5e88fd859e03cc0
SHA1 7523330948e5d3adc9fdbc4fdff04c5c360524d3
SHA512 ac40ef165cc00a6bd5362d8ac9ae3cdd58ba06ea256390ee7481cb844e629d250dbe8788b1c84ef393b98de5e65ed603efc8f0d5e49ede31ee699f7c278b3dbb
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0RnQ/tbw/2Mkjy6Z:N68Qg55nhheWu7PNU3/MQ/lFTjN4
TLSH
T18DB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f0732c5776e1a436350195b816bc4d9d2e45b9caf07bf792d6f1c110f174bfac
MD5 c7ed10ee0aed5d529a7214a41e633f7a
SHA1 04a4be76496722947255100d4caa46aa6005240f
SHA512 8a07f1ee11bea23523c2ddddac53b8048253cc755638ffc9808a5ab0bfd8707092917c9a3bd83ed5c3e89955d0b6db3230db5fdf2856d1c9e284fc11fe5c8ef6
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:Hy5112gYy5azzVvL69nLKnhZ6Lm
TLSH
T109167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1db7cd2cbf545a1994c1f316ac54df88d587d9d866e063645c3fde2e190cf09a
MD5 ffb0611da3391501baf4a3a85593123f
SHA1 f5e4c2a9ba8eb69b59a07f095441027526ce0b00
SHA512 3fe4731522f5cca0883b74842ec64abd706c231881f0d7f34d184024a456b40e336fb8a4ec56a367fd26b9f2891e9b7ad2a532af477d3a37e57b492614a8d353
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gluQ/lFTjN4:Tu6JmVxd2dJLm
TLSH
T1E9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 31a0c61de53c796fb28ec4cee783b7fa3061806a61c5c3a1f1ad3cfdaebfb59c
MD5 6aa05f2f1cf3bb253dfcf52ac681e0b5
SHA1 530e526d75eda52ac9cdf81c51645d6e1979849e
SHA512 194b784e95aa2aebc00331ca0c1055465f0e139835f5d27f23059c8cccb39830f94767f23bbbe47ec8f55a673957c93682295080d22b5052d72f65abff61f6f3
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xyQ/lFTjN4:4mifPbRkLm
TLSH
T15DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a71da95f0eb1dff7f4e616baca4f0fecf9ae672a6332e9627c237f2a1e5fa80a
MD5 9eb050e577c461aad76713d3408b3db2
SHA1 6cf4a4389626a1282b8559f7ca5ddbbcb495d211
SHA512 e669bafffdcaec9cfba20bbccc147e73e3c6cd39efb4820fb37a863802f7ef771bb22760491223780292ecd642660d03ef84727c1050a10a9aa11186d2c9b02a
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqhQ/lFTjN4:w5dKTi61GLm
TLSH
T149C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2c2f1d0fcfb0fec339fc4e2c3a2e96f27ea54306d4ffb4fb6e62500a9747ea6f
MD5 842b9bdc0dcc263df05fbb1580be1cd6
SHA1 3d8cb574cb82731f52ba77956076ab8a0d2a7242
SHA512 df1590367f3a1dddf2e84883929a23fb4e19a426d1c9708cc110a612d3f39228a33b21c013660e660b33473d9ed214d7e34e5eab91f741992f02d341bf90c787
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5w+Q/lFTjN4:GX2iyph4Lm
TLSH
T1EA95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 07ebe5d3c2cfad4b25493848c8f4a9126bf5fee41c778bea674248158a115069
MD5 9c6ec416a055865f8a042e503fa77665
SHA1 e38258e611db5fe532b02cd5e6d4c61e9a0515b4
SHA512 bad2d20d1a16274968fec6be086b33b0e0005d4939b12b5c1e59d05d6cfec67382cbcf2356598b2fbb8da74eb7be62505482c6889bb977a0d8eff880928ece48
SSDEEP 12288:c9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:cdnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1005523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 48bac14d5bdc81e7901c659f696a27de26e249faaa03f2fa7af1776b0f94b716
MD5 3d42a28b7d4b899787d7802977213e04
SHA1 9dfe707814c8222411178e8045f090b12a9459ae
SHA512 250d8cc3761ebef78285aa40d39bae08d59a61ea6d7bf692860253d751026ecb69a0257749145b406b01cd91d93393cdad6af3441cc4f057e8b79e10fb0a0688
SSDEEP 12288:x4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:x4nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1415523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9f8f9b2e486abda0b7085eda94770717d6f4e690e3c6224f1f78a5392c6b2ff7
MD5 6666c0c11a436e65cb4b875b02a3cfde
SHA1 cbe7eaaff1ddb8b37744b307c34035bd80db62ff
SHA512 8cf4497882872103d338981cee5ade635171eef8e58b2bdac115a89747d1d39e5773ac8e94662f74129032fb846b88cb1a58a2b1e847010e7d5eb7c3a9875897
SSDEEP 12288:laGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:lanQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1705523697965F98BFB1706F148838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ed0cf029dee75b9c3c68701d83a1b9d390adb2d5d55613862dc88d54de981498
MD5 53ab10118b30c149c300cc3859bdee98
SHA1 ef034cf36807aae7d9ba30cd7aa23acd0192221b
SHA512 ed0bf8882dfa4d75775c6291eab881917f9f5c233edb3c3b6a9dacababa454934362bfb2f499e7f594b7d025ab4d72826c78ffdbabe422ff6253708527371e7e
SSDEEP 12288:QVPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:ynQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1355523693A69F4C7FA2742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 31c2265d41701d37da134076e867f5cdb5b311b8ad67ce55831e463105681833
MD5 6a22cdcc499e27e8272efc5eeba9623f
SHA1 bb92f2757adf9fa1ed2fd372ae47fb7ab68e85a7
SHA512 12d00b3d987c0754032073143ffb99c6ec00f1bc4802865a79e2e25e4da4e4ac5f607333ebbb7239666af8f636a1e0d6fa9c2c753e905511612f39e30b5b7803
SSDEEP 12288:SnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:SHnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T14B5523697965F98BFB1706F14C838182973B0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f9ce59d6d8da7ef771b50eb2062761de09be833617d3963291b1db34d6013161
MD5 dcf3b1d9eb53d24f7e67ec68dd1dc0b1
SHA1 84aa06176f34eff1c7b5ff4b28593c80d2383166
SHA512 52c37d83388ebacadebf2c27a6432485885c656f4373cd1c72e0c2375694e0ef11505d6770fba68dad205a8b3d203e16160cc3cb0ac4151baa82281b60fe0d56
SSDEEP 12288:NEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:NknQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T13E5523697964F98BFB1706F14C828182973B0EC7BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d090279ea0347e82b47d7737f3b9aa01e04a5901780cfc796d377b4c925bd168
MD5 3ea68014653b38cdcc13d67ae6c0ff73
SHA1 9c5dd516add198f6699c51927035d53c857edc0c
SHA512 e17028b0d426e2efeabf616365e6309a77d51b511a316d2b3a984ba6c5cbf1dfec368a1607640b97cd0cd1d94c2c838fedefce8ce06579bb7e97ba3a32b92589
SSDEEP 12288:HwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:HQnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1185523797965F98BFB1706F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1827925860372d0f57c5d5b31c7df94376162fe4156651bb97dee449fdd36ec9
MD5 532d46479855508671c4e43096828543
SHA1 36c938550ad0c945645ee897b0ac3b87b4581570
SHA512 217f7a397e18f396dd971f4c78f8d1e01b0583aa9fbf6ec6777c3a68843dfb3e36ab0b6dfb24b9de2e12fb6e284bdf9aa43a177b7ab2b2dced803e875fcf46cd
SSDEEP 12288:qiZwbDzzFEoS2cPvyYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:NZM3zFVSOYnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1527501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ac8bc53db3c7057f28a377a6b4b25af4a5e659f0dbdab9c55e6387990fba406f
MD5 62dba372f120eb2ab7d908d34942d69d
SHA1 f7e9129045d296bdd8854574736f9935548fcfed
SHA512 c6639f6e4b451652ebb40cc3b510a468d4749c1c39d311a51d91b26d4e74b7f43721d1d545309bff431157b2f248e7484d59bc0af0e3c0f5337d347a768d90fa
SSDEEP 12288:OhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:OxnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T10B5523697955F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C2128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 aa62ac410cb5b640ae66442df5a2789a5747a70a88fc9d0f010d12e005424bfc
MD5 4f10a06dee0f5c9c75138cd2e05fb364
SHA1 ce6755e0777f1eb900ae18ce31e39f287448d44c
SHA512 54cb8c9c68a0eb4e58003a4561a3122860e2bb2665e1a7dac0a54d457fd18bc1faa2ae2106fce24db6b13f90f6260efa48c70c3ffb159c0ede06cdd6dc16a4ff
SSDEEP 12288:eFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:elnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T14F5523697954F98BFB1706F1488281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 16b8e1011e1180324a5d64dfc1d0875c64cfcbc4bf42f07e0c9e20b4864ae536
MD5 6970cfed7129da5f82177bcc36571230
SHA1 fae62d402f6c8332cbb0e649a98a21e77127b6ea
SHA512 b8b98b919cb30b2ca966f76ebea2560ca2ec6adb3f842fed263330eebe6f1aa48eff2bb92d4342c65e0c2f42cf07276b07095ab13d767b6027bfb5b2ef616066
SSDEEP 12288:qyPz5L8sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:3zysnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T18C65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bc2e6ead8fcc4a49df8afd7b907d79c3641f525481509be207e1ad73a7c00119
MD5 4df65676ba86ff46ff66c8936bb88cc3
SHA1 62569bd395123cd5584020501d37180316a44661
SHA512 d34a347b57353a1f3ccd32f85ffa7cb941a1be54b843b3a8ce45413d1c12f96fd8a6c7338dabd30d13f2e7c6d87ebbc6a25effa22527faa365043ddf8a02d478
SSDEEP 12288:khGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:kxnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1925523697954F98BFB1706F5488241829B3F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cf13762ce6c5b0e8418542049fe1a62853f9da07f60c1709f2a42f166e50709f
MD5 d2b2f0a09b91e2dd7adf0329ea01c3e8
SHA1 ebf2e95399d5718c6c08492af4891b6b1eabb91a
SHA512 30c82bc8e4efd6a958401151e0cf59ccde6945e07acfc0c58c6a312f1424db9e90477dcca63d2ae850513d7f997fa2badf2ec6d45d804c7f953b165811216c0c
SSDEEP 12288:ihGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:ixnQ/tbw/2Mkjy6Fr7g0of
TLSH
T16F5523697964F88BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 97dfb23ea185ed75cee8e58ef9575043ddedc8fef9a7d444413ae54939e4cb65
MD5 64cd29651beeb0fea5b8cafdc6ed9134
SHA1 a4253743f5695f2361b0e125f0050cb8f28ab69a
SHA512 b0eecbb17e6c8e89f739db8aa4255dfc41bb4ef30a1f5785047163ace28b390e60232dbb7b55eafb8be82f3048001cc81d3ec9bca6aa0d7fcdcc371ce4194209
SSDEEP 12288:RyPz5L8sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:AzysnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T13A65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 bee39b38ddfab6fa32469232b27c264c34099df5515ae40260dc12be536b1fce
MD5 150ded9820316a4604a0f061736fdb88
SHA1 e9a01a9904871d30120abd87e0827e3ac5c1151a
SHA512 393dfc200845c0bc9ba57ab73ead207b9d92cee1247113c8299cabaef779c0f62cd2019f77f72224d348b7a2b483ba52d1c8e56db86b6c6e814e8fc7a7f23dee
SSDEEP 24576:TT0aLl3z0zDKnQ/tbw/2Mkjy6Fr7g0o9:TTDLljLQ/lFTjN4
TLSH
T1A57501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 0e58476865a2148a6d5daac5f1ae13b60debbbc74556d3657e1042cd5a6b1e47
MD5 f818bb8fccb6d71630b4be0889f09740
SHA1 4824f88c233d7c82dda57d0529f0c1eda7b0d90e
SHA512 dc9613a1ab86bc3b14cea0eff87224977995b690f3afd4c3e3f859623e3d2d43b562a19a6d3629f3ea2cc2b8be0a8df3a0db153832ee206be0b40238de5267e0
SSDEEP 24576:T31d9CHKy7GZGnQ/tbw/2Mkjy6Fr7g0of:z1d9CHKya0Q/lFTjN4
TLSH
T13E85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 94ce3ec032d89ad98f42a8453eb783ff0d7224edd30d3b74c63e35d710d7b884
MD5 fefebb213de7b92d6ad3b387cbe6efc7
SHA1 2007467197b1d9f9ee94e9c30d994f2b30058b86
SHA512 95768daa58e82a86d63ad25cadc48acb490335aaac50c98ad83cb84dc5e7bd510e1ccb64c8fc5495f5c5a9902b59c2df80ef89ef146282f6c261fc2aecd0f2ba
SSDEEP 12288:O6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:O6nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1B85523697965F98BFB1706F148838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 85d7432449f0326c64cb2ef5dabf654c61b845c88d20358081e999eaeca141d1
MD5 9bfb3c8721bd9430e818f3a2dd4c9a0f
SHA1 063dd249e5bc09a103a0921eb26541f2088dd50f
SHA512 46fa180540ff58dfdd1f51555bb321a46e1cec43a1f417aa645e4b784cb030d16aa720138d9167ad5866e0d21a2b625985a5bb2efaca8b1b24177f7335770030
SSDEEP 12288:YMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:YMnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1135523797964F99BFA1B06F148838182A73B0EC6BFD1938F7B482129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a01b9ef28fa0e9cced63a5d5cc1f89210a100f90932bcc3f2f7e9ace4e35844f
MD5 de6d76695298251fbf7525eebb3f2f1c
SHA1 eb0bcdd6a97a9bfb5444e098cbdbe2237ae91228
SHA512 cf58eb44fff353245c947e890da84109f8d74f5e1d01235bedd06bf07fb5b1130a83eb1f94e61066df4e61ca00cb127032e2ca3c6beefc6add0314faf77a389f
SSDEEP 12288:uzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:ujnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1CF5523697925F98BFB1706F5488281829B3F0EC7BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a731a232dfa1107526ad60b9bacad318243320f60daf21acfd4a54f98bbff805
MD5 fca28c79f3df67077187aa539ebc2d76
SHA1 07546003321f45204472fe036ac024dd8ec27378
SHA512 c1ef6d15b2d25168080cd4eca495b102adb418a5f763f7c8942de618959273770e3ddbe33dac9c32ce9191ffed013b4632c5fed603296c9172ba68230839defe
SSDEEP 12288:6hGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:6xnQ/tbw/2Mkjy6Fr7g0os
TLSH
T14F5523697915F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C2128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3517c830e517ad6f81a80bff4f680d08a1b6186c343f5dc0d687d3d504fbb3e1
MD5 b8243be564d0606069a9e208c477f2e7
SHA1 bd03a52e28bc1a620caef7b83ab925b862cfaf95
SHA512 f875600c3eb658b0f8077f507e782446a2338eacdf8665b27aea3a162fdaae34a314ca60daf78dc7b32d86c4e0f85a83e432d166bd2d870fcb49e3cdf03c012b
SSDEEP 12288:O6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:O6nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1815523697925F98BFB1706F148838182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3ddffbbd0de4abffbdaf53725362d6bf759157fc2e2b678f082b61f8b3bdeff2
MD5 bdd5c86e6a82b36d11c6a381ee4f84cd
SHA1 ad5c760ca3254b32ca5455543ad672f2fb533ae3
SHA512 443aa233efc4ccd8b7d36a04ae35ccd6b569a0a2d87a6e85e90aed79766b578d6a65b7db2cd609a0428ec0b3e8a38e727bd4d9faceb65f17f5c34361587b5ea0
SSDEEP 12288:3ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:3pnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1F15523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B482119967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 bf9d4112935f1d26c0181dec54b33b2d381719222d89354872303f815c98aef3
MD5 75ed701c580690f86bee8136430c0c2f
SHA1 133b5aade55d8aeff9548221b4255ad1bb59b9d9
SHA512 0635c31202f075a1485e35f05b8af2b8098900cc915594b7e4a7c67967dea2cc411e4defcf5daae2f7d98b2d3946c6ef89004a96ed112cc72bcac9eb8d7b6769
SSDEEP 12288:1nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:1HnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1BB5523697965F98BFB1706F1488381829B3B0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 37aa2183f272d3a85f1f6b7cf1a4512300ca80d4c3fd33c81205b04c6163d08a
MD5 657da67991c041ae8ef1c7fd9c834592
SHA1 676ab94c3f7e3cff1fed1eebb8e108ed81da4823
SHA512 135c2aeac06b9968cfef332148232bfb9fdaa87785529e8e0d636921163a429b3be1d762ea0d9956cbe84f95e869c60b9a866449bbceab19fbc6fbcc4945d44c
SSDEEP 24576:Lfwv/k9RX6wkyAI1nQ/tbw/2Mkjy6Fr7g0og:6MnYI1Q/lFTjN4
TLSH
T16585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4de9417295805c30f02092265fec1bbec19970c553ab71500122238747bf35e8
MD5 ab181707f23cf59f32dc1719e388c5b0
SHA1 894f8860cc698151780837c518428d771f9733dc
SHA512 5e311ddf20116885bd932b8981c8fb201fee810da14d7247bdf28c141714fc430db2cb181a75c135613e2f8d24a470e5ae4711d819423ff6cb26c1435e2a95ae
SSDEEP 49152:+YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eQ/lFTjN4:wySzPRLm
TLSH
T18B066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8bb927a58e302dfe3e4d1aed9a0f45a351bcd612f8013b41d745b3e3f6cad213
MD5 e30c092eef453930e8f75b82d771a9ed
SHA1 e290b401b733eeb37a55aa8e603930cd9a2d2973
SHA512 13825bed7a0ea4251aae5a582a90738e487527cb5fd4c8fc55f91a3b0d91d766bfc4c1f695f4ab5fc963f259dfc45c10032f5a04ba9d795deacd72c3242b651c
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYonQ/tbw/2Mkjy6Fr7g0oD:l47JUQj1irIhCnDHUPfF/uQ/lFTjN4
TLSH
T10365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1f2887cac1c899b7bf14936ade4e8ce73f7bcc1d5335ede439dc6f7027957be3
MD5 2dbbccdd794321289a63072238a5a8d3
SHA1 6f7ba06ffbfd4a33791025e443c88a2f67431417
SHA512 727a86c33d66bd050ef326711ad09cfd456f6d93a35a815619e00ea478f0b720eeee88b2f458f397590c34e4986434b982ad7efadfb2c3513ccccdf2d6292780
SSDEEP 12288:+ssfRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:ohnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T13765F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fe974684359c0118563b1e02b06b9cf1cc744e0d7e6f014429a143e8255b59d4
MD5 3aad557bf411f21aac57558c1fbf66c5
SHA1 bdceaa873275ab528eda8f926d076d24eb0b855c
SHA512 1728e6df319c1d2a14ba406e55f7016b15b45c3deccb07a3e702140ad5d43b4154ee38826ee5c9a1f0eb9a29ab650d43a2ed35fcf33ae558bcbe7cdc0c34c860
SSDEEP 12288:BJ5ypKDU3fgX5NdkUh0xSSfukFzI5OEaZRMaI2dNQq9yz:BJwp8UPgfTPeM5laZRMaIANQq9
TLSH
T1B04518017626CA8FC6A940365E76D6CCABB07D05EE046F0373C9873FD476A59B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 0ba267f9d25fc99d3880f364aa27d0a395af6f2c038c6bf5cacded8342257142
MD5 90dcd1d42ff0c85c143413c7a999c877
SHA1 ae3d2b912c84b1c57092db756754826af6a985e6
SHA512 d17ec086c065b8d3c2d05d96d1d44424bec806a6df5a4b2e9f0bf727f3fdc78aa17030ff8fdb9817be88afc4294640ee0a90043ee75ab666f8a71a1c8489491e
SSDEEP 3:OlH/lYeNLH2/ms72I/lbl3yjIl/lllo3mCllltGlslslslslslsl69XIjrN:KKeNLGmSPBOIXymCtEEEEEEEC0
TLSH
T159819240874E0630E95EA0F2094A57AA5336E016ACB8A39B154070A13C8126C1DAAB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d81194986230d7d4035bea78fec9de06454fbcd0de1c62dcc545b29373cadcf3
MD5 3f95d6f55a8aa8089bfb6f8fadae12a4
SHA1 530f1f86fe1a1941e34581e4ef38e1dae815948c
SHA512 cfe769ff874fcb67f2477a49b2d2edf394897ae951e40fa433c9567ce5ba258f00608b95697dff45cc4a0246853d62d01cbf15ac742d555b0da74a27c8f124ba
SSDEEP 24576:NmUpf5Ro/AoSFlURRWVtQ7EZWCAfKJpN/:VroSFlURR4XAfipN
TLSH
T11A650801A5B7DB0FC97A903B4232C5CDBBB86C07B6853F0573458838986795EB6E27D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 954d5e0cda156cbd3ea8dbda1a0dbd4534ce15fec5bf53e3a4720a9eb2177ad7
MD5 0f2db6fadc3727c05c7724bdba0a1784
SHA1 1bc196e4170a8baeb3fca376aa4f87fe06266f6d
SHA512 899e377c00e47aae13e3c21636c4321f2d8ffb1411a3f00d827c5e73a5978c702dafdbef9ffb7c5d1d0b1622a3288a71f3c4c45742e16f219e38164b2a6a81a6
SSDEEP 12288:d67JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:0ZnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1ED5523656668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0d719714aa7d21319ed11bb0ddc414dd716daafe1f7e81de52934d63c03561ca
MD5 c77856a0751ce32af68344cff153d5b9
SHA1 7cb0a0327df1a550812a1988f13becc32c0c839b
SHA512 229571badf9cf25bddc0ab780c1181d2f3e8019d5fd342631c05764d86099b7c8742a647e57c52cd0c3ababe6d39927719811d8c7547eb26fc2272ee918614a9
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYLnQ/tbw/2Mkjy6Fr7g0oM:Xgb4mBIBhGFoQ/lFTjN4
TLSH
T16565AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8f7080e0f77836a4d8c8d0406aace206b3b9adea54b069732fc09cee0bfc5c78
MD5 f672e9fc8df9e08a62e4f357707603e5
SHA1 61e1643aa22be77f8177256e4b34f9afc53b72b8
SHA512 24ebe38150616504fd6ff51a2a9bcb2879ca961c8bd818ee57dd12edb46832ae0248bc8b70d0847b096fbb45de79d01d50772718b8ff18f7873d13f1cce92bcc
SSDEEP 24576:JG88u8FpJqH1Qzria7/mYnQ/tbw/2Mkjy6Fr7g0oB:c7ZFPqVva7/DQ/lFTjN4
TLSH
T11D85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3ce97a944768af52bd283393291b0b653f7e162cef131f91fcd50cc403844a76
MD5 3dac6f8934b214f80141d115e74f6f1d
SHA1 fd72f87573cfb628ac40c1cb62e7a301f5b2063b
SHA512 c515ad4ad3f96b73de00ac732fdcc59b07a779dbd5ac1ca751c5c9bad3abe7df0b46c5660da262f14af7777447796da728ad32d52dd11ef0362f70e60cfc8f20
SSDEEP 12288:/HvUrBFrEjwaQUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:/PUr+NQ0nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T14165E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d13159420139f728f6fb5fbbd8edcda60bcfdcaa174e00197791ef4232752d65
MD5 b0efc5d14d284cf085bcaeff82c721b8
SHA1 731b1246d41418c646527c77e47dabf356b6b962
SHA512 ca58cb5f26dff59e190ea782452922795fe0efc0c5bef6179fe81d12c90070af3a708e9ac954ebf8518438ca03fdaa621de7a2a441302328b9c787302e2e3bdb
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkQ/lFTjN4:LG05lO43biLm
TLSH
T19CD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 01550ff854076d712180829db3aaa059f666115ec5a0c1b719770eed4e4abf25
MD5 02cf6e59ab99bd166135c489878a046d
SHA1 08ea39eabc892b666f01cff1197e8adfe8066890
SHA512 dcd68e21838eda41cb0358b38e4c2c20af2dec02aa90aafdd09ce711a36d39b10a345455a440e310dbc3e0a6d933154b2da670a93121f6aa59c3bfc38389d885
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnenQ/tbw/2Mkjy6Fr7g0oS:Ga5POZ3+Jt2pasx2+mMQ/lFTjN4
TLSH
T1BE65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a0f02f15d5ee1342a3e9f8bd729775b801b6302186690e6d0554adcc9412cd93
MD5 51d96cb889d7b739ed160ac9bc273056
SHA1 abf8019f2291b14760bd2ae05f5c6bbbf26aa958
SHA512 6276fc0b72c7972a71c63fa6356646140892540a17e5bac998f8151b5e9857385caeead9f67d61f6a0ef693e502a65850976ebd5b6a8a1a69b1fcae35ebc86bb
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FkAnQ/tbw/2Mkjy6Fr7g0oz:DNc/zEOVHFjQ/lFTjN4
TLSH
T10F858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6444aa5f366da802ae2d9b9cf37e7cf10f614956838cd06919cfdd73e4d517f8
MD5 fc95557645f0a8667cae28087d819909
SHA1 44b4ac667ac9c0325388fabff20476a08228f414
SHA512 50cd8fdf2a8871f256ff702762e28da846605ebb5e43c785ed92261b9a2a77de502d631b13014af29718dc807689574594e6f6895037699d7adbd7edf6eeaf0d
SSDEEP 24576:z8kNvNnaFeYhJNtmZBminQ/tbw/2Mkjy6Fr7g0oA:z8MwBtOmiQ/lFTjN4
TLSH
T1D655AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9ca7fb664cda929353fcdd3ef12bc57c7786400833217115ed5df4fff5cf23b3
MD5 657bcbfd8c3ee9cc3bff266e7652d2a0
SHA1 33eecd0ae5342130d61142faf23bc877de441239
SHA512 2fcd410632fe6b9291694488af6b6ae88d6153e56f47c34afe8db3c16523e4975c797a0d2584efaba668962477e4c3e27a970bf3b6575a446e20d128685bd6a0
SSDEEP 24576:sD3FHshBIYQgA9nQ/tbw/2Mkjy6Fr7g0oG:sDVHeBIAA9Q/lFTjN4
TLSH
T15B75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2396-327-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2396-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2396-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2396-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2396-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2396-94-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2868-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2868-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2868-278-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2868-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3040-0-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/3040-1-0x0000000002610000-0x0000000002676000-memory.dmp

Download

memory/3040-8-0x0000000002610000-0x0000000002676000-memory.dmp

Download

memory/3040-86-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/3264-295-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3264-72-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3264-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3264-66-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3684-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3684-45-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/3684-39-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/3684-50-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/3684-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3968-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3968-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3968-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3968-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3968-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3968-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4208-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4208-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4208-114-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4208-120-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4376-21-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4376-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4376-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4376-20-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4376-13-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5108-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5108-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5108-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5108-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5312-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5312-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5312-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5312-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5312-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5896-127-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5896-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5896-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5896-133-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5896-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6032-82-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/6032-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6032-77-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/6032-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download