6de70a90a4e07a97c12f92af691a28a6f89da5aefcfad35a13a1f1d76c3d6e88

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
Size 19.4MB
Sample260707-tkfdtshs7x
SHA256 6de70a90a4e07a97c12f92af691a28a6f89da5aefcfad35a13a1f1d76c3d6e88
MD5 6f26091701f0677d8d946a3c5d565292
SHA1 cb30a481c74bed68cf97a6d3fa5824620812dc78
SHA512 798c0fb786b91ec52399daaf2d361d0300beb7e7a53e9b03bc80de11e5695bbd0ecf7cac6fe7ab5608cff115cc6969a39d3b9a53315e055d7c9e05aae0b805fd
SSDEEP 196608:WJamCp0kWlaw1GCbCTsdOnIsfIOXxzNl96kZkCV3qGfxm7ym3dKnRhuWJITStGEe:kUfI4T3V/wmm4nRh9EStGM6s6tpiDy
TLSH
T1E0277C81F7C782F6D84708718057F77FA7206E05C424CE66EB947F4AEF73AA2151A21A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1816	alg.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
5036	fxssvc.exe
4048	elevation_service.exe
4836	elevation_service.exe
2684	maintenanceservice.exe
4984	msdtc.exe
5048	OSE.EXE
1392	PerceptionSimulationService.exe
4232	perfhost.exe
3416	locator.exe
4948	SensorDataService.exe
376	snmptrap.exe
768	spectrum.exe
3344	ssh-agent.exe
4060	TieringEngineService.exe
1648	AgentService.exe
1532	vds.exe
2356	vssvc.exe
2920	wbengine.exe
3524	WmiApSrv.exe
2352	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\352fd11bf77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094769cac2a0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5e44cad2a0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ab397ac2a0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028c007ad2a0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c44db4ac2a0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3c2c9ac2a0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb10d8ac2a0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085d6dcac2a0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
4048	elevation_service.exe
4048	elevation_service.exe
4048	elevation_service.exe
4048	elevation_service.exe
4048	elevation_service.exe
4048	elevation_service.exe
4048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3768	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
Token: SeAuditPrivilege	5036	fxssvc.exe
Token: SeRestorePrivilege	4060	TieringEngineService.exe
Token: SeManageVolumePrivilege	4060	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1648	AgentService.exe
Token: SeBackupPrivilege	2356	vssvc.exe
Token: SeRestorePrivilege	2356	vssvc.exe
Token: SeAuditPrivilege	2356	vssvc.exe
Token: SeBackupPrivilege	2920	wbengine.exe
Token: SeRestorePrivilege	2920	wbengine.exe
Token: SeSecurityPrivilege	2920	wbengine.exe
Token: 33	2352	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeDebugPrivilege	3772	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4048	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4864	2352	SearchIndexer.exe	110
PID 2352 wrote to memory of 4724	2352	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1816

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2796

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4836

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2684

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4984

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4232

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4948

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:376

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1112

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4864
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a6a764670cc6b8953912ed1f4d72f485a688978a4fc3d1141f91046e5f0ee751
MD5 16670a1948a49fd6897d77a70cd2d264
SHA1 0acbc8de6eddc8c8bf2fbfb85327c8742985df81
SHA512 89e37048730e782fec17192607cf6d06080e6a7af71c255d92afaebd256760b9fb02adcf4d9d0aa4487cf0ed40eeffc2c8d5358fb732ffbf0609a355e8d8a729
SSDEEP 49152:Pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxniQ/lFTjN4:N3q6HjBiLm
TLSH
T197D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 303a6a3229f87f6c7055efe43ad81be1af72e10033c46add7e78659f24910a53
MD5 12fe6b15ee8212d5be2c6137789c5da3
SHA1 f9334a839a3d8516b089af53ccd56f4507f73863
SHA512 49ad2e3d9b928e739d28545a0fad2b0d0896ee4fadde181593565ef44e488effde5dd36b502f6fb5a7c5a05b3546ed69891b0e2728fd85c9197266cf6a716947
SSDEEP 12288:w1XLsswWkxy2lRq2czABGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:mXYfDtczARnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T17265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c0db810505099265ae6a4fb66106a7eb7dfde40c0200125cb5e3ae3af6517ba1
MD5 423f2bbed8b88f6c677ac4f6f5a0a651
SHA1 a567a78dce4e7f66526843a50f502fa460d6b073
SHA512 54e2130e4c371676680fc890e3ad5ef05d0b8abf327d9d29b0efcf867014ba025b0af7366e44b169758b6751d16dc264807693e28c69aa3375bf2c771440ddf4
SSDEEP 24576:K0Le5ji0hmxLrMKnQ/tbw/2Mkjy6Fr7g0ou:KPji0Al3Q/lFTjN4
TLSH
T1E0859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c9c0f65cea11877d4ade1edb563ed14b5d9a3b9121e8c6b80b965d541fd0bad1
MD5 96a0ec96c3e43569b84e6c177dc17b24
SHA1 307ecc8cfc3bc68969d8ae8f016b741723790525
SHA512 d6f912b9b21957fd80f8b9d11094aed5095bc23ddb141d83564d0e5c5c7907d4c8c697bd9e80d1098b2032c88115a04bdcfba64996df529a7aecdde323476942
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyucnQ/tbw/2Mkjy6Fr7g0o3:6/ezSC6vUzPvxHjyrQ/lFTjN4
TLSH
T127755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e57a1c8e23e1aa68fba150a1576e5aba3c6f8b922493e1c87505e50f29ea3680
MD5 33780ea46395639a1d76695ef81cd284
SHA1 340ee5d92a4193289c595247ef577578964abae1
SHA512 87d5444463a88cad3c079e4b2070e35ec2ac9e6316e1460bcb29d3a3ccfa0282dc2a676d9bb6a4446c6ea0d15231c81f65985b39203e90fe5d3e8d24d9056d5f
SSDEEP 24576:iVbqPb88hv/l+6dnQ/tbw/2Mkjy6Fr7g0os:iVO88hXl+uQ/lFTjN4
TLSH
T104559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ea695fe3a037c2cd12c53427472fda72340830acd0befe50db70ccc8461270ff
MD5 2d9c9c07d2f14f9eeeb7be7aa1387fb1
SHA1 8c937546e278e62cc62ba2e7aa2652096e19e690
SHA512 ea3fde9d8bcd6d0db892b33712d18596213cbb4079d342e62b784d40da23ef59e926b40b3a20cf0f68c4fdc99a9ccf25f643b636929728729303ffe8eab6ffc3
SSDEEP 12288:/zGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:/zmnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T13E5523796A24F897FF2B06B15C8284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3972a09e7e30622370d17cf9ddad1cc95d61e497c6f84f30eadd3683f3cf53e9
MD5 55646d88aafc4c5c3b542906d2e89099
SHA1 a5672f1a43866cdd0c68b086168c3721b9fa8918
SHA512 dc1daee2e5dbce10fb0c523bfd72afe3ec30964dc397e614f8f459ae12d70ee2c361372bee18616504aa01a524a4bbe1029faddb08f06d89221d22b553b2b170
SSDEEP 12288:YeBNUbTVO86UFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:YJIUlnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T13675CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0317a5ef745c54cc6ddc56f00c236db411fd6173f576970b503f02637ca92384
MD5 c1135c5b88cab70d5368127ee09840cf
SHA1 ec08b1d99cd2655f5d5e28154448044910c9d875
SHA512 b80e4a9e3fe55375c9c2bbb61a3ac36557ba4827bff2a2f903e0abc18d4f4913cbf70c9ba1953247ed66a827c8da117a113eea3b6d520338b46112acfc6233fc
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:FQvGAdlCEL8c/yRNw5CvLm
TLSH
T17F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3da7b07f667a9d7390f3e105b1c0e8a4a8c5f7878e53473f6b0d79ed232c230b
MD5 903d6a9250bc50be738d902ffd577213
SHA1 7b13e911f6ffcba93b00f639ad016c4ade2a30d4
SHA512 2fe9556d5869647fcef859e9313071ce6408e0c7959ae372c17030f616c703741fe4f4b4fc7b0e324479f78c2730decc5dca1d186ac10670a509a7c39d40dedd
SSDEEP 12288:lAwSfxL/2Dc39DLLmt0LDQewsAjHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgg:GQewsAjnnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T13375E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3bf151c11aa7eedc1719fa5739ad6a642caf05f8d50223ae5af490ddbaca04a9
MD5 120d80f187fe45e198599e4aa827e86a
SHA1 11f79d838532131033a0bf53dad4736e106c4e72
SHA512 211596364a517e66b60efd81b160d4d7b94c07f30f1371cf11bdf1e46c32b99cdbef46a49da585c3f8b22da22fff1d7d5f536d806d713bcd5dff412c26ead1a5
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0L:wUEtQevvqc2W1cpV2EI32
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 765784954f54864186335803e6ea0b04ea6ac302c0588d22fbdd065c207cc2cc
MD5 5976e119f4240509c4d4070c5b5ee677
SHA1 56b07eb0307c738ebd1d51a52ff2ef2c3984778f
SHA512 880e3c5f1d6d1b2e6cefa441220231c5a6f8e1f2023d66662c11589b7cd23aa7e702aafe70404898c9ed91be569415fb8c719e640cd20a2bd31a346722d5a9f9
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/zHQ/lFTjN4:FoqtVjnmjLm
TLSH
T143D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2a3e0f8f0be375f0d858f96c23e83bf2b4a39b49b0a8fd733cf78de6fdbfbfd2
MD5 10fd50525d13285374b0073f093f4041
SHA1 8cc916879902c7e8e9a01ae79c51de85afc3e7e4
SHA512 f77efcba2745693a0d46ed1f5bc570ea09b797305289633ed10409fbcb2c65be81c9384ef376b23a61fa55b87516d1cc3fbfe9a6a6a63791e5b991a3338f0cd9
SSDEEP 24576:SAhGLJIFoiwtA5l7S53wnQ/tbw/2Mkjy6Fr7g0oc:SAMyFoiq5AQ/lFTjN4
TLSH
T15835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 09ebfa63780e8a0ad5778981c313d7a1bf7476128d58249214ad93fc7fc14f40
MD5 f2f00b0b30fc1ae97ec75e6885f68b50
SHA1 77406b90b9b1ccf2f4382caa675c0da37b3ed5da
SHA512 9c2464d5b6866bb8303f3c6b7d40875c2fd2e83afafaccf20e2e68ad2c4374b9a5816c8aa2ce0784ea60baf6a282e9ebc32c7946be874996fc44771d9b7ed742
SSDEEP 12288:xmw5HEjsChN2BFgl0WDm+C8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMu:swuHOWLnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T17565F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 38c73999b5f797f6cb7327fbd29bb92f955b55492c8aa35c87e79e18cb134ac9
MD5 70ff3f504a7ac2ad454209c103034c2b
SHA1 76febbba4bb165c2ef65a7343e2ffd117880deea
SHA512 e2c3df118badc4d55471e333f4e293c65e3993bc45d861f6cdefdd4458f9c3103321331ab735a39d0e39d6b176cd2c1c6aca06644437c89209ce83c7fa654b30
SSDEEP 12288:DXZ1Iy3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:bZuSnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T11555126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a2d70afef4f76f87e7036c4942365d1a1c9ef5dfd664a6866f72b0bf26951abc
MD5 51a34b97197ed8ea22b67882e0ea6358
SHA1 c28f7f66264a9d0827d6fb45b302ebeed852062e
SHA512 084e69326702885d718a91872e5182e1583875eb11e6404dbc1f9f990c4f7ac79f9e6c8b2b8c63eaa87a7fb8a0532f857a31b9a68cc1c8ec71a514349c507966
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:9QRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T194666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e4bb702f856a29b313061ba307d03afac8bf551da7772ee4edbb5fa6580d9824
MD5 96c378c52a96bf934e61537ca9fa35d8
SHA1 f0146679454071cdda6004996ddad17369b0df6a
SHA512 b83f1aa48cceeb4892a0348d500dc281915921aa0ab6a925d5f3c5e931573e5acfe91a1f6d62f6e12007694124926c75ea6ff8fbe0a90cf2caa53b22f2ef7fc5
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:oQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T119666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1488b7b3edc8a72c2e85d80c2ab7b0f1a4c83b0b10ba3efb8c535adf8646d1d7
MD5 520940353ce44d833615d5b4d7612c55
SHA1 98cf90aee2ae4a08da88c88cd79d4e6d47a33923
SHA512 d0e09e353b79d6305e80633a3052100dbc2669aeed07eadadfeaafc6908b352754bcc46d33004b138c2046cf876fb24062faa7b3dcc56786e720c2eb848dbc5f
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0inQ/tbw/2Mkjy6M:568Qg55nhheWu7PNU3/3Q/lFTjN4
TLSH
T144B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6b8165f634ed74ca976167a54acd924bf3f23771b5df7f84e27a69c626c8efdf
MD5 74e32b362d10db43b4713a25c3287ca4
SHA1 b2a892417a4d5d11a8e076d1eab7fb95b7f33962
SHA512 26274e798f8392d6b3ce3fee5c0b22d3e99cc1ecadad322a207f76ff7d8d173b75dedf0becd21fc00e945d2fe6c0e4dbd40126f00c558bbbfdd25dc7f8ec7c8d
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99v:qy5112gYy5azzVvL69nLKnhZxLm
TLSH
T16E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b84163fdacfbd7a0fc9550086d5788df14e0a1c0b6a96293fe472429f252db9f
MD5 5220e58e256ab0e1e6e57f8dbc21e33c
SHA1 61addce7becb074e4d7ea8b253ee5af1f858ee4d
SHA512 1fec2c76612a09e5654604cbb36781644422c9ecad54581b1bd20941b65f7056a91a2a9ffa3510089f576aa050e392980ad561fea5affec43209bd7155b47e82
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glhQ/lFTjN4:pu6JmVxd2dGLm
TLSH
T1A9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 35f5014cf0e889eab8916ac7f0c96e99c5b67020b5139b2253fabc5bb7c5289e
MD5 23f43456944fe1d1ee8e3e4f68c4e21e
SHA1 c579ebf2a27ea4bb958db024bc68373952b0052e
SHA512 47959ff61999d5ee66e3ff9e1a6f3d500deb9cb8b754e79000eab2c6e187ffd7d77fb711c7271040c01bd114b08ea1f3333803a232e82b01ecc6b3b4fdabfb97
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xFQ/lFTjN4:fmifPbRjLm
TLSH
T1E4B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d3f16cb4c08b8da77fc32575c7ac2a017fc3f27dc9e6416ff22f21129c228e94
MD5 79ef86c2248befa8618d73d9f2672848
SHA1 8acf07bdf9efe709af582176cd7a749537ff20fe
SHA512 32503bd4b340ad26ef90c884bcb4113e637fc1f783bd8115d8eed7a153e54bf45036e5315c540e5cecbb26cfdea0552b656abee7358eef7004594edb7dd35e75
SSDEEP 49152:3SuZQIY0Be2KRRVtOnks6NMHqSQ/lFTjN4:t5dKTi61dLm
TLSH
T15BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7e22d9e42c76a0c9916bc06bad1df883481afbf6a028ace138e13bbb40df2d4f
MD5 2e6a4a762bbd21565adcfd37d58a1fd4
SHA1 d7984f6fd483318d64b4409217fe519512886209
SHA512 a2c207673ead76dc21d15327efab0d77ac2893f186cc3d82ff0c01894673921b475f20f2bf04b541a36c2152e129682f2488ea87411f3da62bd7a09edade63eb
SSDEEP 49152:lhtSn8EApI0figngiDn0AP5wRQ/lFTjN4:UX2iyphXLm
TLSH
T1D695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f610d66c166a6087fa4fe34af720651f4a32d4a251599640d9e5cadcf73f70a1
MD5 7e1ac5cd7297c21df1d36032a68b7f13
SHA1 31d9485744a11a2e177135086c5440a378464f12
SHA512 8b022c3a36d5153c53d37a4f59b8194c24ea8f1c585c25db1ad34b0b7db016cdf99e5944bd68486fcfb067b6c3afbc10486b2e41fb7de51e884160024e5466e9
SSDEEP 12288:0uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:0unQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1CE5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ccef5e99339b73f76e20fd76f7ab0c239b3f69b135401ba073e53a4dc72c698a
MD5 72caecdd3a27672f32657aeddfe8b72e
SHA1 8dbc4f525292cd8fbe69f3e93d7986dad23ed5fd
SHA512 a66f1995ccc16bbc3c70ca7bf88a0a225978cceab77ce2a197cd17b6aa899a41d2339d9b88f2469b7b59a095a1c7ec2b965e09d999b0a1ef94c8a504669a57ea
SSDEEP 12288:zTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:zDnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1AA5523797965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2f1b5b1bf3169f437033fdd90fd9e8d89f3ebf61877682aa43da91eede45f688
MD5 9becb5a65fcd21ffaeb7f7e2f93081a0
SHA1 e8156485ca9d1e42fdf95bcd99856d4a512c123a
SHA512 b3aa9f11518be635f2ab7253bf06b51cc29ab9bea2651ed436a566b3fd6a8c9573380718bc86b1ca248ff1e67389e6f46942cc72898f8696fd675d8acf2efe55
SSDEEP 12288:CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:CtnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1795523697965F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d00d944815ae86b7a145b68823209c84ea3435d3682347ec09d566c6c3d2606b
MD5 596f28252f166de9f3d56aa22a96f922
SHA1 151158a7dd5000f405b227e3d377c679eb68d30c
SHA512 ed8fa31b41654fff28e27e41d83af342ad86e54580d24096cd5be4c281858290280b42e949e4b9603ee8dc7ce7e10410b4d5fc19cc3de9f206dbf930fc21c654
SSDEEP 12288:EVwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:JnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T17C5523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f8ee880836cc7dc7e54099ef227c7266e75d51009215b10ac52c43da0ab7dbb0
MD5 f0b57c473622108fcdbc392a0688c384
SHA1 e3a9486a1c452e9c0ed20e84a4baaeaaf4a20d05
SHA512 f0583fe22de10140092a4d820aa25cf7febacb52f5e35d35cf77b83fa1c43b850e56972014bc9f1f75752e9de14297e655bf238b8d86395ebcbbb1e9a34ea643
SSDEEP 12288:eoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:eonQ/tbw/2Mkjy6Fr7g0oH
TLSH
T19E5523697965F98BFB1706F14C838182973B0EC6BFD1A38F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7d0afafc54597c6fae9f096e898942224f93ab076aca20531bf060b778a7c634
MD5 3d339a0bed46a8a9d4c9c7aee058865f
SHA1 0b39c7fc1aab4a8cf5dbf42aa250ad44950539ff
SHA512 f86849b8e84a645bb451940af73642a27c07c36d2775d5df5efab49356e135cdfeaea825f5d2d87160f38ddce782b69ce16a41481023ad4fb8a8e7a94fc6ae2d
SSDEEP 12288:ZPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:ZvnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1455523797965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6c60248081722a6ba1057a3d81d4682bccfb9c6eadc3c367c975748970e22427
MD5 b9863c4e5bd6906a1ced61da1006c16d
SHA1 4df0f57ca97af3385834f7556a447abaaee86418
SHA512 7d74f561714bbf015ab0f33752dd0fd99093047a44689a19785e94b52dd6324adb943fbc86af03a6393f92df2899117fa34db6b566d22b8813c6ab25a5519314
SSDEEP 12288:ErGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:EbnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1955523797965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 60cc1e69256fdf30d259728bd7e1b6e53e8281aa0b202f8d0dc0ae7db6c26275
MD5 268396a34d9f2dda8c08203879e748e1
SHA1 bc05aae7baf0a694dda9ef774657d08060d7873c
SHA512 933b691c32c7d1c9600464591a7e5b46de29100bd4d4cec6c712a9974f102b1b99a32284430c4088479eecda8f0c065dc8506d1dc6ff1f0b183872cfc915a12f
SSDEEP 12288:KiZwbDzzFEoS2cPvyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:tZM3zFVSOjnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1467501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 355695dbe8acf199d24ade1b429f06525db8cb583edbcd9185cf3f5d0d8e1745
MD5 7cc276955bc32d0a9f9fec1e817c5d66
SHA1 bc776c1045b5190c60a9000e705420f2f60e029c
SHA512 8c9b5e61caae1111e2fa43cf77cf1b7f7f812969bf45fe363a81da6bd210c5889fe4584e9946f9770cf91761c42de80f7d76f368ffd1975de16a2157002302ad
SSDEEP 12288:7CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:7CnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1445523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 85e75596df6d8dc697bc881ef0f2d73846b25ea5a7a35e5bd964d5f5ed43315c
MD5 0e2f3e85c95e7598bf4c1a8cb8bbb1df
SHA1 b294c96828189361adc4ea643b3b8ebc8cfe45ee
SHA512 9b6c0ecd57dfc21065ce50d9afffdfcca6b14716b2562557af24fc6fdb4dc83d3f4dc370fba3a2135cef12edb88b48eb5002b65b5541240aaf1016d9c1af6ea6
SSDEEP 12288:A2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:AWnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1A65523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 066618273a08d658b8ce83b77345c0c54d53f494f953dac68c2153287b569158
MD5 34cb60407e7b6b2bab116a81946855fa
SHA1 f0d4676e4e1a651b311037ea0fea396dc391dba3
SHA512 116cf1b527c83e39de308954860daa8f95ced601dc4f2888543d7ca3de6b8521a6bec8e37d8d0a4633398efa7b70f76b433d230f248bed83d71471adb46089c1
SSDEEP 12288:HyPz5L83GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:qzyXnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T12F65021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c679894a13f8d5268ee17b48d407320c5f7f675c47d06b4b8be4b705e0c9a92a
MD5 db5fdc107913202c38dc6cd571ebc1c7
SHA1 e6ade0d34ad2fad380eb5595d7b7b851f47cf9aa
SHA512 8dee10422d1258aa49dfe147b3a8f9890e6706a0655ca81d159cd822fe4c7fc8519d1d40826f9d5afd2e5c69103dee094ff8395d74b8695e50436536ff19f2fa
SSDEEP 12288:kCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:kCnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T13B5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 273d9f7f3806421a9e5d56373b49b920b3e78233b9fab4f1435394b898fa887a
MD5 239b05e1553364f54eacca8415e0d22f
SHA1 4997bce12cd82125b2e0a0375f258a7e2aa3c631
SHA512 0e40c1f7b5f9b1277c648c63541d3cb707b63d26396e7095f8397535d0a9a9b861f66d8a6fd5ae3b84df566f39cc4eded888344672ce34c41d1df91be5c6de40
SSDEEP 12288:PCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:PCnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1635523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1635589db5c50d01bb67fce4c36d8d737d04b5026c566d5cac15f69296f8add9
MD5 6003a1b2c445cb890430052b34420061
SHA1 f8f1ecfacdc4d7a1ee4ddef544aec5d10e07b6ba
SHA512 06e29ab21f0500f655c4c37efe91de788d7909c935e3df8fc3fc9040c7df35b611b00a8c922df68f5623abc53aefa72dbded9dd9aac2cee19476c8bb46ba9374
SSDEEP 12288:8yPz5L83GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:lzyXnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1EB65021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 962befc314ab339de929e277aadf204f409c0f526026e02a85ed3644ec902430
MD5 37300043cc7c25aa04237a0427d7d327
SHA1 4ade244f2f00466d577161733613b971762a063e
SHA512 e723dc4e7a7c8fcac069a49f25f751f6fc63ea638c379a7e255ea3e7e0d8bc12dc664bc8fc631671098b271454af18abcf2cfdb0a4ce91078d3d5d6340fe57f5
SSDEEP 24576:pT0aLl3z0zD9nQ/tbw/2Mkjy6Fr7g0oL:pTDLljcQ/lFTjN4
TLSH
T1E57501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c8045fb736e612273454763132ef82f087ed9d08084bea6bba6ce426cc2093ee
MD5 0af9b2e9f7f619c35f9f4a450698e15d
SHA1 86fcacf557762a866a27813578236ebab2820aef
SHA512 1e9b449e0a0f8ce54270d9b0e94129a2b0c92b8448b0d6dfdf69d16006829d69043c7c2b02055dedfefaef750cbd2cc980ce3aa140921255c026a43588db5941
SSDEEP 24576:HcP4mcvIjkGOxhKP2l71nNKbrh/8KBanQ/tbw/2Mkjy6Fr7g0o8:8P4m4IpOO67W8KMQ/lFTjN4
TLSH
T17465AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 aabff469a74687ec908cf386d86ac323be630eb34d11808bd22f4eade6ea25c4
MD5 adc7a1370c215c453621a74b8bc98c0e
SHA1 9ab58fd96c0bbf4c8416c029b9cedfabef8c4ab8
SHA512 3512225f3ac39b7e010bf79a1a92402b61c9ac21b14d2423e1ec1ace7fa743431bb8e1aa11a4ac4529828594a98684836686f1c64350d0429bdc67b3cba54a7b
SSDEEP 12288:JssfSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:hSnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T18965F119E29852E9D12E5275CB828A41B3373C9597E1D3CB67C0F53E0F3A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 635c7f26be5f4624d3b1f220c9ca367adae14d9f3b96f363b72a706d5222a37b
MD5 1af0b6d1e6afede474afa219115eb049
SHA1 e712676bb381bbedc00e63355f8fc670189766ec
SHA512 e2404ec3aabcd2f30261ca832ca9412eb1641464e5d390696f9332bab920d84d6f50f83cb8eaf447088096dec9da056400c2982cb76220064be27657780844f2
SSDEEP 12288:8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:8ynQ/tbw/2Mkjy6Fr7g0od
TLSH
T15F5523796668F94BFA3B06B05882C151673F0EC5BF90D38FBB08222D957C3D41EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 74b19bf85a15b3e4f85746dd81d4487e861d6ebf21a7e8174ef53726a9ee583b
MD5 771c62e467ff181845389c90c8844627
SHA1 9baa430b51b5a822f951de380605c11b0dce860e
SHA512 6f4104aadb3cb7c2eaf0cab36ab568c4bd1e75fd297831c4809c86dc88afe62fdc40a4aa5ce22765d9e81fe9e8ed8fa1e92a57d285ab2b8b44cb9d8d6f0d4096
SSDEEP 49152:Ia0h2GEkuAe73q3pp46zwwQoQ/lFTjN4:Ia0hNYG4Jw0Lm
TLSH
T162859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 843fa96968145103cb95d789b8ade025c5c943830bc2b7b54174819d632f7225
MD5 4f7e0e85a873fb848d1d5ac46fd7c4d9
SHA1 df38bd064afb535c241c9b63acd05700ef432431
SHA512 8fbcd6c2ed0fad585fc810937a062ad10aa6f62c64f99a4a9c2f028fa02d1da674ea12d9a2c83146397f25f3808d78e960494c347b87358278d2d298525b0688
SSDEEP 12288:+hbHjfXjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:+hbHjPTnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1F455027E26AC30DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBE41D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6efe92f8e34bc70ece95f06bb18a605f7b6153a7a970b509348eab1b8c73a460
MD5 37f74e53cac7c7e46c9ee9c1ea31594b
SHA1 fb7e984ab4837e4a3566cafdba6080026c119d26
SHA512 109fb25c9cfd3a730e9ad41a28a4a2a52b27ae6593e507f295e16de367c8d1b5fbffbdafb2eb947128c60f25ebba783343ce53273b3e6047addee2168d3a360f
SSDEEP 24576:v3YgnJcRTk4yti+R5dBR/LnQ/tbw/2Mkjy6Fr7g0oO:vIgnaTk46pBR/LQ/lFTjN4
TLSH
T1BA45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 b1bfcaf0979b558f4b42b882fe8abf10c5fa1ba55a8522183df7570752921907
MD5 b2beb83c6f19ab23c801fa571431e1af
SHA1 eb34a695534551b60a2f6cf2efceffb29bf848bb
SHA512 55adee2fe5d72c09dc9f824e4a311b76253bc2e8acca7914ebe22af9851ed470bd3902c4d9bda6143971c473b6da7475249c9d4b876b48499612bbb4a249282b
SSDEEP 12288:DmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:DGnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1565523696614F88BFA2B06F54C838546673B0EC17F91A3CF7B48222D967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 3f11aae108f1c90de3e6d8881ef977f1418f7efe819416dfa6428b6a57f6c9cc
MD5 6e0cdfff508155ad4d782e3e75d64c73
SHA1 93b47eec751b13d54debc32b5eb6169bc57eb9b4
SHA512 1ff46605436d47ee4408a8702fff95d499e75a9bc930c9d91774e7e751831f67adeba9ef772a053e37b3b4298d084b50f9a8d5b1ca4f8b3dfdd511a556ccc431
SSDEEP 12288:yOb4A4LWOsvAYFTBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:jwL3UTRnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T18A75F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 5e58297947c82e69482e03f4b2c6c433b31efba57ab999bb58290dc24ad92cca
MD5 f9eb66a35d7cdc017eebafbb1ed1b039
SHA1 ed2e2a3b7b524df07ac13549df48c2196453ab4d
SHA512 b552ee75a7ad284cecfca9c0d055a3a6cfd96e325b6528b0f1086df3e6ccea1fefe2e9c94a8641b9c08b146551f9057e7cbc1376ed7d7fe2b1d9369ab5bbc04d
SSDEEP 12288:tpFtCOlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:2OFnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1D955022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a38bdb67626b3fd83d4e9a1e1e0b58e1aee55f51671f8921ece75d6ad39f0a87
MD5 84871a8cec6cee89dec909be3ef5581e
SHA1 e26fb372b035f969a468263b703dc1c3ec6f2a45
SHA512 c348fa0ac9eeddaa72272c5d273ceb405a61a7c292b8aa530bf4f54c7e94cdb4ce9f2c985ab32bbb6f3fe7e0a0f99a17a95fe38b2ed5775303ab4d6cf9aeec25
SSDEEP 24576:67NM9YqZqmWMUkPjZM48Mv6bEhsCnQ/tbw/2Mkjy6Fr7g0og:67cBWMpPjN8DbEhzQ/lFTjN4
TLSH
T158659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 5c1cc801fc5953e4842cd1bef3ccc53dbc4c004b63f54f2e628ffd05f798bc68
MD5 fc64499c25d48690d6210b4d532308d1
SHA1 306ef3a0b81db293f38c37d8c85225a88f776da7
SHA512 5f02374354a83e0292874c7d97052e94df059f54a862046981b4308837358a74ba692701a106a38e24d42f0117497b4184a394464f67f085fa61448b7ce63397
SSDEEP 24576:TW6BApg2YuyuNDYTabvcdvNYf8km10nQ/tbw/2Mkjy6Fr7g0oS:TF2YuHNETovAvNYf8kmiQ/lFTjN4
TLSH
T15B857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 827bd204ae21b882b1d4772a313b4455c12cb59874e5c6eb68f6783b7c89da5b
MD5 cec1a6f3030b398d05521e3646160471
SHA1 079e8002191a989f3a28f7d52276aad2d8804a3c
SHA512 a3822a01aca08f7cb62f6c8536a58cba6cbd4b9906436173ff459d882c382f38ac0395d9255a8ffb5da9d45ca168ceeb3c7dfc0f41f9f992555bf5c737716558
SSDEEP 24576:gAFs06+Omlf3NXEbTo5nQ/tbw/2Mkjy6Fr7g0ox:1Fs060lVXuIQ/lFTjN4
TLSH
T18165AF2F66AC00D5D07ED17D8997C91AF7B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 269e0618507dded5faa688964ea91ac43e6d7f1104f9455990ebdbded242220e
MD5 c4ed3763c2ffc939b7f702fab6fcbe67
SHA1 647f9034c8f39c2dc5acd68945d2583bb0962c76
SHA512 74ec2d1e74d60566d35dd28bf2800946d889337bc911a9228e13c76b810c991f46a6b17819c1255ce07fd51ad5e2e7d21ff93a9cc5a2976a46f139e2b1012376
SSDEEP 12288:lCJnJ5D3VkrqzxiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:cJnJ5D3WaInQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1C875D03DD2A810E9D477C2B4819A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b61d10d3aff4130bf580b48e0eea05c7e1abcb098b86083ec36fe86f5b48133e
MD5 73a04a98e0e7c57422a524daa253fa3d
SHA1 e8f8504ef9e952f79ccca21184695d447a76e33d
SHA512 68cbc525c0d7317057e47ecfef02684ed91c0f6b6997821ddf6273e03fe0c9ef1f1592db3a9acc011514150ae4b7f33cba5c0515cd8fcf6c637dc793186071a2
SSDEEP 24576:EEPghm6/7IIXdwcXrif7qQncjlP65i3VuLnQ/tbw/2Mkjy6Fr7g0ok:Lg06DIKdwc+eQnSt65aVuQ/lFTjN4
TLSH
T111955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 4009dc6b36807f9e25799c37526a662c7395b3a483f0f5b3aec7aa42d162ebb6
MD5 49edf7f9d6d178357d88b75e98523d5c
SHA1 c3e4fbeaa8287e6899501188c30be905d3599493
SHA512 1237580fd26a45274caa6274f76d9cefba8cb7650297fa5cfa952abe092cf6f5ba462002a1ce8e9178f1e3b4b57efda0c5ecaae16ad5e411cbeec16dfbd16eb8
SSDEEP 12288:pEP3RS8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:6S8nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1D455126D37ACB0DAE52A517D88918545D373F4A12B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b217f9342db59ba5703fc14d99996d78eeab232947443f2048b6dd76b1791d53
MD5 637b4a69c9e3d4d6f1d589d707c21957
SHA1 9f29e5dcc869f73264a82c40dc59104d2d8cf27c
SHA512 c2ef13f0572dfccfc610ed87dc3747cb7b94647b0b8c7dbec1d3c7da64ef80a2f56a06d15f313f9bc3a90a86eb58d06c8be73042222ac75c6732b411f9dc64c5
SSDEEP 12288:YjkyTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:YIyDnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T13F6512186398F4C6EA7A06788DA381919B367C506F2193DF6280F33E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 87465fb5bedba7512b47a17e9f22b76ff41b08590ea18316be4a1f3acb0965b2
MD5 ca8781267f61d05f16e28c1a3e9e5a51
SHA1 bbd9c56666322df144fc4ead7b35e79dfa1e2912
SHA512 f8ec9ac6c6e1de6b8523bdce5394284e9d788ea8def49987810f2ca004ece3e7908ba0f3ff814949663b851df977523eaf16061086b3d8f04a9a390ceb4dfb29
SSDEEP 12288:f0VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:81nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1AC55236C2665F88BFE2706F448928542973B09D17F9163EF36886239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a1ee31160a03c0230a7ecb2b909093def77b3646c68446fa67a4558aec72074f
MD5 5ad7dd5bedd857ed5c0fb6f6d13f8ca5
SHA1 1abf51347f8302f58e109f81047abf912e6de0ad
SHA512 c2e7863dd4d8894fc26d9de214d02bab3707e9366222e1d8d01f85bb135b50d8b152bf75d293fb08ae926abf6a81ef1b6049a72d5e5fa05a812cd83342eb5b85
SSDEEP 24576:LQ9MxZKdcz9dw3qnQ/tbw/2Mkjy6Fr7g0om:LVKZqQ/lFTjN4
TLSH
T171558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 da57be4e467c64c489d84d3198420d19a63e11240ff2ff6ca29e08aca2db9a0e
MD5 554bf0d532946d962f2964b2b194a5a6
SHA1 2bb34a15d21dfb45dd65ee5de79608021f2d77cc
SHA512 6200ddf7342ffe9551e864ec32b7c897806813de55157d3c18803bd72a61251280bdee69a984f9de16ae0b2841966617f33279df7b2e32d5efe866d3b04a0a2f
SSDEEP 12288:gyoKo20Rple9pHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:gyocSApnnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T19F65E01FBB6D90A2E136813C88818645E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 03936fd8967b8ee53350a6f50cb82cfdeff85fdeb12d9a9fa9b94a3308307930
MD5 3a7a7a68a5eca44ac932e2cff8715cbc
SHA1 e74857feac156cf52379abc86c939a6e8be9df59
SHA512 97a2f9cde58040f260be4605224c3afda34b5f49b974ff7d04eb321d02c8851031ef9bc08462307812af6b05c1de371687b61806851d15691e44cf8f6cc3ac05
SSDEEP 49152:UWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKnQ/lFTjN4:+0zuNI2Lm
TLSH
T14DA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 df514ccde41bbabc977963cb4c51040f8aeb602bad74340695c41d515ac2efdf
MD5 d0f551b89c76342c899da242d3f30057
SHA1 c3f0913459ece81cac352a09f03ff24966e16ce6
SHA512 fafe7c3ccc510ed7bf190e77764a8d8c529f8a0ffec3f91398d303b5c63d2beab602eb34c9fcbe14e494376dd3392cb841883555da15dd4f95d836577c81f3c0
SSDEEP 24576:o1QT7EcpfxR+N5AWAz3ooiYtjMqb8nQ/tbw/2Mkjy6Fr7g0oF:VTDxR+N5YzTfjMlQ/lFTjN4
TLSH
T1C055B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 c31447cc2f18babe16b4471849bc911c0cbe72653bed4dcc95bf7d0096a0508a
MD5 f2803feac675b9e3801dd04aba434ef9
SHA1 dabacdc82577f47a7d8a460e3320cc1a7a9a8a4d
SHA512 42a34f854a1dc2adec5baee6101468592b5936eb6a14c6f769e785dfec21f12c9fb9d60f969fea2307d0f54dd932bb9a076d5dfdd8e3132dac64eee7ad7c8ec3
SSDEEP 24576:NTMdOz0FFS+1mSLQnQ/tbw/2Mkjy6Fr7g0oz:30K+1mSLQQ/lFTjN4
TLSH
T14175E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 23eaef7d2a60b672eb9c1a3ce0fc23b096912d38e15de12f5520043968451d6d
MD5 a275bb1a85d026f03f08903c80c9eab8
SHA1 7338706cdcb804017964ed12cbea4abce804d56c
SHA512 60b62c3c8942e4f83eda18d18904351556d8ea0fd4b62e97d61f1a3fe52f6289138b76497ee9d598db7c6f4f793ead5354a032f443a272671d131b675c51b592
SSDEEP 12288:54TBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:8RnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T11B55122D23E8B4DAF93342B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-295-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/768-108-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/768-114-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/768-296-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1392-79-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1392-87-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1392-281-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1532-306-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1648-132-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1816-14-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1816-406-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2352-424-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2352-168-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2352-188-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2352-152-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2352-310-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2356-307-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2684-63-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2684-61-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2684-51-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2684-57-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2920-308-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3344-297-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3344-119-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3344-125-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3416-287-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3524-309-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3524-423-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3768-8-0x0000000000400000-0x0000000001D32000-memory.dmp

Download

memory/3768-269-0x0000000000400000-0x0000000001D32000-memory.dmp

Download

memory/3768-13-0x0000000001C56000-0x0000000001C58000-memory.dmp

Download

memory/3768-5-0x0000000003D70000-0x0000000003DD6000-memory.dmp

Download

memory/3768-274-0x0000000000400000-0x0000000001D32000-memory.dmp

Download

memory/3768-0-0x0000000003D70000-0x0000000003DD6000-memory.dmp

Download

memory/3772-311-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3772-24-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3772-18-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4048-37-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4048-275-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4048-31-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4060-298-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4232-282-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4232-97-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/4232-92-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/4724-400-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-421-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-425-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-426-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-427-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-428-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-429-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-391-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-395-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-393-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-392-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-390-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-394-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-396-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-397-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-398-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-399-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-430-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-401-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-403-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-404-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-405-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-402-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-431-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-422-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-407-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-420-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-419-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-418-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-417-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-416-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-415-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-414-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-413-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-412-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-411-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-410-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-409-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4724-408-0x000001EA7C910000-0x000001EA7C920000-memory.dmp

Download

memory/4836-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4836-279-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4836-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4948-292-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4948-340-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4984-270-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/5036-64-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5048-280-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5048-75-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5048-69-0x00000000004E0000-0x0000000000540000-memory.dmp

Download