2a3f73e5f4cc74c31e99d3a54e89bf2dde441408fd3dec4a27f75407dcb58477

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Size 4.0MB
Sample260715-peatyaft5x
SHA256 2a3f73e5f4cc74c31e99d3a54e89bf2dde441408fd3dec4a27f75407dcb58477
MD5 3f7d9ab4f79558382a0b867f927c80ce
SHA1 8a61b3c83835d1de5acb64c8aa4fc1aa94fa194b
SHA512 2a64a1e052f05d756aae1d7554ae1d0218d1832cb8350bf473c1b4cc371eb2a72a2cd79da6d68d068b9dfe558d115f79853b40ae4be9d1d356cc6c947bb87aba
SSDEEP 49152:Sc7e0CGHIVnk3lAXW2N5n/koYVGia9SCIJ6ZNtHlr/KCo9w3xQ0uAWA0niplHXcP:Hy0lHokVAXW2N5MhUB538niDXA/6CIG
TLSH
T1A7166A46EA8710F9ED071574321EF33F9B365809832C9EE3CB945D25A96B7D2183BA0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3732	alg.exe
4588	DiagnosticsHub.StandardCollector.Service.exe
3128	fxssvc.exe
2416	elevation_service.exe
1480	elevation_service.exe
3168	maintenanceservice.exe
4040	msdtc.exe
3096	OSE.EXE
1404	PerceptionSimulationService.exe
3444	perfhost.exe
4996	locator.exe
436	SensorDataService.exe
1908	snmptrap.exe
4124	spectrum.exe
4008	ssh-agent.exe
1152	TieringEngineService.exe
3492	AgentService.exe
1796	vds.exe
1356	vssvc.exe
2512	wbengine.exe
1980	WmiApSrv.exe
3344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bca64576a19fe9b3.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\SelectUndo.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd4f26795314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b65a6c785314dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005db10795314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000568254785314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e239b795314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e1aed785314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a78d02795314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeAuditPrivilege	3128	fxssvc.exe
Token: SeRestorePrivilege	1152	TieringEngineService.exe
Token: SeManageVolumePrivilege	1152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3492	AgentService.exe
Token: SeBackupPrivilege	1356	vssvc.exe
Token: SeRestorePrivilege	1356	vssvc.exe
Token: SeAuditPrivilege	1356	vssvc.exe
Token: SeBackupPrivilege	2512	wbengine.exe
Token: SeRestorePrivilege	2512	wbengine.exe
Token: SeSecurityPrivilege	2512	wbengine.exe
Token: 33	3344	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeDebugPrivilege	3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	3792	2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
Token: SeDebugPrivilege	3732	alg.exe
Token: SeDebugPrivilege	3732	alg.exe
Token: SeDebugPrivilege	3732	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 4204	3344	SearchIndexer.exe	110
PID 3344 wrote to memory of 868	3344	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3f7d9ab4f79558382a0b867f927c80ce_akira_amadey_elex_glassworm.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4804

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1480

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3096

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:436

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1908

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5008

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4204
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eadd91507f46de85f91370542a162bef1a9499d3322faa42412cb0890e014628
MD5 7f84948bbb999aefdf3f19078be92181
SHA1 418e2f5fdd2de85c5b2afeaa51e040a7a5757bd0
SHA512 c9ed0938d7e406c6143675c55a62461fd15ebb6fff4f5a95bdd024ae1444e42550f93a52c7ca633ddb16cacd3f74c8180880eab70273f1c021378828d2e81d67
SSDEEP 49152:sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnWXch/3qHiXeLG:W3q6mjBvXA/6CIG
TLSH
T1D7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 992776ca77d4ca868519b0da94ba675666a23548fd6f7bbd36f5c7c5ae096f9b
MD5 271f1ab72201aceb88fb193c8f1d16f1
SHA1 9467c863127228a947313a6b1d38125c978a55ac
SHA512 216ee199d61a5d8bcdeb4d126f5ad7f099bf787208aec48f5af1c74c91677832ed8fe0d84d085223104b5c470d81842d84274881abc43c924db2ed8359288b46
SSDEEP 24576:eXYfDtczAZ5T+v8zVW76r0KA3qHwg4xteLG:9tcsXch/3qHiXeLG
TLSH
T1B965012877E908F9ED67823CCDA2C511D63378514360EB9B03E499261F736D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c1fc62bdf2ccc118cdd2e1ed4dbccb8c2fe85093a9dbdbc179daeafaff8b4291
MD5 28e028fb408908a98ee8224c7c84570f
SHA1 e383a705a149b15e720b98aca3c0937a3a2a1b13
SHA512 35ee775936b072e9d8d690500cb7cc0686cdaeef08873b5f6a960a2ebdc51c2855f5eb4a056b79bf9b0c50bc49fbce13a35d178cfdb4faddc90fddba023d03f5
SSDEEP 24576:P0Le5ji0hmxhrMG5T+v8zVW76r0KA3qHwg4xteLG:PPji0Az9Xch/3qHiXeLG
TLSH
T14185AE15F6788731D073C0B9C5D2A69EE972308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 07e0785bff2d14640806cc95dba1fcb43cd888f138c156d62d73e076d9af862c
MD5 4e8f7a037b57aa0966a8c90cd97159da
SHA1 62eeaf6b76108e8b64f860c13b1d2d3e5a96fa50
SHA512 8209aaaabeeef3869fe4b3ad6b661807a5a4885d6f7dbcaf16e01dd6be67d11bde6476a55452ac5edee4805b65114ed3bed49ca8ba498250bdf1d31211dad52a
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWj6q8wyuw5T+v8zVW76r0KA3qHwg4xteLG:F/ezSC6vUzPv+HjyhXch/3qHiXeLG
TLSH
T1E0755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 25b067b4b897baa4a09be4fd9a0b86bc14219a6dcacdc8ddfcbde0e61d84a60f
MD5 6ed19fa427b5b801f15792efd9347d80
SHA1 6770e384a7baf8bbd1832446b00c2ea6922da6fe
SHA512 3d323a41cf01ba24653d8a54ec7d6f23c803970d3987c33416a1f57966b90daed0d7f7f708bc94e1d7188dc27ad7bf26d25f1db32dfeaf2958e72ffefc91220f
SSDEEP 24576:QVbqPb88hv/l+BV5T+v8zVW76r0KA3qHwg4xteLG:QVO88hXl+dXch/3qHiXeLG
TLSH
T10D559E65F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ccd48d2a0115fd23df712c2a66e86dd7ebf5ed700d7e75423867f6fe9d5f9570
MD5 bebbbfbeb8bdfb1a174d9c14f1993a6c
SHA1 5bd04a8c040118d8875c202c1a5acd63624a27c5
SHA512 1d925ed1d0e77c3702904af88b6847a23c86ca6d6939d13b3cd1e6f262c406f6fd90542822731c90b39fc539832f5a82abf6e911658b3dcb4ffb2e4a5cfffcac
SSDEEP 12288:xGS5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:xGS5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T14D4523485E6E2850D39B8A303FD79560C652AC7263859C175B8BF6237DF8CB0FC066E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 eec6ff145759ee23a46a2d2ed5cf399f610c830132cc621b1d3556328f31ecad
MD5 edc59bba2b0d5c305c1cd2a5ea6112e1
SHA1 a305588654d70accaebe224fa2d33bc80dfcc6b4
SHA512 2cf2f3437c16e0d67ff27576bc12caaeb1492b0e3e6f9af22c6c1c2a21d784548222e87b8b568ade89c10684f3b35ba2c02cda534abfb40f1869b550cd3f9549
SSDEEP 12288:KeBNUbTVO86UN5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:KJIUN5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D565CF3BAE28FCD2C27E8D795B918600D77278714B52A3CBD165C20EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 37666310e595042f01fc1112a7ac2accfa97b8b790bac79c5cd1d9d76d05a839
MD5 7ec9b8d47820157cff3618578997ec7a
SHA1 d46984316b727690d1529142477803f588d04d74
SHA512 ce8bfd46f1f6dd16eff100681e96000632403ba5e32afbf91a1abf8fd39930741ae25b495144c749cd6604bd02efe31c3374db93a8047b3dcb4b80ea68943068
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THg:cQvGAdlCEL8c/WRNw5CMXA/6CIG
TLSH
T18F267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 bb82ead1022aee0c4debae2103905e39267ad140009f6f4c2ec85e305ae28cd5
MD5 1b3f93ae0004aec1e5863be1100e6282
SHA1 91c6b8b81be3501f1daa233da93e8bcc334eb95a
SHA512 36290f56aa09f062b7b864f5825fa172a539c5e1685c4a242d3c4158bbeda06e12a36f64f03d284c0720e96d4d3b62b8456bafaecf690d6a1e0230932c9ce30d
SSDEEP 24576:pfewsAjn5T+v8zVW76r0KA3qHwg4xteLG:VljNXch/3qHiXeLG
TLSH
T1AC75E030FE79E432C3BF0DB21B66C716542DB9204B5219C3E3E88E9E59702D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 33cf7371fbbcd9a956d60021dfd9d474206e688bee0d7eca9c9218a0a92bea37
MD5 7eeca12e82c189da2fcff704153d7cfe
SHA1 ad98c1ce362180cade10006a941abcd463fbae97
SHA512 1c2b4a2853689702dbeb119fedda07cb0f56eed0fdf2ecb5305b4408233f0ffd482d52e3784a0e56be2b4dd0b9c8850d95e1002aded3d9d4a4772e6b64b4bf1f
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHpCIG:aUEtQevvqc2W1cpV20I32pCIG
TLSH
T1CA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b1cd30ff0bb1b0c00ec7800f41afc3849907f31cbad279fe55ed9238c4b8f853
MD5 f70d4d5a6ffc46017e187422e3c54946
SHA1 a0b01e33e75a7fde226f82688e5639f46ff01bd5
SHA512 5a95b72b28ddf0b7871486bc2e3db9196e94ad9b4435569c762c2ec3cfb1468f850037485f375db714c59e25bda5d03406ceb728e3029a599ddf3f1f1ef28e50
SSDEEP 49152:eCbRquA/m2yL5zTfFiV+XenmE3/ztXch/3qHiXeLG:ToquVjnmgXA/6CIG
TLSH
T101D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 efbfed631949218ce1bbfb5b910cae216c9e1a3d4f183d8c3ff7041c01eb2f57
MD5 3890f26a7186b706f022e720d9c13af3
SHA1 6b74e91f40bef59a18b379b13874119f560c1c6d
SHA512 8161625fbe76c1b826b41ab11b9bd7007d3f50c8fdd0b50a90bd9eee9b6d491e174f260aad318e09beaa48484774c3fce6d0148319e8048627e582ca25e6f604
SSDEEP 24576:HAhGL6IFoiwtA5l7S53U5T+v8zVW76r0KA3qHwg4xteLG:HAM5Foiq5wXch/3qHiXeLG
TLSH
T11935AD80EBF955D4F5B39A7899B68170EA76BCAA5E31C20F2250D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 49c44f75a54fe96bae21d804a90f520e336eec1129c866e8d9856c86e5869c4e
MD5 d3e8d1b68b5fe352d62d3517bf0b4af5
SHA1 6a08759cc945d2ef2c5865b8f2a44b3236b500e5
SHA512 f7b84a482f6a501fe42fa2e136d1bbd7f53ffdeec56686ad34b29162e877ce55fbfbd53b26a832e9aac6a488ac6737ecade23d1908a383e2ed817d3dfdfb1290
SSDEEP 24576:WwuROWL5T+v8zVW76r0KA3qHwg4xteLG:WwSOkXch/3qHiXeLG
TLSH
T17A65F14936A91CF9E66786388A97C135E7F3BC122621DB1F0760C6176F37260BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fbf580e880df8d5d5fcf70501404b98679cb20bece19e465b4bd52c951ea2554
MD5 14c87f3eeb48c8d301995d131869105c
SHA1 f9152b4fe87f61d618dbe62fc33ecadcdbbe21e4
SHA512 35ad2431216bbbe77dbc067172efbe2e795c530d96f3a74f5d9158a6edb4cc1f52cca772baa406ec7b8bde882ac35fa435dedcca038896538aee4a467eb8ef7f
SSDEEP 12288:lyZ1Iy35T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:8Zue5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T13F5512493AEC30F5D29786389EE28604C3727863237647CF165582672F73EE16D39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0c85ccef77b0ab78ee34f144ab264a715926876fc87c6a8388daaed52dcfe8df
MD5 2bf6e75e063d5d915ae925164250f799
SHA1 ff64ed2278f4f3789f0e1ae499d4745619bc8999
SHA512 85965778b6c1df7f3d2e1c4dc0cd8795217eb92b9ce650e763b817ffcaeabade99dc5036fff367c0f284f173730ab90bfc776db1eb3a343644b236df95f74cbc
SSDEEP 98304:lQRQyi36YOcPDLvw2gAf+PN37XA/6CIG:cQyiKanX+PNfCIG
TLSH
T1F7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1cf1018484c41373b8ac82d232943cb7db567a4576ad25d392a3a33209b824e3
MD5 6beb3c79a4d6276b03fcc74733361107
SHA1 e118ac9976250862fee7fe50440cd3a40a7bf79d
SHA512 5545368937eef9f299aa1b97a181a35afe3b872d96e94efe82bf0fe81d72bc73fc064078d0afd57427e9662de3f43911c08f7c7b1d566193bb15d85129ab53c9
SSDEEP 98304:oQRQyi36YOcPDLvw2gAf+PN37XA/6CIG:/QyiKanX+PNfCIG
TLSH
T1BE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 579dd8d4c67cc511b6e86c6b05d3656b5142875bf5a7d6699313c8336ac4df09
MD5 1ea0598394af8810870ef1b718584780
SHA1 e39687f3b302e1764df7d7551ff1b2d7fa23137f
SHA512 cb640be000a1b77517e2d92b4f00587a4ca4955cf5fc468d348990ee29cc00bf84fbd4ad5b0577a5b96df8220cd215dd7a0162bcefd6520c96df04b8d8fe5c9d
SSDEEP 49152:y68Qg55nhkeWu7PNU3/9Xch/3qHiXeLG:wthTRc/9XA/6CIG
TLSH
T15CB54933B2F600A9C44DD1769F4A872196D27C758FE0E3DB860572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ed520a3cf6c5a591a7b6fe223d5aa7c7ec692565c739509e342663a39117e4e7
MD5 1dee2cecc15cae9d20f81e80a56e2a4c
SHA1 b4820a8bc0192b576cd8a990a05280b5f2da2ae4
SHA512 afcde829f2527e414f4f67369661fc42895faaf23e5d5688185dd7110a9ec68eb64d07094503b5e0a2904eab1227091c876437cfa85918639cea75ede131839c
SSDEEP 98304:fy5112gYy5azzVvU69nLKnhZaXA/6CIG:SLIHRWhuCIG
TLSH
T1AC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f3eafdac32bbb4ee99970db0063a90a092153b49657abc6871d942fb0cd50253
MD5 f37c7bf36cfeb94d1f9f67b8667f8858
SHA1 0bdeedc46f5fd4d48ac76fc407de6615e4ad16df
SHA512 d1d592d05adeb1466c1ad0afb89ad41496e8264293c9a694ac9d66f090dafdf17de9471932712decd39838fe89c9e7fdfcfd4ba1d4c25e51d5ef6f8e850e8683
SSDEEP 49152:FB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glDXch/3qHiXeLG:ru6JmIxd2dDXA/6CIG
TLSH
T1FFD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 143b5eba51d0a5d9cbc6ef5e0ed0c4153dcca5593c6c0d39621d4dbf7e4b6cc4
MD5 5843ede35861f84b8b804e330a80d4c4
SHA1 1e6ea785ca3c2fa45ae55dab2c9e24e53075cd23
SHA512 605b65794846ab5b972fa997580aca03d725c68bed50dad95d510dd36013c55e437fca33e42b7eeef8aa42169614bc1e13adcd815c92a64ec61505515e7e7ede
SSDEEP 49152:W1hpsNoJpF1A67U44CwH7R4xHXch/3qHiXeLG:WmifPqRgXA/6CIG
TLSH
T1BAB5AE13F2D900E8D05EC17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dec41ffd61659dd3d31d656c9253a0ac9483d0d0eac1cf76c729db3c4701aaf8
MD5 bd7d6f33b2dfd634544ed8e6434e1ab8
SHA1 5c2ed1c47f812700ec2e84ea2c5f5a965be23ff6
SHA512 84a73961bcddc3e02c289168a5ae6048d351d142430088912a0b461f366944938cc9feceaf1f703c2712787318dda940ab926bfce17c50d42068fcd895e7d641
SSDEEP 49152:sSuZQIY0Be2KkRVtOnks6NMHqmXch/3qHiXeLG:O5dKqi61mXA/6CIG
TLSH
T1A1C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c3eb58b7d87b3ebd7f5b733443781fa39940e3a2b8bda3d2691b955aba9fa117
MD5 70e32302fc568de279a911805562aeee
SHA1 223702ee3da17ec02eb4949bcc32d8ff60b3db30
SHA512 de42c59605cbe2e7dd39ee3d689650a192f076babbb59e855e62bbd0dfdb4dc1f40019c5ebc43f40a173e579a8bf8b0c13c12bf4b06544716d7485c559645d22
SSDEEP 49152:dhtSn8EApI0figjgiDn0AP5wTXch/3qHiXeLG:MX2iWphEXA/6CIG
TLSH
T12595BE13F2D900E8D05EC178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2b138a1bcbfa2c663aef2289b550cf75b5bb4551eb5be9044f726429c9223fc5
MD5 0ceb0aa6504dafae1a0e7435fa702628
SHA1 6ff97250e3863394c357d5026b1ad49877ef26fe
SHA512 c9e80cba711eb9340d4d49eca29f63cac38cf15b60ac718f28c0357244bbbdf9d0cd70c351255e0a4efd39aad900304533cb054330b12435510a55a02582da4f
SSDEEP 12288:xK5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:xK5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T14B4523486D6F2854D34BCA312FD39164C64668777386581B2B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9f80178c329a0e2652d8d6f1ff753e7f6f93659d305788b919119d138f80c559
MD5 1cfce392363bc99e3f16df4c37f56d7e
SHA1 fe49fa1a885b54dfba44cc9fa8987e345c1c57d4
SHA512 9823bc328ae5374f190755d6455ff3376da600b234de9a05e8db02af0c4a635fd44ccf14740169c4b2b6fd5a7f289bce7eb6b3722444a3cda8b33e498bea24c0
SSDEEP 12288:wz5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:wz5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1584523486D6F1850D34BCA312FD39564C646A8777386581B2B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d33b20d8f8f412855e0029bbf3cae10d4f9b2560e51b09f4c86f9797b31371dd
MD5 f85da1add364e59a72dac6ff5be41465
SHA1 436095150f5af2d27f80bdf3dedf669c0b3a2d84
SHA512 0d1f1f46219aff001f62f6da218bae929cabf3183bfc2ded950fe8f6f009c5da3eab92e895376f6c348196a4bb0df41191469d1e003a4a2c5bfdd0d1a2acdaa1
SSDEEP 12288:cF5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:cF5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1464523486D6F2854D34BCA312FC39164C64668777386581B6B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c8208fb5168732cda51d1b7602cbf4dbe7525120d6cb7df15d7e569fa422f02b
MD5 008aa79974b094fb1874fe11d5d009c0
SHA1 8c684da0b079c273b87650c9155d277643aca999
SHA512 7754272406c509c5ee62ae53a10d1ba78a8ac21654e38df4922cdd94eddbfd8f10d7837d9b4aca89bd55120ff3db110d4affd1f414cfaec8e9f90ac686ed9c71
SSDEEP 12288:VV05T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:E5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1014523482EAE14D0D257C6349FE39120C3A2BCB7B322995F5B4695132EF1AF07C25BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4b3d803bb96bedcfa1a310f770f463d91cec1bc2394032896344af6f8553634c
MD5 97c59c67703cf51af1adec96e2f34a5a
SHA1 c440361e4f866b6222da832bf8ffad668878dd83
SHA512 419fa3a7f97ab326691cd63db3931452bca56a16c61dd8847fb5c2173b09b002e133b9db3d33e47227c3e654d7b8a285f82d976c4bd5f975f8b3c5c48041906f
SSDEEP 12288:Yc5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Yc5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T11B4523486D6F2854D34BCA312FC391A4C54668777386581B6B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 79b5ec360200a422b9eafa9f0566e9e019d0b5c2f76cdc05fe5764d428c52e2c
MD5 064bfe414e6a017b7f1404fbf99856f5
SHA1 01500ce92604b09a396af908bc7c67c068280f95
SHA512 092547d8718521df0996a770bcd53ab02068243e4f518787865560ad01c5597c49d29eb27dfa9c43eb7fb2bcda963c8ad4ce43b89e397875e10837061f18adf7
SSDEEP 12288:M/5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:M/5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1C44523486D6F2854D34BCA312FD39164C646A8777386581B2B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 eb2674685731848062cc11df9dd4abd4410270f482dedad95bce21fc6c06f741
MD5 5c582005e42a983b8b075fbb0250aee5
SHA1 9478dec375c2d27e3c86b0a020000b1a5fff30f9
SHA512 982ac3b04ecf455bded56ace60d803d556cd0e444cb238390e27e0423831efa770010ebe1ffbd7dddfb6c9081c614e62c8b20462a15e62c8a0e6774bb420503f
SSDEEP 12288:h75T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:h75T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1EB4523486D6F2854D34BCA312FC39564C6466877B386581B2B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b12b0eb7db6e92c5ec694935d6f9ccb348d0839da032de4440f55473aade4a65
MD5 2a3a1da34ff592f7632d221d2b6a25d3
SHA1 cb50451dc98820aefe5346dcb23594d9f0818185
SHA512 424035ddf16ac2c92311726fa631fe7dbb5009f2f38603d25afd998cb244d7321a77deecea4a716ba8191fc4faedba81e1b7f81cb137ed8891f79c64c573d410
SSDEEP 24576:ZZM3zFVSOT5T+v8zVW76r0KA3qHwg4xteLG:ZZM3zflXch/3qHiXeLG
TLSH
T1FF65019473941CF4ED67813ECD568915D2B27C6A0760CA1F13E836276F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 05454472c436158bf5e27757d55fde81577dcf3d64524adca1bc8e8279e687e6
MD5 03b913ecd168731cbe99651301bf09c7
SHA1 02c3e2fb3208c88509dba26ab68e3d6a278605fe
SHA512 fc5d092090960797f770f99eb8873db10c6d0090b48808f262ca7d8d53061d70bf5bb9b099570fbce95e87eefd55e6e15fcf2f00991f9c67612111ef7abb95a5
SSDEEP 12288:mu5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:mu5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1724523486D6F2850D34B8A352FC39564C646A8B773865C1B6B8FE123BEF5CB03C056E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b2c1d1824966d11f0cb5208a099308d5bfdd6ac4fdbdb9dec1cfa2196f2c2693
MD5 1c3f76e43fc062aa9ff7344cd313e1fd
SHA1 f92661ed6c0d3d936c8ad2c477b0eda1ddce8ef0
SHA512 58744c465468f0fe50a1efe5cd7d53b1d6582606e090a08dfec487fcb57a2dcdf89c4d6b809a6605b562a47832d09d627cf0f113de4455f4275ba9c8b1f6c036
SSDEEP 12288:Ui5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ui5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T17C4523486D6F1854D34BCA302FC39564C646A8777386581B6B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a320313ec7731b08e14a67841dd2a0a6190ce316b44e742c4041bebb45940e7a
MD5 853519f3e833396c41e6d58fd2413d25
SHA1 07d9bb74baeabe6ec68e87931fa6afc667e79132
SHA512 45bc0070c162898cd76f7e0a2ccba83a249fd0999cf4b24d29b344be50ad39bcc04106924f4d3009e32da3a497ea940a87ab74776931fb730f61caad79f1f100
SSDEEP 12288:GyPz5L835T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:7zy35T+v8zVW76r0KA3qHwg4xteLG
TLSH
T10855024777A930F8D16782388D921A11E772B83213218EAF179447772F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 02a7f05b514e950a8daa2634d6f5682f84497135c6f83163cac643c3c260859f
MD5 097f5673a21b6c4c87a9e28d20136141
SHA1 fc136a9f693f3ad0847e4c974395a0f0fef0e3d8
SHA512 caa744f34c0bb90dcd2abe6bfb6ffcf2fdc7c3122d4cadd7ebca0c1bd1ba49d18adf3c26f5c324e03bfded7a500c1054213e912cb4951e647f105fabb4aa04e0
SSDEEP 12288:Ou5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ou5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E64523486C6F2850D34B8A342FC39564C546A87773865C1B6B8FE123BEF5CB03C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d7e582bddb3f7b3c5bd051bc23b44bb5126a435733f4beaa40b059f4820a8d9f
MD5 e253febe1015265962b0345b6ff0db7f
SHA1 10ea027138d1b20e7a6959f746abb6c231b34cb4
SHA512 69a20b1e99b391695640b5b418ebbbd13e3a8948fed2c5641adcabb7328be972493b9c4cda26c626f443925212d1df3c1613e609b331a154b86bd4d0200f1b52
SSDEEP 12288:Su5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Su5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1114523486C6F2850D34B8A352FC39564C546A87773865C1B6B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cdbffb7fe9e76b57482aa8e4660f4ad1390ba313da1e8b4fdaaf969a484b1145
MD5 9b5fdc9d11c69681f608e50c1846a87e
SHA1 68014b237d954386bc45a7be764209dcfe1f5048
SHA512 7b3c0ef878d78805894c612eec3ed1f370b5e3bf31cf75cb5bd09c97d44e4105101b7ef2691576f327b653295929cd7fd89458792c303484d13978b8c6e75d8d
SSDEEP 12288:4yPz5L835T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Zzy35T+v8zVW76r0KA3qHwg4xteLG
TLSH
T19D55024777A930F8D16782388D921A11E772B83213218EAF179447772F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 6788f3b542144b856bde53c43c61c2aca64ef716c670d62a11f5d9cf5e6b545a
MD5 89c603b4e3140c340b0072b9ca547edf
SHA1 a6a4141bff2dd687f867bfcb49924862248f76ba
SHA512 7d920f85e4b9f98cfb3c3b463b66163a2ea2c9cdace8ec9a7d229c8e7cb305b9fb03749c8e919d1a4c8388c0d5d595838f80423647af6c5fd17ac76eae021990
SSDEEP 24576:XcP4mcvIjkGOxhKP2l71SNKbrh/8KB25T+v8zVW76r0KA3qHwg4xteLG:sP4m4IpOO67N8KMXch/3qHiXeLG
TLSH
T16D65AE2DABDC0096D0BB817486658A49FAB1742A2F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0c1b0e441a7953f5ae9a875e61d031acaf5bfb04459f41fe872f53ebbb79ff4a
MD5 0ca7a2118cdd1e691502455873f64aa1
SHA1 4de326e7a922dbdb5aa8c8b04e75add0272c0103
SHA512 b24e23036c6dceba5b82e0bb2b0e913a34931cb97984df62e6ac84623c5f9ab774767367ba63094cbe1cbea2f59c5c190db548df6a5bade3ecf3eaf54930c401
SSDEEP 12288:Epsfe5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ve5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T10155F009D69811E8C16E8235CB924640F3237C6693E1D7CB17C1F53E1F76AA06DEAB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ba1e73410159cd9b32c2f16724acd1f43ea8c897b9de5800e3a59ec4f2e08b3c
MD5 a2dc54e864548d101cece28cc3b48539
SHA1 d1ffd34c67bd88b0dc3f9e08e245db802d302bb8
SHA512 d701422b18a29335dca169b84d25cfbcf756891cfb8420e53186960446ee3c1820c1635d672a8b37d62243fbd42ada16268f128bd1a3593eb176f4870115f6d2
SSDEEP 12288:N+5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:N+5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A14523485E6D6815E3AB8A302FD7D134821A78776345980B7B4B92237DF4CF0BC256DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 37feed3afa1639ac6e345a1469afd504ce1877337bf8cac3bebfbf38638ef710
MD5 c873b3601a5c82abb2a0e1a3648cb9f6
SHA1 9b6d0f4a93aba965fa26a6dc308759c42f917a6a
SHA512 5d5181add6caedb56817898bd1e481bd25e33883102dc02835afa904be03e8c6eb494a78898dace52674313ac49d7019b162f961e118113e0833c831e8ebd748
SSDEEP 49152:ja0h2GEkuAe73q3pp46zwwQYXch/3qHiXeLG:ja0hNYG4JwFXA/6CIG
TLSH
T14385AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 14874079be65fc0950082a509b7a81735933a0098a1fa5cf6524b96138395980
MD5 fc06c2c7e2280a53efbff8efeffea631
SHA1 726518d1a02fe6e20a567abeb91eff66dcbc39c5
SHA512 b354442f107af853cc0a2c3671c90595d881c478bf259f8972ab692afaeeee090c2ea0711e2bb580fca2c5a724b014a6c2c3f9b45036580eb8b0a86e85e95dee
SSDEEP 24576:VhbHjPj5T+v8zVW76r0KA3qHwg4xteLG:VhbHjxXch/3qHiXeLG
TLSH
T17B55027D2AAD2094E276C27D5A928506C331B836231197EF27C6823A5F77DF06C35F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2312f7acee0d9b8371580b216ad77da1901ae297defa7692533945308997cd8f
MD5 7e1d425aac826870653afbb0d182dcf6
SHA1 3625342329bba9c9a29ca41c7ec1b15a018bf5b3
SHA512 1fefcd58dc804b5e15b5da03c00a471da77454b9cb3605e364f295a5f4170be02927d45e201f90dd98419e89f9faac46ee8c799c7923ff621f4c2461475fdc3e
SSDEEP 24576:N3YgnJcRTk4yti+R5dpR/L5T+v8zVW76r0KA3qHwg4xteLG:NIgnaTk46ppR/BXch/3qHiXeLG
TLSH
T19B45BF2DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 8e6310a41eae4b71dae785ac4bb4b327e1e68600ba87126e1fcf42fac4c88904
MD5 781a3af4198ffe646943a5c6351cb2f1
SHA1 502c9de7b0988ac526c9aa1895c289003ef03129
SHA512 b93c95be6023735137d811dfdf9e747225c5d8cb95ff4400d705a57f74ed8905cadc959c73dbce1c6afb5cb555c8577c8ee3becc9da3a304be6f917fcebd3a60
SSDEEP 12288:Dy5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Dy5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D74523482E6E2854C35BCA742FC39534C20278732346589B2A8BE123BEF5CF07C356E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 be0f8690d0f6bc522f4ef12b5612ea23efed712dee6babfdd423d631739130a2
MD5 e7f0e02055b945ea0df2c866e2293f1a
SHA1 f835acce0202a1ce81eb55038981a511407d5159
SHA512 7c60bacd058a2b63660711bcc332e57b16daff6fda9f83c5f4b7b71c21ed0d0dc0d50bc738ec8ee605a0be599f60c1b65d4708abcd528a363877ecce82beca59
SSDEEP 24576:8AL3UTZ5T+v8zVW76r0KA3qHwg4xteLG:8AL3UnXch/3qHiXeLG
TLSH
T127750154FBA900F4E96BC13CC9A28516D272B46D0364E7DF03A98A661F637F14E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 b72bdc84bad93d9626d0e5aa0eae00d536af66d2f3965d58eb09b1c93c9369f8
MD5 4d5e0db35a6b52f67413b8752eddbd40
SHA1 e98ee4317f390d2448c054067c7458faa3e52c95
SHA512 7629732ac717949d288596cf2615c42254d8f8d95ce82b70c76b984c716560e6a9c4abec45d204471094705731e1f474e9df3b3abf518f177b84c7355fd1a15d
SSDEEP 12288:3pFtvOt5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:hOt5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1B35502193AED20E4D17A813D9A938219C372B876131257DF06D1817A5FB3EF46C3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f73c0c5c3bf9fd2fac80f20aae505be200a3d83a9d18b50bc321f30e4b0331e4
MD5 a0745373806b06f35d9ffaf272c647bc
SHA1 c47ed83421177d6b7e0d5415ae57a97594a51946
SHA512 d47a7415451eef3a1e01d02096ca5054dfaaea88697ed05d488215b0dfb1d8a8e4f95bd64adb5e7b5b7e17bf5de111d2ffad9e5d10468a1de2a12a56ae52b00e
SSDEEP 24576:37NM9YmZqmWMUkPjZM48Mv6bEhsu5T+v8zVW76r0KA3qHwg4xteLG:37cBWMpPjN8DbEhJXch/3qHiXeLG
TLSH
T1E5659E2E6BAC81E5D577C13DC9E28205F6B2B4611B318ACB1252833E7F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b672f97a7b9672792e70483032e4c453d6453af26768ed34e4f92ade157f0fe8
MD5 b5c0e07b203f913206e69e5be43741a2
SHA1 b29ccbdb8193c2ac2280eb15493ea137c249ac50
SHA512 a941381c05d67db4e2ffbb70d36134c2754f46e77f84f7473e33f6133de291d28060b49088ceb567b7d235d6b8cb6f7294f70376f9f3c0f1ecfde3e0b7990431
SSDEEP 49152:NF2YuHNETovcvNYf8kmWXch/3qHiXeLG:Y6tCf8kHXA/6CIG
TLSH
T115857E292BED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 725aced2eee8ce8e8624c07ae4ad773a1ac7710dedacb6bf2de558c36dd29b00
MD5 41c25af363e4160024049849f3c7a7fd
SHA1 e546e8bdd95585d5c3b71e1278c9a855c339120d
SHA512 f8d39375ab3e9c53261680cf30e8482785d12af2aafbeffe8adb008b671e9c160a1a9aca21101899a22d54052d98a089ad5dedaa0af050406916dbd4d7da9eba
SSDEEP 24576:WAFs06+Omlf8NXEbTox5T+v8zVW76r0KA3qHwg4xteLG:/Fs060loXu4Xch/3qHiXeLG
TLSH
T10665AE2F66AC00D5D07ED17D8A97C91AF6B1746303255ACB0260C63E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 5e8bea04de89baa36e79f322ea3ff198621d736025eff8ed0e0e5649c372bff2
MD5 b9f2d8257fe8e5917281700eb2d00f53
SHA1 d4214120e8eb988bccc347658dcb3e58da1aa3bc
SHA512 e6e3151a5c5e157562ebdba412df5e35d015c3822a80b34731c0cd0dc202c4dfef7cec8ba245e6e428d39ff22deb20965fb934f5b33cd7d4eab197c863eda33a
SSDEEP 24576:bJnJ5D3Wt85T+v8zVW76r0KA3qHwg4xteLG:bJnJ5DGt4Xch/3qHiXeLG
TLSH
T1C475E02DD2A810E8D4B7C274829A1755FF72383D2B226DC728B4D5353F22EE0A979F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5bcb79c295ca791873c359b91d48d2068b37ce0393fe24da8662251a5e1e76f9
MD5 16d336c9aea3f59b171d6d34a37633ab
SHA1 3d57d8260f4ac0eb71fbfc1025e5e34ffdd90313
SHA512 daad7bdd57bd019f229a576a9915c25dbca400771153f8ac1a492e2fa3b4892b8e6bfd028dba4651e0f960a779bcd25dfc697967a8f620ffb934168ff87c3d05
SSDEEP 49152:no06DIKdwc+eQnSt65aViXch/3qHiXeLG:oUXA/6CIG
TLSH
T1B2956C15BBEA5294E8B3CAB1CA6291159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f45f618901bc939bcd95249e6380d848bea9c3cefa7f41ed5537b60a05aef3cd
MD5 a139943c346ceea649d51ec34e0fe1de
SHA1 81758514cfafe7ddaed43f3772c82aa00a667862
SHA512 092407eca458bedebc708e8b68bac0586f00d4587f07a4feb9608d39599185b920f93673e4cf22557ace2a10fd97da401adf056e99c25ed0c7a7ca7db69db1ba
SSDEEP 12288:SEP3RrQ5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:RrQ5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1BE55125D2BAD70E5D22B813D5A928204C372F07123522BEF16D6C23E5EB79F42D39B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 e2e78a5d51cab0c6590be00aecaacd9faf72e9b9ab00d666af91651d75e051f8
MD5 f70334f041edcc841ff2e1ded85c1c8d
SHA1 1d3c83788a5de0f3c10742008cda6ccfebe2d20a
SHA512 eae144cc53cff232d0c139a7e6d0fe4c1ca20578cce1777077a98ba8fe3927162abc7cdb1696063f7433d78732fb5bda50ae0933bc66b202efcd95773d9df97b
SSDEEP 12288:ajkyz5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:aIyz5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T18E551208279C6494D6BB46389FA381A0CA31BC31671196DF65C1E63F7F76AE07C30B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 090560d506b5df95dc61ecaafe4f8b0edfe98f0037bb52faea33ae948ea76c5f
MD5 90b8734fd4b9553d826f1a436db7c5ba
SHA1 d58d6bc734e63a4b3ea5820e5cb8dcf6f43efea6
SHA512 4d66bceccff513c1735fd08e399f74acf95d57d085ce527796653b8805977704082caa055ec4615017161405f6b7f2fbfad9389b7baef728be48c74c3133b545
SSDEEP 12288:CF95T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:w95T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1AE45234C2E6E3854D75B8A341BD39560C2527477234668AF2ACAE133AEF5CF07832ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3cdc156d211cf4b0b02a89772b751a51723d6ba6dfa0083c53d639af012cb385
MD5 b72424818c32eb763e9cc8b0c15cefc0
SHA1 c4170290261b0a86cf932d19410cc9e5b266cd2e
SHA512 faf18087b9387dfcd8a6a24fcca70930704765a119e038d04c469d2a627eeed99197c411342032ad8bacbfbc6a8b82c60a71511868c9a4ad103e9db17a86223e
SSDEEP 24576:iQ9MxZKdcz97w3m5T+v8zVW76r0KA3qHwg4xteLG:iVKXeXch/3qHiXeLG
TLSH
T1D2558D2DABE9059AE177C23595A250C3A673B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 45695e2205cac9c748b3cc9a8303c63dd355ed1cd1f9ee865a9ea2b2de8a45c6
MD5 cc77ab65800a7a81b4be02cfbffb7eb1
SHA1 667b3f81cba8981a0262f99ee02b68195c42c72a
SHA512 f929de3eda1daed439398a02e6b44c604ff43af0f985c574e76e2d97d2ca2a97d31e5a9299b78911f73583746030ac907d6d36ec8d303d3a1b8e87d4ecd6aedd
SSDEEP 24576:FyocxApn5T+v8zVW76r0KA3qHwg4xteLG:YocxApNXch/3qHiXeLG
TLSH
T17565E01FBB6E40A1E167813C89868245E773B0311B6257CB6692C33E8F779E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 203e2b76e8a551743be814432d3a6235faaf3b1d7d4f655994cf54076662444c
MD5 9d7c62fa18919594e3ed45f97d0a9391
SHA1 57459d38417f8aedd4d0cb9a38fedc5c2068aff1
SHA512 ef0a44ba25a7d960ce6a87eb9cb46d09229ef0dd0e5998e646de026e3dbc5b5023afcede9300d2897c191720dce581b734f3f8ce8cf7ea702127f0b54315b807
SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKNXch/3qHiXeLG:u0zuNIRXA/6CIG
TLSH
T1CDA57B3DA2BC00A8D9AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 19d8cba07f072883b12b532840ae9f9207f07bfcece2180740c631cc2eac6f09
MD5 a34b734ca47d9e2824638ba4a0a495ca
SHA1 35825d0326943168c148e63ebe4cb1d184347364
SHA512 9320c4626e32a4be2619f2cf543cc206f658ccfc9988d221487d3fdfdddf1ddea5f98c13da1930dd9961b5d2208cdff781a3b2e04a8ea1a5ddac354da82c0551
SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiYzjMqbQ5T+v8zVW76r0KA3qHwg4xteLG:7TDxR+N5YzTBjMnXch/3qHiXeLG
TLSH
T1A855B02EA7F915E9D17E85789B23C512FA727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 8549d9db41a5bbb03bb1f353dd7f537be5a5e7b2ffb46af2438bde157c7a2df5
MD5 3155e9017fd15aa0b178479724a6e0de
SHA1 ab148fe2a55f04d17df130e410bd607e038322c1
SHA512 fb9e660c41100bfac10e584d164bb45747a37b3db7bb7f071225993e3dab106a8a7b4c75bb9dcb6ab6097cd4a06617047d7f7a6ce076421e5e1de504d3c862b7
SSDEEP 24576:5TMdOz0FFS+UmSL05T+v8zVW76r0KA3qHwg4xteLG:T0K+UmSLgXch/3qHiXeLG
TLSH
T1AE75F17E676D14E5E57BC27C9A438906E672347203226ADB06D0C17A3FA7EE43939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 409d8a49df2f164dcf3686b3e0d377a6cefc781751672702127cac77bab3f778
MD5 01050870a242e4e1cb6c0821886bdb6a
SHA1 c0bbb5ebad078dbc9adb63a66c2e7331933f92f4
SHA512 6a0f3616122e142b6b5511d5c5ce8b0bc2c4a49b2076b0bf13f03d581ded8b9f8247f73ed279cb3c54d99ca5c6a0960ba99b939e9b2c4d73da84ddf820134c12
SSDEEP 12288:847Z5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:rZ5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1DD55120C2BED34D4E16786349FA74125C231B832231569FF3AD5C53B6F769E0A839B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-453-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/436-136-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/436-357-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/436-142-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/436-455-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/868-462-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-464-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-466-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-468-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-474-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-476-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-458-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-463-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-460-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-477-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-478-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-465-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-475-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-471-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-473-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-472-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-470-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-461-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-469-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-467-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/868-459-0x000001D31CE40000-0x000001D31CE50000-memory.dmp

Download

memory/1152-184-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1152-361-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1356-363-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1356-217-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1404-370-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1404-111-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1404-117-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1480-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1480-70-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1480-457-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1480-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1796-207-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/1796-201-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/1796-362-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1908-153-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1908-358-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1980-365-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1980-231-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1980-237-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2416-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2416-50-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2416-456-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2416-56-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2512-364-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2512-227-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2512-221-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3096-107-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3096-101-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3096-369-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3128-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3128-38-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3128-87-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3128-88-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3128-47-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3168-78-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3168-82-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3168-84-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3168-72-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3344-248-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3344-274-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/3344-366-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3344-242-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3344-290-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/3344-258-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/3344-490-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3444-355-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3492-199-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3492-194-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3492-197-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3492-188-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3732-12-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3732-382-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3732-21-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3732-20-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3792-1-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/3792-8-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/3792-367-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/3792-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/4008-174-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4008-360-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4008-168-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4040-90-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4040-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4040-368-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4124-157-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4124-163-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4124-359-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4588-32-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4588-33-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4588-34-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4588-26-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4588-438-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4996-132-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4996-356-0x0000000140000000-0x00000001401D4000-memory.dmp

Download