Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 01:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
- Size 4.9MB
- Sample260720-bl7wcsa18q
- SHA256 76e57640afca2996ebbe20fc1d53e9d05e1f6d2f0b2632c314e023f9810b70cb
- MD5 7633ced4410b31a56b8e1c5f0fb1debb
- SHA1 9bea21220fb4ff722aeff49a79dd4be1c733a19e
- SHA512 c8c14d6c238dd6115347c6c304ad93f0d9e2f9c1358dcfdf7d3fe57b8c38f01fb1de1718eb217ada0f4d0e85794a651f20225266b3b88756a3a69ed6feb19969
- SSDEEP 49152:auJkpvUqUBkmp/W5OltLRpiJUj5y09P98UAWGjNfrnC3nNQ4XIlGs2fk:auInUKmdWeRpvjE0B981LQNRR
- TLSH T16536BF91EBC740F1EDC35476A13F3B1B9A3E9609433685D7EB902D719C213E2693E286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 604 alg.exe 1064 DiagnosticsHub.StandardCollector.Service.exe 3896 fxssvc.exe 3208 elevation_service.exe 2940 elevation_service.exe 3728 maintenanceservice.exe 3588 msdtc.exe 4112 OSE.EXE 4892 PerceptionSimulationService.exe 1192 perfhost.exe 3800 locator.exe 1644 SensorDataService.exe 2552 snmptrap.exe 5100 spectrum.exe 2712 ssh-agent.exe 3488 TieringEngineService.exe 988 AgentService.exe 4260 vds.exe 3420 vssvc.exe 1340 wbengine.exe 4800 WmiApSrv.exe 1888 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\O: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\Q: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\S: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\V: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\Z: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\A: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\L: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\M: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\H: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\N: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\P: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\R: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\T: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\W: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\B: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\I: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\J: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\U: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\X: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\Y: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\E: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened (read-only) \??\G: 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe - Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7bf17d162d44b5a9.bin alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaws.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cf3e03ee517dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0c24a46e517dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8ec5c3fe517dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e44b13ee517dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000673a43fe517dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001190de3ee517dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe Token: SeAuditPrivilege 3896 fxssvc.exe Token: SeRestorePrivilege 3488 TieringEngineService.exe Token: SeManageVolumePrivilege 3488 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 988 AgentService.exe Token: SeBackupPrivilege 3420 vssvc.exe Token: SeRestorePrivilege 3420 vssvc.exe Token: SeAuditPrivilege 3420 vssvc.exe Token: SeBackupPrivilege 1340 wbengine.exe Token: SeRestorePrivilege 1340 wbengine.exe Token: SeSecurityPrivilege 1340 wbengine.exe Token: 33 1888 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1888 SearchIndexer.exe Token: SeDebugPrivilege 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe Token: SeDebugPrivilege 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe Token: SeDebugPrivilege 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe Token: SeDebugPrivilege 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe Token: SeDebugPrivilege 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe Token: SeDebugPrivilege 604 alg.exe Token: SeDebugPrivilege 604 alg.exe Token: SeDebugPrivilege 604 alg.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe 1980 2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2988 1888 SearchIndexer.exe 111 PID 1888 wrote to memory of 4736 1888 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1980
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:604
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:1064
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4360
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3208
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2940
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3728
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3588
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4112
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4892
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1192
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3800
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1644
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2552
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5100
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2712
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2108
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4260
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4800
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2988
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4736
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 7484dc4ab83fc1bf49099cd38958ecd34d4fb5ce33b0c6d58ccf22b33bf6e1a3
- MD5 4c5923ac0431204dd99c6c5232e560b2
- SHA1 fff57058f2227108447b828768d65eeb153e7c9f
- SHA512 00e41a8cba1546ab299011d34086ed11deb17c5397732861acecd969f3d4effa3fd843e3027d34fc0c7081b04304771465cf8dff64db9612670c35a00912397d
- SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnwQ4XIlGs2fk:a3q6sjBTRR
- TLSH T1F7D59D03F2D900E8E06AD178D7569133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 b809cd0a3a01b6c8761c1c7c56d62070555619653d34c3345e921cefb64c1c4e
- MD5 6d96a901182ecb07f3193c96f362b75f
- SHA1 b05705cdfbdd7819c82848c95b6d21bfef9e7034
- SHA512 99aef39eab1687cdd0e6543072d95e8772c754fac81477da71df7515f15aec5cfe8bea96b7a7936d45cce599d55f0a982b4f1b6c0f1bcc6e57bf846d5d2e5e53
- SSDEEP 12288:g1XLsswWkxy2lRq2czAhBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3:2XYfDtczAhB33QTM2aIlGs219sdN
- TLSH T11465F12877E509F9ED6B8279CCB18112FA73B84543A4E79F03A099251F237D85E3EB44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 9d28e6b3a8397b0305ad5ac2b8904c1b5680f08529dc28c416d292254dcd89d8
- MD5 c75d48c6d96d2ab422078b11134d2673
- SHA1 95701b18c43a7c87fab836dc1fda22200399bb20
- SHA512 d09c3f9a7600a8e53112f026f0346481bc8fc0976aa1724706a3bc4201e85c4a6f220d0460ff80705b11d0a729ab0d68ce4f0172d54871405e63daa1f1412fd4
- SSDEEP 24576:+0Le5ji0hmxxrMIB33QTM2aIlGs219sdN:+Pji0AjpQ4XIlGs2fk
- TLSH T120859E16F5748331D073C0B9C5E2A69AED72308657308ACB4286D77C7E67BE68A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 868cb64db0ec44f8df2135762c6c082f15e2684c8f4aa7e5094d224257511dfd
- MD5 3d549d6ff8d489f0dc3cbb9fb68a90ba
- SHA1 17e3e84a1c37ef21b9c7e0a70d38ba606b0ff8bc
- SHA512 1419fc73a574247787a5f4ca7066c1a9445a7a08b2aa7d5e5795edb9627cb120132054fa9558568147c6059eab3bceb83a3e38f29831971b4c1b3ba5966587c8
- SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWn6q8wyuOB33QTM2aIlGs219sdN:n/ezSC6vUzPveHjydQ4XIlGs2fk
- TLSH T16E756C25F5788323D0B2D0BAC5D6BA9AFE323046573089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 88e2a38d75654a408ecf5d58efe8e4e34fdc590696207fdd6497ef0a936a9a64
- MD5 3043b84ee20a1f6a97aa704fae4d607e
- SHA1 02cc73c412abe57162f48f3bd949b5f03dbfd1f0
- SHA512 9caa9a01f5030a6dd9060f5fb542baefd7d9d449c23594cabc2a8868134747181891d6f1efe8a4f3338b1c4820f1fd899a1f69628d031b6b18a122a948374106
- SSDEEP 24576:VVbqPb88hv/l+YtB33QTM2aIlGs219sdN:VVO88hXl+GQ4XIlGs2fk
- TLSH T18D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 fd6d1e740e258f77ace86df33d6b138cf0a5f34e867bb552437c36bb8c30dab8
- MD5 58124f02c786b3f3287dc89311a0a327
- SHA1 be977825621ace56d8f6e97bd0aab2d1fca7a9b3
- SHA512 d968d015ef48abbd02faac78a4cd330b8d25628784e7145e53f35b6349b095465fecc5f0e9dd20cc89c9f90ee8b989d51ad52465d07bb536b7c3f7bb6073db28
- SSDEEP 12288:cL0Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:cL0B33QTM2aIlGs219sdN
- TLSH T17B4523026D299AA0FF7F527368BC51A2B977FE45A188297F072378563938963CF3504C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 ca5904519ec1ed4542d481d61ba10a5ff15339c3d3d84e2d9676b4889a18877c
- MD5 fa56de45183c801ed2ec0a269d3aba35
- SHA1 fac634839f6ad2b61017f7b4b608b60bb4961625
- SHA512 b8ff835b5869ca96eaef1587a7fd9815063d0bbec402d90610755f1b5ed610f99ed4d776dd3ef0339c1c9ef8f0fb2b2a44266e02820226031b3f6c916adbe284
- SSDEEP 12288:teBNUbTVO86UFBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:tJIUFB33QTM2aIlGs219sdN
- TLSH T1DF65CF3BEE28FCD2C67E9DB95AA18240E77278304B51A3CBD171820EDE235E15E79C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 8fddd8db84c2c65317b969fea37198786998b374e4baf8ad2f0b0ad40192e040
- MD5 151980fc623488bf8a270121035af53a
- SHA1 79dd8db73d08203566a89b629211234a1b4dfe9e
- SHA512 fc7779f1ad8ca391b20a6a4752b1f9a63be129c8c5bb0d64d97cb018d889e8a647e68739e09456348b4bc61c6d272b683c0e41d7d1a1bc938692def1060304b6
- SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:QQvGAdlCEL8c/DRNw5CuRR
- TLSH T181266C656BF880F5E0B7E174897A85B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 c4e2dead797c55717ad0f9af60b17722889051dbfcd71b913df84a7dac25cbaa
- MD5 76b7c2c47e06f4c23f0111696a67c681
- SHA1 884882568add869c8d41a2f10c3c446422924513
- SHA512 aea21b81848855769b35475b785b7db589f0f2e82a7647d614f5cbf8a974782030ac0e0011c80dc2da451bd81da5bc15460c7d4cf482931131a00e8d61398403
- SSDEEP 12288:YAwSfxL/2Dc3RDLLmt0LDQewsAjLBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+4:90ewsAjLB33QTM2aIlGs219sdN
- TLSH T1DF75E031FE74E436C77F0DB21B35C316683DB9204B911AC7E3A88D9E59342D22776A1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 45ce87e38959d334f30496373cc70521e54eebc43f543734d9f6fcbaed477ee4
- MD5 118cd51616da700bff04719661828219
- SHA1 13a74167615bd3637941339a0415bebb54c757d5
- SHA512 3ec975ea6e2cc77a7b3414054c2c502a12e626713441c7374b698710d908a713aaadd977e9e34dfaad613258398a5f50fa0fc3fb90b15c7b3db1e6543ae493ec
- SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHhRR:NUEtQevvqc2W1cpV2tI32h3
- TLSH T1BE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 786f0df8dd432a6d4820d81d8013c43a9b60620c9e0885126c6e66019de830ea
- MD5 e371b62869acbcb4f964b2d1c58b1d49
- SHA1 57af243c165f0b1de694ac0c2b130cf85badba96
- SHA512 0eee38ed8ee5abc2b88b7d78af6d54b0db16a66557b499ae61bb20806472f3ce716cfbdf9755b6489703b2fe58b5362e27d5d2763df1427be39073ebfea346a7
- SSDEEP 49152:8CbRquA/m2yL5zTfFiV+XenmE3/z5Q4XIlGs2fk:1oquVjnmyRR
- TLSH T1F5D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 a459441c3a7fd8f99a130181520b67f4888458faf0cc857cb7a2bce240d2f715
- MD5 f2eaa398d13d48add2774ebd686ec093
- SHA1 9bd970c80c410a0168a8f2afd11f4cb07a22f2db
- SHA512 9c0e25930ef9af300ee3181c1466b17f0c60244015ca26f3481ec99022fa16540d67cefa00eec1d0a06427ad01ce4075ed06ab7986537260d4d23bf35e64430f
- SSDEEP 24576:bAhGL3IFoiwtA5l7S53CB33QTM2aIlGs219sdN:bAMUFoiq5iQ4XIlGs2fk
- TLSH T12E35AD81EBF955D4F5B3AA7899B68171EA76BCA65E30C20F2120D11F1E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 f6fe1ff6beea6571ca88804e54decd1fdd621a4c5c98dd31a51c19614a28ce9b
- MD5 0bf5884b8c870db6b658fcd8b6e430ce
- SHA1 7b8d8a2f42e0a5f1ddb7a7fd4e58a8ba47133133
- SHA512 11f99015d36835807fa95669722e381cd5d23c3da702c9e800a7a9f847d6351aecf2766831199b1ad33f7e17b178f264e806181da933c2a7de8a8fc01832ef2a
- SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+CuBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/P:owu4OW/B33QTM2aIlGs219sdN
- TLSH T16565F14636A50CF9EA67923985A7C136F7B3BC022624DB1F0760C65B6F37361AE2D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 9f69c4e7e74939d7a587eb325a03ad8737ddc514174daa41a64249aab98ad9de
- MD5 8b7fda03931da9dd471524e5805710d3
- SHA1 629368e7d8f741f4f99a2d032f173136fd7a892d
- SHA512 67f50e793ec6c619ce1e306540ceb81d65ad2befc0ca370a072d5a6e656a978efdacd3396fb88b6c960f315bd619248c83a1bd5e8f2df172e9644aeca4ba5a4d
- SSDEEP 12288:IeZ1Iy7Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:ZZuAB33QTM2aIlGs219sdN
- TLSH T1F055124A36A821F9E6BB523ADCF45246F773B846637443DF032246662F37AD24E39314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 5f572fc929fecc6b3d97f4f97724ae73117b34bd7bd4f76bcb8657c0c953aafa
- MD5 81c5fb0ee412bfa29a72b131e76d9aa1
- SHA1 a001a9cfcc308b5eeecb9add27dcec384e6613b7
- SHA512 9c0732c8c7354503ea93742b58be2da9f41953b2b07a2dc253503bd7decc5ec65fd1189b07dab973f61bddd877e2f3d2b03750819c999c0f0400884a6a5a55de
- SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:MQRQyi36YOcPbLvw2gAf+PN3/RR
- TLSH T110667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 5779b31e713cd18704c3c0870982187f3cb680e211b2ce654f02b181f2d79c4a
- MD5 cc38b8f592de29845fb4d6ec3377099f
- SHA1 64e036dede4ed5311085ef867647772be20740f9
- SHA512 784754367bb046f9213d72412e474afad9b5525691d6fb0bcd5c4c2422819220d914673726af6bc4043c72a1c220a029b0eb19743b6012e41581db03f065bd1b
- SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:rQRQyi36YOcPbLvw2gAf+PN3/RR
- TLSH T1AD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 47b7b5686296d384dc7da1532662bc49cb984862652812395122fb6bd5a315f6
- MD5 d16821ea2da635dce28fd0cc0fe2d4cb
- SHA1 1d4ceb1bcc0c86e9fe9e30bda0a77691662ced5a
- SHA512 40af4cec06f318192c93187dbc2f9d032c52c824f58c9f8cad861f5c9bcb15c8f279a5c2ccf27eecaa6ef1300a73c6f9936659c517bd41788c968bdd5423e0b3
- SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0QB33QTM2aIlGs2e:Q68Qg55nhceWu7PNU3/pQ4XIlGs2fk
- TLSH T1C7B55933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 8662ae727170d5993854e12fb5a1238334bf12b691d1633039dc841a72a3104c
- MD5 034c46717088f9b8c1473c914dbe71be
- SHA1 76c0aeb57fc97db76565ac73f2d2efdd7ba03fc4
- SHA512 87917942f0b08ad1fb4b9cb55d047e4b8906c6a1e854d610db01501e121cfd4e1aae89fc2775be5151c7b20b686b81b085e5e231e6d24d2443c74b3c9f90de2a
- SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:Cy5112gYy5azzVvt69nLKnhZkRR
- TLSH T18B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 e7fef9f716a1b6b06f0d648cd159823a966bc9ac1c6865dfefbd6d70e6c5e6bb
- MD5 03a493c69f29cfb5e4b7eabe56969921
- SHA1 ff86684ae6ea3ea88a2dfb58384e9d92a8b5281f
- SHA512 f21783ec7e119fbd3b7102dd3680d4caaf0ee314ef6420948cc2d354493fde4eae86cb95a49bf47b303d25fc88b9076fa395baa60335bfb8ccae6bed153d13cf
- SSDEEP 49152:QB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3Q4XIlGs2fk:Ku6Jmdxd2d3RR
- TLSH T10BD59D13F1DA01E8D06ED079975A9233F962BC490B34B6EF0A9072562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 bdcc95e9c0462326c3ae62cdb9432751a295c591a191562a04921f680a2f7c5e
- MD5 9f3342a83897a87fcc97eea5156c72ac
- SHA1 0f43e303b510e48384a441c8bb0bfcb1492a10ef
- SHA512 975769633d687b9eab61fcb07a603baf5564576e7b118a69dbaa32bbbcf46e863c94dc9ee410ba8c152911135175caf6dcdfc0c7f887b8ef5f66a54f715b7e09
- SSDEEP 49152:V1hpsNoJpF1A63U44CwH7R4xbQ4XIlGs2fk:VmifPWRyRR
- TLSH T1A7B5AE13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 d1b204be31bc9f771d6dd674241a62f88da0463aaa858a43531a53c5cbd4789f
- MD5 24440b6cb249e7070dee5e2c9a8fcb78
- SHA1 6facff2305ef0fed30882b009c4a6d25e6d2d300
- SHA512 4f5e263a9ba5781e7a29d7ee79239a3fc32d56d1401558ba10621badfcd5cc8c6e7a606af35c35fb932948cf8dfeea3efaf8829cdc639f640a0b9d37ef75f191
- SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHqgQ4XIlGs2fk:K5dKii61gRR
- TLSH T1A2C5AE03F2E941E8E0BED6748B769232EA72BC464B34A6DF064072551E77EE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 273d4f26ab012ec920fcea5c254b39adb5c3b4b25565890aa4a156afcf185aca
- MD5 f38185f344e677745421b275424c90b7
- SHA1 dad9d0fbafc5f4869058904f84840ad3ae341784
- SHA512 2584192130edb2be935510e5558e6f485d83dc6f22147f995b579579c60361ab8979e30046d9db1592d351626f8eb193824539d9a9a2a65bda9f28696bab6ede
- SSDEEP 49152:9htSn8EApI0fig3giDn0AP5wnQ4XIlGs2fk:sX2imph2RR
- TLSH T12995BE13F2D901E8D06ED175C7568632E962BC060B38AAEF0A50B6561F7BBE45F3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 46a269acd035076866a84a015c60620fae0d38fbbae6476d565ba67752c094a9
- MD5 435139aa217ad2aac92a65c10b639568
- SHA1 5e7dddbe6a775566b21490ae1af18e6a98cc221a
- SHA512 6e2b50b70489f88d8b904741dc0b7c252c45c18ce0123dfbd58904159b7f4802823cfe29577ccf1b64f890d65efc197864538a5d74292f3512c5da0b21918f6f
- SSDEEP 12288:GMBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:GMB33QTM2aIlGs219sdN
- TLSH T1CA4523056C7A4A95EB3F527358BC51A6F977BE4AB388257F071354213A38A734F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 ef51897aa3886cc00e0d67572e5f29cf2117cb7f48d5d8bfb42ab04165b05012
- MD5 3822ffd3b28db1a28cd4bbd15ed0c686
- SHA1 9b46131ed4b8d0b4bf82dd4a281b9b88cee2dc62
- SHA512 67ebd690d07eb1cc29eb626eec66a65b88cfee229cd6e669f86a2fefceea4553fbde753441b11c8956b9830464a1e2d9d9e14335c2a287fc8a2a38b99b9d0a95
- SSDEEP 12288:7nBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:7nB33QTM2aIlGs219sdN
- TLSH T17A4523057C7A4A95EB3F527358B851A6F977BE4BB288257F071354223A38A738F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 5886039567e08b1c95044a1cf4f95b4d6d7cbcc7b7292cb818248c9e3f800116
- MD5 001566d6712b77110d470918623c4125
- SHA1 e5f8c7b57fd1ace8667ce8c899b49a2b2fe13b58
- SHA512 7cc7283d87b2e345ce2ebc6ee64154a3cba8c60f6871b94aef53ba4eb1996f181ee58bf2045d39c714e76194e5e62423933f6393afb7b45bdf7f42016a629219
- SSDEEP 12288:A9Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:A9B33QTM2aIlGs219sdN
- TLSH T1034523056C7A8A95EB3F527358BC52A6F977BE4BB288257F071354113A38A738F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 53b6656dcace966c260d3e6dc8e09df85d626e8c2f4661b8788686029da6af42
- MD5 e021867f54aab11b3682cad0d6afa6c1
- SHA1 91d1abacdf08325a631394306f09c4deb9d9c99a
- SHA512 e8055c56626597ff26e6e794434c73aadcfe16c8420f0bc0de169a3d61feeca7fedfb1ce787e0a76174d325bf4d37b39149c26f20cdc8f988699005c0b954b3c
- SSDEEP 12288:pViBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:GB33QTM2aIlGs219sdN
- TLSH T1BF4523023A7A46D1EE7BD273CCB85162F6B7FD86A36426BF071308162E347A19E3454C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 09978533fa347c7626a6a4a017d46b1a4781ca18bd3a5eca5ff371242043079d
- MD5 df0e9e8db626fed54bcc3cf1e1200121
- SHA1 5e064477d5f1fa1bfefbfa5700aded6ed3984be4
- SHA512 0e7cb648438e9134bcf72f9a99ada371edc167c1643404d9c2ed901c38193bbcce2a22ec564ee0bb29b9faf84cdaf0506ff24b5e7573c148be265fe85e1f2ae7
- SSDEEP 12288:KqBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:KqB33QTM2aIlGs219sdN
- TLSH T1794523057C7A4A95EB3F527358B852A6F977BE4BB288257F071354213A38A738F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 5e1b32e79259ed880d28cb2e92cb3a5f581c79b8276a9c9d2bc63dc3d291c202
- MD5 6edf928c0b1e6f590a795b9e45f7dc96
- SHA1 a5c528d4a5932c715818a6430e02b56b4cd83caa
- SHA512 2d63fffcc71e4a7f9453251e4b72d95fbd2213414f70d0dee9f218bfd62c8c74b20f0edf2a9f8b34fd442da17b18634662f7f032fede9a72c2f4c14b6537970c
- SSDEEP 12288:BjBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:BjB33QTM2aIlGs219sdN
- TLSH T1544523057C7A4A95EB3F527358B851A6F977BE4BB288257F071354223A38A738F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 f313ee593735785ac0d849acd1496ea72baca6a537e8afa6c3b3526d5cb9349e
- MD5 c0712b3350dd2781dc5184dbf897b816
- SHA1 dd91395b95970737122d4e534034986c8ececf82
- SHA512 942da8ae1792b45dd4d91e663332693e1a2d9750e11eae79a09e136c1b217f9c58f34077e2b3e11d714424cd11ecff5a86af3ea424052556489b982f89a2ba6f
- SSDEEP 12288:LPBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:LPB33QTM2aIlGs219sdN
- TLSH T1624523056C7A4A95EB3F527358BC51A6F977BE4BB288257F071354223A38A738F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 d6b9bdda821703c4fa22e6e7b0e423ee43224ba885dd71c6ed3200affc4177c8
- MD5 aa6ac9f7ef2166fd29614fcd2e1b84f0
- SHA1 134b73631b1d7267a773d5b54bd8c938c4536121
- SHA512 5dddaf5899f60d6a208c629863dbc88b78c673c506fc4a71da599f646a88037c8ce36cc7a4fc1597bcf1ad5bb617f6ffaa27fc0c511a69e9084614e6bb4beb71
- SSDEEP 12288:MiZwbVzzFEoS2cPvyHBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:vZMRzFVSOHB33QTM2aIlGs219sdN
- TLSH T129650195B36018F4ED77823ACC758916E6B2BC5A0760C61F03A136276F333A15D3EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 4ce51336d56226e06a4bc221c0e5c557885dcfb0ae842bd746ef48454089a2aa
- MD5 7a0abad822b52b00c0832fe855691646
- SHA1 b0514d4fe4135a9fa9e0ede9c9953b2fa7444a46
- SHA512 566021167d8fa688572d2c6d70d8a90a59a6eccb8508650241fb859f1dba195e5502e050d0e787a545262bfa9e00f097dd787889b7f3842a2720be202f53ed81
- SSDEEP 12288:UwBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:UwB33QTM2aIlGs219sdN
- TLSH T1044523057C7A4A95EB3F527358B852A6F977BE4BB288257F071354213A38A738F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 932e77b13be4cec88746a102cb2d5c3693badb9eacf04f526b90897347097b75
- MD5 9a3684423df85437b592d0d8aadb9346
- SHA1 0d49be1b1ced5d921d5ef67795c228bd5be54d16
- SHA512 89add0b5e22d5322179601232a996c08e70c0432821c86e9de73433dda5d9db7ce284fd01b8c102c1bb6af67505e68f3a8b68528ac9abb93e4da742e9b0210f5
- SSDEEP 12288:bkBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:bkB33QTM2aIlGs219sdN
- TLSH T1144523067C7A4A95EB3F527358BC51A6F97BBE4BB288257F071354113A38A738F2508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 94a81b4f94d03b647bf780f0c0dc0f32a1abdb61161c8205f99253ab732708b9
- MD5 44543d60f37a2a1132074dc246508aeb
- SHA1 8ff8719599d933e4fdf964a811d8f9274c20a194
- SHA512 6ad6bb24be1bac4c814afe1c6e097960b471b1a6b36e8f9fa9514d1f7ae98df91691ce76d95e1a972bae6eb4239674a2f51f374d86f085c35ab2cd148c46023e
- SSDEEP 12288:iyPz5L87Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:/zy7B33QTM2aIlGs219sdN
- TLSH T16755120777A531F8D63B9235CCB51612F772B83653649AAF032006762F376E19E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 515a53aa6994c24fab68525a86be3b878a49b5cde7ddc35750007cf4e315d320
- MD5 05cf0b4753b037d4e40393f3c48bcbdb
- SHA1 7ea4d248611a1b7a7c626ce909b7bb7cc2490d9d
- SHA512 b89e96260dc4228ce8e6ee2dd83ae7c83f563ccc7791ecbf159c0d8b7936b628d7a0427a96d997ebde7716298f54bbeedddd773e037a45318f8da83c4fb964a8
- SSDEEP 12288:twBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:twB33QTM2aIlGs219sdN
- TLSH T1F34523067C7A4A95EB3F527358B852A6F977BE4BB288257F071354113A38A738F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 ebc415bebf66cf322ca779f2495a599aa7ffefdee24b2b23ae513724e1e9eb80
- MD5 18f265bf7df37dceb1dddd0cc22bad1a
- SHA1 377fcf5e661ea49191f6e58fde0d78dd7de5cd64
- SHA512 a3a917d1944334830ecbc52e4e6bec02ea9512bf92c30d04890d86f08505e21700848f387b0ddcc089fd01d598ee08809052fabecd7e288526d06fdb45599871
- SSDEEP 12288:LwBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:LwB33QTM2aIlGs219sdN
- TLSH T1DB4523057C7A4A95EB3F527358B852A6F97BBE4BB288257F071354113A38A738F3508C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 51499dd7fa5b2486c1b483b6b38e2b54076ec41e5a20084e992bd21840b8008e
- MD5 a0bee5faae9c7273b60895140ce5842b
- SHA1 d07be22d83c59c1a71edfb469f12a73a3d170fb6
- SHA512 f59550ad1d5e0b6914c674d2944d9d4153b74481be0f9ea09905d8bf0a48bce29c12102be0e821b55d0b73b326e64a62112d023c050bce0e9bcd453f59aa7407
- SSDEEP 12288:LyPz5L87Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:mzy7B33QTM2aIlGs219sdN
- TLSH T10F55120777A531F8D63B9235CCB51612F772B83653649AAF032006762F376E19E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 32c9361b59c987ba7c1aaffd37f558a1635f72ed87d26a835bb2ffe1599ffa27
- MD5 c9ea99ece1a07f2f91178f56c9061d57
- SHA1 39ad9e019afed52acd90ed4c8e869f02a3b92e65
- SHA512 5306252e95d5ee8364b7fd28ed5960434586b6af660a67f94dc41579f29bafe6902473d977d70a98f273b699043d61fc2ace0f55da7c8d9dc29d8b1d92936ecb
- SSDEEP 24576:qcP4mcvIjkGOxhKP2l71SNKbrh/8KBYB33QTM2aIlGs219sdN:1P4m4IpOO67N8KuQ4XIlGs2fk
- TLSH T1C065AD2DABDC0096D0BA917485658A4AFAB1742A2F3286CF1160933C3F77EE54F35F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 c1d8dba4fa7d16ad49b95452d34f9edf1b251abd1c4311e7c7f962ad082d3033
- MD5 f8da1103238ce6427933d13be80600ae
- SHA1 9253cc9f7c0b1e45dbc9a0f5561be2d583791d08
- SHA512 93335bfdcdf4b82984b2bfa6d107a65aaf7fb645a915f06978254e7a7b6388bd7b1501ee87ab7ca11728ed3f3c09355106bf48dfac80bd4e448b6e351243d462
- SSDEEP 12288:QbsfABjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:3AB33QTM2aIlGs219sdN
- TLSH T1A555010AD2A802E8D16E6276CB654641F7337C1593E093DF13D1F43E2F3A6919EEA607
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 ddc93ed9cb8c3ccd04b1498b2edb7527c643712a8581b74f984ce62ca62c2a9a
- MD5 bbb15338dbaa74281a96ada8ded141d4
- SHA1 05e97117f3f1e0b0e9b6fb772147eea152b00072
- SHA512 d6c4621ba0205af8ea7cb0ca29aa704543b54d73f49ccf6d25c6b58b08eaaee01ec659b81b217f3a53c5829f114485edda43bc33cb678402202f7cbecc07417e
- SSDEEP 12288:CgBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:CgB33QTM2aIlGs219sdN
- TLSH T11A452302AA6D9A55FB7F6272187C8171B93BBE49A38854BF571324253938EB3CF3500C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 2ba5336aff6c696170542c86662b208d146031a1bd8d7dcd0d62cdd4e53790ad
- MD5 66e4956290b7b18c9d93cbb0f2e09133
- SHA1 a62a6318610a246aeadd157899a5b86cd7918e8b
- SHA512 d1ece9f80297eabf4984bbaf62dc65261e01e3e3a7e564e0e93faed16108677fedd9b009bb4e8b1faf2dfe4dc2ccefd54ec62a8360bb497ecc8280b445f518ad
- SSDEEP 49152:Ja0h2GEkuAe73q3pp46zwwQaQ4XIlGs2fk:Ja0hNYG4JwhRR
- TLSH T1BF85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 8e63990cae961668960412e3d93118ce7cec2e3268959c879cf384c623dddfd8
- MD5 c1c3840a7d6064ae1b3dfb05b1e48e3c
- SHA1 e63c46514baca9614075a0a5c67f9b24ccb9edc2
- SHA512 6788c77be9c2e080fe5a26c687bccc09e50f2a062b67d04c4492f2e46ff90fec16d1226aef28b33996b9d778d6e64f0c2bde24eee43866040930c09b667497c0
- SSDEEP 12288:FhbHjfX3Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:FhbHjP3B33QTM2aIlGs219sdN
- TLSH T1F055127E26BC21D8F676E27A98B58146E732BC16131063FF1392817A1F3BEE54D35A40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 12fdf5d472e292cd5b3c56489ecfec883296abd8cd8043bdecb8ad733e6f12ac
- MD5 d08eb64fac90791bca85d0dc109f6780
- SHA1 405f9817a04cf3141fe7fcba9b6997d14d0ced84
- SHA512 5f616ad6deb2ce0304884358cdfec3b1241f351fc8da564f49b40859c87b3e581ab5c75702fe0b508db9aa1f86c89120fe114afe322bfe0d901dffabcf513821
- SSDEEP 24576:o3YgnJcRTk4yti+R5dpR//B33QTM2aIlGs219sdN:oIgnaTk46ppR/9Q4XIlGs2fk
- TLSH T12645AF2DF2B910B9D8AAD236451143B5FB71782D1F209ACB0170C538AF1AEE89E35F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 e62ed85d01cdc1707b93f1ee8e931025433b35d86c65812d7115f23ca663dbd1
- MD5 05ad1fe7feead70c2ff5eda20ecc69a7
- SHA1 219be31ae3e01d9d682ccb34200009552f22da6b
- SHA512 c5672657ad446a867c2f9db0b92b699d84226da52eb37e3043a5a43e5926be79210c1cb15e6d55e650eb2caf2c99d17fb8b3699b0a66899e9f84c612ac7bb3fc
- SSDEEP 12288:EUBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:EUB33QTM2aIlGs219sdN
- TLSH T1B8452305292A8A94EF3F52B35CBC5166B937BF45635825FF062364223A38AF78F3504C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 19145c740555b8ad2d4bcba0cfdd1ddae95656aafe06f8a83500e5ce3353cf53
- MD5 73cfefaa64e3e470e1fdaba607a97076
- SHA1 49f0a52f9b222c97eca70bb0c422423ecc96723c
- SHA512 12c74c47414a72c3690057e4ddb9cfc5706461b03e5acb36d6326f2780c9d4e95dff280d4b48c74cc6b599da7f26f0b8a441ecd56ad04b26d4c956094ba56d41
- SSDEEP 12288:yObfA4LWOsvAYFThBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:jbL3UThB33QTM2aIlGs219sdN
- TLSH T1F3750115F7A400F9E97B913DC8B68616E272B85D0364E7EF03654A652F237E28E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 38e387c9b8af8c6e8090a2d8f6ae916fc2d5a007c5174ba86f0f9c366e89d8b6
- MD5 a67fec1aca269036b726e8edfabc32c1
- SHA1 a6a169a2c3a8f426f79cda08d337c47c6af6e7fa
- SHA512 e2aa6a6ead732b9ee43fe44308338c66eb44c6b92245ae943fdc28c3adc1ab0f5e50a6b747d807221a1246228b095c93c934b9a26e5a40d87525626a3631335f
- SSDEEP 12288:ppFtIOlBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:IOlB33QTM2aIlGs219sdN
- TLSH T1CA55121A36ED10E4E57AA13988B6434DE772B856132117EF0391807E2F67FF85D3A644
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 e9b01cf4494b1b363d3a5e9a047db7cc6867e6b8188a5062bba27d980c1a4e33
- MD5 88587253fcb603f16871413d340464ee
- SHA1 0a3a9fda9c2ccb320c127f4e8227a266377ae369
- SHA512 42bf68d68318ceea87ea3b97c965f7fe2af4f8153e24764f8e5413da3f9f6963a133f1906040f6e5a219f1c8a2e12402503d64e042ed7ce38d7bde8288404445
- SSDEEP 24576:p7NM9YmZqmWMUkPjZM48Mv6bEhswB33QTM2aIlGs219sdN:p7cBWMpPjN8DbEhVQ4XIlGs2fk
- TLSH T1C965AE2E6BAC81D5D577D13DC9A28206F6B2B4611B318ACF1162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 2ddca7232721d6183e70466a8d7fc063b4f6041be9341ef85ab3998f9817ac64
- MD5 4187009ca1726f717ada0bd30cf58389
- SHA1 b3a295ccc9305ea945f6ff24b586dd5251383641
- SHA512 f982eb0636b0acd9758e83b7cf1aea4af9edb810a0cec2e52917e852a07b4f4693042aed69f3fdee475973e9923202bedaf73820fe0b314374fa785ab238b710
- SSDEEP 24576:iW6BApg2YuyuNDYTabvcRvNYf8km1WB33QTM2aIlGs219sdN:iF2YuHNETovcvNYf8kmwQ4XIlGs2fk
- TLSH T131858E2A27ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 84f398ec4373960320e2652795f4fb6487737bf0635c37347173626c1c4a0f41
- MD5 f241d2ee267b9e05157d7e8d89f920c1
- SHA1 36545a84235b3b5107e52da62a5303eff7f2323b
- SHA512 2612383691d401a5ea92b5a7fba2fe1b7e9becc9f7ed582573ea7231fea9cb61c1dd4fb82739b49795b426fc34e4c642261f15f17055eae36202d35fb6eaf736
- SSDEEP 24576:TAFs06+OmlfkNXEbTo5B33QTM2aIlGs219sdN:cFs060lwXu6Q4XIlGs2fk
- TLSH T1C965AF2F66AC00D5D07ED17E8997C91AF6B1746303255ACF0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 9430036ce5d9a60452290fa1d1120eb197f1bbc0bf3354f5553fdab3e242d2ab
- MD5 cd7dd3d6da4479eb84d42443429f0ca2
- SHA1 6fe40e31fa78d286a4447448aeb05d1a149e39c9
- SHA512 84e3e9b6b8218446f971f49e26b841f0efcc67bc501b0eca4d3214022083849349537dd6b5c15ac3581689fcc2f8a51ced6592708c9feef217c355ac298bada9
- SSDEEP 12288:mCJnJ5D3VkrlzxQBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:3JnJ5D3WtKB33QTM2aIlGs219sdN
- TLSH T13375D02DD2A810E8D4B7C27581AA1756FF72386D2B2269CB1874D5353F12FE09E79F08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 e7192293e281dc03698bb126bfbe790efa1c6d489d531b6f79fc23b03a129a10
- MD5 3fd3a05908db8ec6ada8de7f7e92e9d0
- SHA1 0352fa8a96b9660a7d0130392e4bfc4328b4afd8
- SHA512 88ca97f6475a0a8871aea3210623302e5426010c134f7494952a1c0bea97f09d921806fa66ef9038068fa4881322c3d4ed6a1b5fceaebe2eefacf104cbce53be
- SSDEEP 24576:nEPohm6/7IIXdwcXrif7qQncjlP65i3Vu/B33QTM2aIlGs219sdN:Ao06DIKdwc+eQnSt65aVcQ4XIlGs2fk
- TLSH T1FF955C16B7EA5294E8B3CAB1C97291169B327C509B34F7DF0A80C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 413e96a76e4d9c220b84793497dea681773b2b03409f35589e365477465991c5
- MD5 20c80e13d7fea791d1ee9015b356595f
- SHA1 7ca46a287aef60a69d0578f1d84338ec54451c89
- SHA512 b6fa2b8e4f8252245f1ae5882e927ca83ee17f4a5bf7497947f8037c296f386bb1e273013ad9a568f47921c127c5e3e3b00e4811c46d55f717d2e1e93f980a3a
- SSDEEP 12288:9EP3RruBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:eruB33QTM2aIlGs219sdN
- TLSH T14E55125D2BAD60E5E63BA13A84B08245E373F465635127FF0262C13E5F37AF65E39A00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 ff880dc3f75d0a7021ab9c35e3e1e93deb7e9903020d115123642d6c570c6c1d
- MD5 a4e249236a716667cc11ce30973fd673
- SHA1 16b8d754c197667aa8d5c5bd0e8147970b268661
- SHA512 d1013d02649b4da61a9e34f4ddb2afed8b868fa2cf4694a37b0f5c6882bd808425d9746da93b5af5eaa3a690afd0c4037af423f30facd82dadd29b5a6e3914e5
- SSDEEP 12288:DjkynBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:DIynB33QTM2aIlGs219sdN
- TLSH T18E55120523A855D4EB7A42359CB682A1EE36FC206B2053EF5151F63E7F36BE19D34B08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 3f4d416552987b466d9c6f52d2a3fdede9ebb50472994bcf7bc50355ab08af53
- MD5 3d612a89262db233f682a1dd944b9b0b
- SHA1 22da68ffa9b373fa73ca40d12233fa79e4bae3fa
- SHA512 1e98f377d7c54a1b547453a54a3b0e5bf67c466a69614c3e66620649752ab7a1b4c3896774c084e1ef0d18674d4030b0577a0031e198075397ccf2e896866556
- SSDEEP 12288:KFVBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:IVB33QTM2aIlGs219sdN
- TLSH T10B452309293A6A94EF3F5273587852A2F577B915635834FF0223A4327E39AE38F3544C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 e2224b9a971de8330a6312626d2674af5834eeb0d124327d3486d135519b8972
- MD5 84b1d13638d27135298ce14e2305e758
- SHA1 0c3bebac0bdff4e0d03f50da6f91018ac0ef64d6
- SHA512 42f1cb22e54782580a6f0873493e94997147a8bf1c8e34778df152451459b0e075ade45b69c1966afb52f6a2003f7ae77ac2f82319efdd42631f2d415cdecb8e
- SSDEEP 24576:/Q9MxZKdcz97w3oB33QTM2aIlGs219sdN:/VKXoQ4XIlGs2fk
- TLSH T151558C2DABE9099AE177D23594B250C3A633B4311B35D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 3bfc49230f568d9434ab3dec6ecd703f10997f08e78beba78ecf7dc510ff91e0
- MD5 0ae663eff6021e63f259d01558bb9989
- SHA1 7f256d232c5384c7fb7168c8e3561bef5f0f6b88
- SHA512 695eaab4cde9d98f6a4f78f0133eaec43832abb70fc654ef62f6f330e11dd356f76aea444bc6708c7608bdc77db0057221e66f8fc14f10bd6de02d92f69a2b82
- SSDEEP 12288:PyoKo2HRple9pLBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:PyocxApLB33QTM2aIlGs219sdN
- TLSH T10965E01FBB6E40A2E176813888958345F773B0305B6267DF5692C33E4E27AE9BD34A41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 99bc11e8ee781f4f40dca3393566cede0ecd78c4416fc28d4f35f1ce5754c042
- MD5 17f153f698737016747dc8f3add4e938
- SHA1 ce0a0b2ff6c54017924302325d285e8ae9c271c2
- SHA512 b50b69a2681cfb246a373f998fc061797113d68b251a350e95bba6286891172642bd3f6b34efd21b3893b24d16023bb63e736c94a29a645571b0759eb1408db6
- SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKZQ4XIlGs2fk:X0zuNItRR
- TLSH T17DA57C3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7fc0e2ef8398b4f5dde3e55f93648257a49dc49529378e6b20beb4b79481bbf0
- MD5 4ff725c76e4eb9d56233aab28668bfa6
- SHA1 0f90a78eb1de68fe01275543122e0c1a0a5a2ac8
- SHA512 44dc556e2875c076fd7dd85d997f7822182c4fc4efdb4a5d6e881518ed104c5f48a1a0b8dec7db97c0ee0b1a6283c9a5657342c66b1e1f0d292be0f119daa4cb
- SSDEEP 24576:a1QT7EcpfxR+N5AWAz3ooiYujMqbuB33QTM2aIlGs219sdN:nTDxR+N5YzT4jM7Q4XIlGs2fk
- TLSH T14555B02EA7F815E9D1BE85799A33C512FA727821033193CF4260C17E1E6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 d7d42817903f0ec18ac5e94ac6d2408346581940e955cff1cc9524f31076e51b
- MD5 515fa0450bebcf398107d8fff4f971c2
- SHA1 c71f57e246ddf18bb6853bd997a507d956757ffa
- SHA512 e7b9734998e8decb8bf8c11cbecdefb99f646f324cc0bdaa22f00cf2986c3cf862202819fc8646b59941e2ae70a5adc77bece433e1c82943e89d7fc7bdb8fc31
- SSDEEP 24576:DTMdOz0FFS+bmSLiB33QTM2aIlGs219sdN:h0K+bmSLyQ4XIlGs2fk
- TLSH T17F75E13EA36D14E5E57BC27D9A538906F6723862032166DF0690C0793F5BEE47E3AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 8e084e0d6aba9bfe3a894c2757e288ef47ec82280e2f6f7e93ed58d2ce331d9d
- MD5 4cd84e85da4d1d8dc3f227e1d37c1d3d
- SHA1 7c94ffb54e66f5121572431308d0ba4736539526
- SHA512 a7fc2b902eb3b706e84929bf2875100e391c26759fec5bef5f1f5eaf8c053224af225f45dfa75e7838b155657efb7b9bc359e81e3ffbfa8afab09c585a13f918
- SSDEEP 12288:/47hBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:KhB33QTM2aIlGs219sdN
- TLSH T10F55120D27F834D4F937927298790256E631FC26232426FF26A1C47A6F36AE5CE39704
- MD5 SHA1 SHA512 SSDEEP TLSH