76e57640afca2996ebbe20fc1d53e9d05e1f6d2f0b2632c314e023f9810b70cb

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
Size 4.9MB
Sample260720-bl7wcsa18q
SHA256 76e57640afca2996ebbe20fc1d53e9d05e1f6d2f0b2632c314e023f9810b70cb
MD5 7633ced4410b31a56b8e1c5f0fb1debb
SHA1 9bea21220fb4ff722aeff49a79dd4be1c733a19e
SHA512 c8c14d6c238dd6115347c6c304ad93f0d9e2f9c1358dcfdf7d3fe57b8c38f01fb1de1718eb217ada0f4d0e85794a651f20225266b3b88756a3a69ed6feb19969
SSDEEP 49152:auJkpvUqUBkmp/W5OltLRpiJUj5y09P98UAWGjNfrnC3nNQ4XIlGs2fk:auInUKmdWeRpvjE0B981LQNRR
TLSH
T16536BF91EBC740F1EDC35476A13F3B1B9A3E9609433685D7EB902D719C213E2693E286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4780	elevation_service.exe
4680	elevation_service.exe
1816	maintenanceservice.exe
4784	OSE.EXE
3364	PerceptionSimulationService.exe
4568	perfhost.exe
5944	ReFsDedupSvc.exe
836	SensorDataService.exe
2468	ssh-agent.exe
3568	AgentService.exe
3676	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\L:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\N:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\G:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\H:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\O:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\V:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\D:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\T:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\R:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\W:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\U:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\Y:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\K:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\Q:	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d40f9f648f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fee8c842e517dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1a42742e517dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b96bde42e517dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3568	AgentService.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: 33	3676	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3676	SearchIndexer.exe
Token: SeDebugPrivilege	4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
Token: SeDebugPrivilege	4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
Token: SeDebugPrivilege	4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
Token: SeDebugPrivilege	4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
Token: SeDebugPrivilege	4780	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
4648	2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 1400	3676	SearchIndexer.exe	100
PID 3676 wrote to memory of 3100	3676	SearchIndexer.exe	101
PID 3676 wrote to memory of 4612	3676	SearchIndexer.exe	102
PID 3676 wrote to memory of 3148	3676	SearchIndexer.exe	103
PID 3676 wrote to memory of 6032	3676	SearchIndexer.exe	107
PID 3676 wrote to memory of 1312	3676	SearchIndexer.exe	108
PID 3676 wrote to memory of 5228	3676	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_7633ced4410b31a56b8e1c5f0fb1debb_amadey_elex_glassworm_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1816

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4784

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3364

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 49bd011948c6f53da1701768de11ab3daafd102ece722f4d891faf8f87f5cee8
MD5 59e26113f48a6e3d16c14152adcdaa55
SHA1 fd5cd845c4acfbd14b86ae6ab58c6fbe7207fd01
SHA512 3325efeae75a70f74b657f689cfa031178058b5b3434ea3b692526a08191c7f000f89657a734db6ba485e6b5b025940ec301ff7cc1432f77293a2355f50ea9d2
SSDEEP 49152:Rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnjQ4XIlGs2fk:X3q6sjBERR
TLSH
T1AED59D03F2D900E8E06AD178D7569133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4652845ea62e43388ce4adb6048ab803332bebd9eeccbde56c41cd75212d0072
MD5 cd5705d063efe5bc16e6d1ad187385e8
SHA1 487a8e12f75fc06f13cfe67283ab979aa5a682e2
SHA512 c9cc45a31bd04a42a3ea013a42b0d006720cde934ba00b858a049142fe34ff79dd089f50ba9a711562cf1dd3f1e63d2a44b92ef1fb578d669ac7ab3790623fd7
SSDEEP 12288:o1XLsswWkxy2lRq2czAABjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3:OXYfDtczAAB33QTM2aIlGs219sdN
TLSH
T1AF65F12877E509F9ED6B8279CCB18112EA33B84543A4E79F03A099251F337D85E3EB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bb47a2494777a7b09c28241e6602ce025ef9f7e103484f8689018bb76afad327
MD5 caaf769bea6c5660fd9690b76a4b03e3
SHA1 5bba5a2b871e4a588a3304ce3834701efa3f350b
SHA512 2f8d50bb57bcdf68e9b36225b3daa58fe39a162d9096a55ae22e2d36a9f2fc02a553c5513fbc4816ab8362d91631d29f456e656045525aca43a3b3ff7a84e262
SSDEEP 24576:D0Le5ji0hmxxrMlB33QTM2aIlGs219sdN:DPji0AjeQ4XIlGs2fk
TLSH
T18E859E16F6748331D073C0B9C5D2A69AED72308657308ACB4286D77C7E67BE68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1a3b62e4853a45510dfde25bc4b4d8c0c25185336c2965fe74e673632f418fd5
MD5 1f9d4f2a10a634ed2edd160abda6fa9e
SHA1 f760a8e924c92a0e0c4b7682dc37d39bc001b7a7
SHA512 75345d9c7e62fed816a49aaad2ef24d66694156eef338b476cb8435a3fe79c00ab927e476f83545b87c10b799b349cf12d537f95c034aba9f8522c363d5fadc0
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWn6q8wyufB33QTM2aIlGs219sdN:n/ezSC6vUzPveHjyaQ4XIlGs2fk
TLSH
T12C756C15F5788323D0B2D0BAC5D6BA9AFE323046573089DB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 59d7288280e7d286e3f53e58dcce533c543d746949e4c9887be40c811290c197
MD5 813d037ca558a6d6fec5f65ce1cf3a29
SHA1 c4b136ca853fc619420e3375d4583855fd97bba5
SHA512 a53b87a87da031ad86db90f303008ddcf5ebd614807d9f80765b1b8d5d4a9273fd8ec179946aa5e007fe0580480ce14292b116bd963aa8e2a620a4bdd785b0c5
SSDEEP 24576:FVbqPb88hv/l+YkB33QTM2aIlGs219sdN:FVO88hXl+lQ4XIlGs2fk
TLSH
T1EC559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b8d741fca9bee99cd5c3f86add5cdf0a9bae6dd8dab8e8a73372249e6d4bed4b
MD5 88ead8151b8b3709b980f0640af62d03
SHA1 f9ef276701e6566181ab076aeda216f77ff7d746
SHA512 3d59b1060847ba002b94c504e4eb36b6fc3b34a210277ee74c0130ad934dcce3275ee5f635035919a1fec37b7ef511764f60f258f182e88a919c2fb2011dec5f
SSDEEP 12288:RL5Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:RL5B33QTM2aIlGs219sdN
TLSH
T1234523026D299A90FF7F52736CBC51A2B977BE45A188297F072378563838A63CF3504C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3ee84316e76cd58ef1c7cdd3fa4df98aea072cca417ecae5bf72145b5f493d64
MD5 b5a6974b367088a9bc8271b18324fce8
SHA1 e593eff1b215cd1a00b55a97bb2ee2ac3a69eab0
SHA512 71d12589e117c6aa64dfb8296747c09fa3aa031353e8c40af8ecfd4d9ea3b085e4f112cba3d5989912928b7d23959f3a163010602a1891ce26663b2e3853787b
SSDEEP 12288:weBNUbTVO86UcBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:wJIUcB33QTM2aIlGs219sdN
TLSH
T15765CF3BEE28FCD2C67E9DB95AA18240E77278304B51A3CBD171820EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 42e5fa0f6511430f2d805742a9381a457869cc5b5261d0ade473f8d4973d4f00
MD5 14ad1f32ed9cdfdcee836bfa236b6883
SHA1 0d1f3f6aac0a43ef7f37308fd8ccad1185a0bf0f
SHA512 34dab70d967e743a9db73a6606e20b13133a150767503585a2778ac6fbee22d73c5670b25c6ba9f4f37789b045bf9ca62aa6ef94a99be8f2bcb5c5f34491eb87
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THV:lQvGAdlCEL8c/DRNw5CtRR
TLSH
T183266C656BF880F5E0B7E174897A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e8f8fdb9703831a42c47c555e1d93d40a125b6e74c3b9630428694d44c401bd4
MD5 e9a2eaa5548c919af2162562649cace8
SHA1 80ea290e8acc69a4576a8b098c901f9f8c85f4b4
SHA512 4735f47a0180783ca6d2595644cc61acc84d1cad3d86c680e54cabbfcef8c45468c23d1a907524f934fe3571a7dc9bceeb8e258959efe9ade2bc3407c94969c0
SSDEEP 12288:lAwSfxL/2Dc3RDLLmt0LDQewsAj+Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+4:G0ewsAj+B33QTM2aIlGs219sdN
TLSH
T18075F031FE74E436C77F0DB21B35C316683DB9204B511AC7E3A88D9E59342D26736A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4ec4efdbbd9ac515f1d951b641594ac229c298524d99face8c44cf75215fed0b
MD5 8c19e39fd6c984269e0fa71ce0aa4352
SHA1 6557fe72e9a925297aa43f460325e5114dcd675b
SHA512 0e0865d60328362fbc43dcce59a9c0020476ad0f9ddbdaa3b3f9ba9f8d8c48ab4495072d6f110dcce989828f4b83d36d1ff124a7c0b5522bcb9729079171bb82
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWRR:cUEtQevvqc2W1cpV2tI32W3
TLSH
T138474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 185452ad8ed557714f8f5a570781d92c6d6d78df5eb0aad273d6cdc5c6a57f8c
MD5 08634e0b4c5dfe7796e8a31545a51d24
SHA1 cd2de37828ff7e3706def4992d306b4966d2dc0f
SHA512 b74dfbbf2d7858a480d37da40e62a24dfcc185dc9e07115c29423493dee55726a4edad24f62df9e9d4eae195f08b46402c0c7ff64d2bdb256e503f2f8d1eef55
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/zOQ4XIlGs2fk:soquVjnm5RR
TLSH
T113D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fedb9de573fe13c25f9588f89e8797f151b77425e61cdf31eacdc8c943e70dc6
MD5 161b793a376aca0766effb67fb35b0c6
SHA1 5cc8a5e395006cd538b1b37ca85c3a13f9c1cd6d
SHA512 2985cc955e4d92033a0664a833f17db60f0af301730be68ba1baf05a07a60ba11974b3d102fa442f6b410899cfccbec65353e9fea2cfd6ac9ad9857561b19952
SSDEEP 24576:KAhGL3IFoiwtA5l7S53LB33QTM2aIlGs219sdN:KAMUFoiq5JQ4XIlGs2fk
TLSH
T1AD35AD81EBF955D4F5B3AA7899B68171EA76BCA65E30C20F2120D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8b15b2fb25832dfabd670db84f55c39d5d5affad30e7cace2e40da483ef56222
MD5 f812840950be48bd5a902d570f888cbf
SHA1 29bfc14e144cc8f088a58ecefb5d7f0168e5a327
SHA512 76097c2662c70abe5e9e75d489bae18ba683fab2974ca1c61f7a402a3d2e24e9451bb6cf2489d57f87e435a27338516b3f2cb9d41d6add4004a1d3904361a815
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+C/Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/P:ywu4OWKB33QTM2aIlGs219sdN
TLSH
T13D65F14676A50CF9EA67823985A7C136F7B3BC022624DB1F0760C65B6F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 66305f54aec1d8e8b7f91d7f4d50360db722fc7055272f226b914665875f910e
MD5 c37990875674139feafb86b94655fd0e
SHA1 99ba277285b897188057d63752d6466a7d67e199
SHA512 4561a0f24017eac1169fea93a9797173161c63d886f75f94487fd80449560cdaf80a4906736da7dc2cc8448458cd2da3e5ec8c359c10a60e48d6e2c04710fdcb
SSDEEP 12288:2eZ1IyOBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:rZudB33QTM2aIlGs219sdN
TLSH
T18555124A37A421F9E6BB523ADCF45246F773B852637443DF022246662F37AD28E39314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6c52cfc55ed89cfecda2645e0a3b0a1fd5208e2b4cddcadd089a345b041725d3
MD5 29e774c6d884f04f2d1ef46ab88e8db2
SHA1 4bbe6b8422eac3a7af1aeb3461c18270eb68b869
SHA512 e01d84e62d485d1547491a30758b8f437e55fbf75a259ab053bbee9fe336188bea1a31ea33c40bce6adaad2a6a91aff049689530af65fe8a4535884d2c2bced1
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:NQRQyi36YOcPbLvw2gAf+PN3YRR
TLSH
T1FF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cc512b9ac8795211f156b3052ebd47757dc3c7fb0162e5060713d029f18756b1
MD5 89713b1093cba870d2d623508ad884a6
SHA1 b7ab78bb6e68bd65304c193bdb2babb8c3494efa
SHA512 69f9344c1dee4f92fe4e23b57f404aca5fac53f787fc0c8994698d768a72683a5357f1a6ed9368115725bb7264411288bc93c52b177699ebd352a8486088515c
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:oQRQyi36YOcPbLvw2gAf+PN3YRR
TLSH
T1A0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fac09d51ba9e92b360ecad50ce6d61fa85e8ec785deb107eb06f427bf8dde80a
MD5 679c69c52e0558f988c24e50852e99dc
SHA1 c7c339c73340747d7dafc9bf5887d23a09cdfa1b
SHA512 f30aca8352ed6eaf5791caa580b73214622f31160d14ba202a9875b0ebebe369ccdfc9b278b3fa4b7dcf7f6052d7c77331790e0fd14d8ccb835f1a77712ae996
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0NB33QTM2aIlGs2e:668Qg55nhceWu7PNU3/eQ4XIlGs2fk
TLSH
T16EB55933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e2d2f23569db1cd139fdadfa8818cf35b806678c66eb65e89d430787c33b63c3
MD5 404ee8b8bfd50a7c2c324ecbef95dbf1
SHA1 ad64107a51147b707d2cde4239bdb8e28bac7b0a
SHA512 8e38d7ee723870ee7a50c9e39fa48f647540d17aea059af84420400e14291524c09e57cf3f5256b6658f08cc4095b89af1c8a81c3070b8729c62b042793e899d
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99P:/y5112gYy5azzVvt69nLKnhZfRR
TLSH
T1E6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 90a42ef476aa460a24dd5b26d8b87cbd38ad16c1390e4542b156ad1b0a8136be
MD5 a17d242452b49d778bd352f3023bca3e
SHA1 f99666b978eecae985ca0efefddb93d3dd22b4a6
SHA512 2ba727b8e1d60afe2f848dfdaed9be43ec208ec3462d778cbeb2274b48929df1e8a32bc9fdcc896ecd5bcb847d5088f388e347d8cb943303add57a84ddab14c6
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQQ4XIlGs2fk:+u6Jmdxd2dQRR
TLSH
T1DAD59D13F1DA01E8D06ED079975A9233F962BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 11a2a6a320848b2bc645da300abcf1415f296f13b3c32203c873d3a8bdfa9227
MD5 682b3f03040dfd3c80f3ef88aaa24c54
SHA1 4753dfc0fa96f5280f921f0422ac61622695d1e9
SHA512 1b82c4481c88348cf94832fdd55c743deddbed0e962e28fbf7afabb152ed5a3d8636d81135825f6bf3ed56c10e803989d094e522396a7ab34e223ed5d62d5496
SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4xMQ4XIlGs2fk:4mifPWR5RR
TLSH
T1C0B5AE13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1484bc7555deb6ccf8f3e5a2028695d2d9b81d91073528cc9c381181d989e1e3
MD5 c2ee0daba63df7c1473d8fadd4d1678c
SHA1 1a0be9016e01fd5b2cf4cdd6717e395b9d8326ac
SHA512 68ed433285b9fcb4a6375f3d3fcc1c2e594d598e5673b85e4bbbcf2d1e28386b6e799e271c673dc92ca03feff6bbfb858a148bbf2ff81bf414f2093e979f8fc6
SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHqzQ4XIlGs2fk:f5dKii61zRR
TLSH
T105C5AE03F2E941E8E0BED6748B769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2806a22c0b980fa30ed15c330362cc7ea3b8e9590c46e8c140d71906995081b7
MD5 6b3b9530961fd2bfe16c08334f3446ec
SHA1 258fd0af7b91e3bdf8155695fef4fd3d088bd917
SHA512 8eb389056c01bc08f5e4fca732027cb6acee5bfb9a2805c933e8916a630ab287f0713599a09d4786984b07a6616a58dfa1197576147e3eae55e57f40b1aeefdf
SSDEEP 49152:GhtSn8EApI0fig3giDn0AP5wgQ4XIlGs2fk:HX2imph1RR
TLSH
T12A95BE13F2D901E8D06ED175C7568632E962BC060B38AAEF0A50B6561F7BBE45F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ec2439bacd59c8427c105408ccdc5c161d3e612bfaf4e829f217fe7406700e70
MD5 6d8be8271cedeacd9b3efa9e1083e567
SHA1 4b6e07d1b77d8f575691f3f0214942933ab7e974
SHA512 1af55c6026ca47d4fc25cc1168f89005b71b14833dcc0b4b9565748729ba254af6589abadd1e68ca51c7633e2d0fee8727f39b2e9030ec69adccd5dcfe3e7ce0
SSDEEP 12288:dxBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:dxB33QTM2aIlGs219sdN
TLSH
T1CA4523056C7A4A95FB3F527358BC51A6F977BE4BB288257F071364113A38A638F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 82f520efdbc45aede40e645a08e1c5d25e4ef0c821ff6b247ae6fc0e65721b77
MD5 937fb1bfe58d7dbb3444511b3a01a1b8
SHA1 1473158da76dc0e757f99f26a3af0e23914436a2
SHA512 c65ca0dec48cb3503aab45ea5896bb5bd27a0c1b6e6c70fe951cecd39b52d1e2289477b7c1e18d9b2545e90740e13f892db3d71daed96c1aaf07aa0339724527
SSDEEP 12288:7yBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:7yB33QTM2aIlGs219sdN
TLSH
T1FA4523057C7A4A95EB3F527358B851A6F977BE4BB288257F071354123A38AB38F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c244614ea2a6bfa00a8b24b9452598199c8cbbedefd2adeb541cb6089e0925ed
MD5 238a2b2be2fe638036dcf17c06514af1
SHA1 11858d3b856240b18b85cc0dedc14811d2d23f0b
SHA512 2c479de818890ae91c8ca8bb0d973f542e422a9ebb4815302c4f987e66b31666ca17eeaa7907b817878ef906edf3cb8e10668529c840fa48ce67feafda9e85f5
SSDEEP 12288:hUBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:hUB33QTM2aIlGs219sdN
TLSH
T1D14523056C7A4A95EB3F527358BC52A6F977BE4BB288257F071364113A38A738F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f402a3d90a87f06541f625ec27bdd647eb89429ea0320e2ab9c5ac76b37c5c8f
MD5 a855c334b81f76feaf3e228fabd96f8f
SHA1 cc3c2640ae4dabdc69990079f426c0de6b16c746
SHA512 1c8a5248e8fcd2b838e973fec60a55c5ba0267196b896b882b619f125da02e8c3b22c94ff0cf0e4478eb974675c48fac91df6e6370ae9f0d9ae70612172bf12a
SSDEEP 12288:NVrBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:TB33QTM2aIlGs219sdN
TLSH
T1AE4523023A7A45D0EE7BD273CCB95162F6B7BD86A36426BF071318162E347A29F3454C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 28bfc344e2becd7c24971a612a73238f4758529c95a7e3ff4f0736b455977456
MD5 8a06aebb21c7805b1d6931362d44f222
SHA1 07dab727d02dc72871d5cee0f0e64473a482aa18
SHA512 e0494f65b2b878e4c6d7a0c155015318e3571262e8b9814857020754d9c04a552c2cc01f6319ef909dbab156c122c474d40b8d5152f0905151fa8ec63b6fa105
SSDEEP 12288:TTBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:TTB33QTM2aIlGs219sdN
TLSH
T1964523057C7A4A95EB3F527358B851A6F977BE4BB288257F071364113A38A738F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c306046ff5a885c5ce4f727016902ca5136698a43c69aec02cbaeb505f12b49c
MD5 dc10d70176400c38223dfc131dd2e456
SHA1 8e1bddc4436e45c03cc4297aaf661219866ed72f
SHA512 0369e1359d14f2c51440be67e498ba03653883aad13c21566d862100750e5643cd084f5632d6f85f42b2b11054d0d7edfdb8920531e796defe172d6ec6745ca1
SSDEEP 12288:f2Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:f2B33QTM2aIlGs219sdN
TLSH
T1A64523056C7A4A95EB3F52735CB851A6F97BBE4BB288257F071354123A38A738F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 950f6d5922b3278ae13d73bdfed8a6aaf4ad83b8d08161dbe92082bf76b5619b
MD5 9940e5f8ee4d6453ab6d41a06654a7e2
SHA1 8eb27bb0414148e5f7eb648b10aede002fefbaa5
SHA512 b120ad49d96dbbbae135c744c57b4c915720e024de4fe0ff7b66197825401e52ba5f88ef21d4d62c6ece67a7b63ea3cbee1bcdabbb8ef674a065b0e2bec58c8e
SSDEEP 12288:T6Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:T6B33QTM2aIlGs219sdN
TLSH
T1424523056C7A4A95EB3F527358BC51A6F97BBE4BB288257F071354123A38A738F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f70aa7a571be5ec0dbe68bc13ec7db2174c6b8548f83f34fc50d6694205f32df
MD5 a32ab194227919b291df933a5f25907e
SHA1 d3a9393e8aa06cfadb0b6db1ed2cd06206befa6e
SHA512 f4c02612b6e46a308edfd498a2d37bd62f7958de07b60a1bbeca80b25d9de7034b27e7eb5d220d92a6819ff25c1f4b083a15c4bf56a59a98b07063587ee33c8d
SSDEEP 12288:biZwbVzzFEoS2cPvySBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:GZMRzFVSOSB33QTM2aIlGs219sdN
TLSH
T19B650195B36018F4ED77823ACC758916E6B2BC5A0760C61F03A136276F333A15D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f80ee4b6e74164c2d68bd649513242685cb388709a234b1c3d14d608ae59e3cc
MD5 0423f2f46eb1b6487bb7650b85b0fb94
SHA1 92a3737ecee6fb547d1a844a4bba6df2f98bf61f
SHA512 d3da080f2630d2277ff12f3f2ff25979959398abdb7c4891a49e641acb3029fb487ba8e5eab196f49aae189d285dc28b64417b93bbb9c47267da84de991e2e94
SSDEEP 12288:8tBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:8tB33QTM2aIlGs219sdN
TLSH
T1614523067C7A4A95EB3F527358BC52A6F97BBE4BB288257F071354113938A638F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f0a0678d3278be30f6331e73ecf539289c60ab618292a70d2d9f3f104cafb789
MD5 7056e78110b6327c115e07442b2e1a7f
SHA1 17ce62033041a11b18c9302338a3ab4ef08f96a7
SHA512 7838e2ddd3c44928f95e30d052509e78bed74c7688e35f3c2052b32b11b10fede53cf052fb3dd4d14f5549d91ad78f2de812a0edddb25d9b89376d7bb6ed1494
SSDEEP 12288:LJBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:LJB33QTM2aIlGs219sdN
TLSH
T1A64523067C7A4A95EB3F527358B851A6F97BBE4BB288257F071354113A38A738F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 bb123b43634aa1927fb563e1f355e07227b9d9ce643bd607e532a4ae85165fb9
MD5 2de840be797fa7f2bb4261df2dcfb3be
SHA1 1a9e4c6f742e04f710d03e2f8777aa0e4a4e2ba3
SHA512 6b4c337dbf40475903d99eaa5c5cf919e54cedb43bf0f5e3e801a56b560e613c68e709b3a3eea1f5412c5295b878145646782a443aa7671d8e88732e58212377
SSDEEP 12288:pyPz5L8OBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:IzyOB33QTM2aIlGs219sdN
TLSH
T15055120777A531F8D63B9235CCB51612F772B83653649AAF032006762F376E19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 edc21e9f13e81f7a9ed21fe0aa78899d1c61bd7708aefecd76e85deae5d48982
MD5 7f77e72545c8370bbeb49fa4827ddf67
SHA1 65a56206b7ecfb46217223dae8885efb50941c67
SHA512 387c7567aa41cd5650ab4edde29bf583a62222a022080b949d4fe469bf8469137babea05620b2bfffac2c058b3740fe9858df2e81639da95a7adfd02162879f4
SSDEEP 12288:ztBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:ztB33QTM2aIlGs219sdN
TLSH
T1C54523057C7A4A94FB3F527358B851A6F97BBE4BB288257F071354117A38A638F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 804cdec4842d5a1cf99c4bf900f6a0d922b6dc3e8e69562c402ae5ebafe6d2e2
MD5 a8566d9cb17197e2cbd0593ba3d2d8a9
SHA1 c5ce89a9cff96220f8c91b932692840535494ed4
SHA512 7038a858a33e9940ca7b13f98cf2f7b0c37d011182e093acfdcd082f89d089c9820be53d2b63bb48de87a3b385ccb6228cbcefc24b074f66c9afc1d464401612
SSDEEP 12288:jtBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:jtB33QTM2aIlGs219sdN
TLSH
T1714523057C7A4A95EB3F527358BC51A6F97BBE4BB288257F071354113A38A638F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6bfad6990cf70decf48e7935af4d0d816b9dfcccd0b808012f6586853563b50a
MD5 0dfee02368f046ded5d2fbe096087d21
SHA1 d92beaa90f31a8e4afc81f59bc92603ffad52444
SHA512 abd6f116f9ea344de8840ff1391a04376992dafb7cb48738d6a85fd72d57c2179cf677ccab2eddb134adbb17c9e1709e760447caf9843dea702f5b8a18d215d5
SSDEEP 12288:KyPz5L8OBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:XzyOB33QTM2aIlGs219sdN
TLSH
T14955120777A531F8D63B9235CCB51612F772B83653649AAF032006762F376E19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e589e86a8dff5d6206ebcb8c2ec38306599a653ac05551539cfcd8ba75188272
MD5 ec3115c2d0cdc73bf895651a15d876d1
SHA1 4e08385d188698fcab1cfa2495026e9eaa551856
SHA512 5498eaf159fe883ec1a4ac3c9c6d588820be0fc7ed226e7717d9a44aaffd28e1e4d37737495cda6e66ef9767e40970d821dd6276eb306823fa5d838dada9ad68
SSDEEP 12288:cCd9CWYoaLHF3z0z04PDvhEBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/P:FTDaLl3z0zDEB33QTM2aIlGs219sdN
TLSH
T10A650195B36018F8ED77823ACC758516E6B27C5A0760C62F03A136276F333A15D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3d8a727f65b0d87184b3f2835adcd1ebad6e64b7704c89601a9f3d2c1dddb99c
MD5 8308fd409a6257adf3508fa1c59c9d1b
SHA1 891a8afb0d911f565861a4f68168ac39c770c4f3
SHA512 6f09928d37a34f9f2dccbf05bcb5e6783f6d53c74244f4bddfe8d5986f25adea606ce2e1074e959b9a7998cde5f4f0d3d79c9f2fe82d73a8f13581ce03313dfe
SSDEEP 12288:Li4e7KRdTfgwCHKy7GLbbdIvHBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQsK:L3vd9CHKy7GZ4B33QTM2aIlGs219sdN
TLSH
T13775CF90F3E414E8F1B79A358C765512DAB67C5A1B60DE8F03A4251A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cf2df78dc24c0f146b746781a0ab28ef18e1ed6fc9e8e567f04192c398d7f504
MD5 7619b9b9eb0c1337da9248cbd46f9282
SHA1 7d4d14c07321eead84cdb4003da64e59762a0330
SHA512 b22616acc77329f9db77e2a123181ecface2036e4e1483b99a1bc9529ae719d2b4cb2c08b861c05b49b5d89d7d6f0c052cdc27476ea02d21b5f9367ce0a03450
SSDEEP 12288:l0Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:l0B33QTM2aIlGs219sdN
TLSH
T1604523056C7A4A95EB3F527358BC52A6F977BE4BB288257F071354113A38A738F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 cf4e639217617933838a469335961dfebea4bc5c738aeeffda0426f9193cc932
MD5 0c3f0d8028324982cf70825d73b47b62
SHA1 d1d0adab2e73e73770234043575b57074f7cfedf
SHA512 4f79ac88f6f83dfbcb725c39f2df45529da90185f77aa885b04bd33d2a0dec762bee40cd9743e267a2d633f7ed0cbbb3788a874f64dee2feba5df8fb4f14872d
SSDEEP 12288:RuBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:RuB33QTM2aIlGs219sdN
TLSH
T18B4523056C7A4AD5FB3F52B358BC52A2F977BE4AB298257F071354123A38A638F3504C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1945329d30bc5359a324fe5459694c6b4237acee04f3383a42fefc867ce98289
MD5 8832e7060ffbcc684686b7a52c5c22ad
SHA1 e5f72536e00598e9e8c5d00e253a85738dd39190
SHA512 7726fbd4275508f33d92341e8a424deacd979edef884632f8977f55e4ead8f72d6fd4f0ea4b373a350f4ed6d558c27e06215a870d721ea8be5dc86e8bbef8492
SSDEEP 12288:gHBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:gHB33QTM2aIlGs219sdN
TLSH
T1B64523057C7A4A94EB3F527358B852A6F97BBE4BB288257F071354113A38A678F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 68ff4ed7f5198c545f222a8c519b5d0a036b1c53569f1f717d2cf828202eef83
MD5 99d8ec2896f26f1984a1a6ebeed8035b
SHA1 47660c611a2adaf30b4477b4956c10aa07687cb0
SHA512 c4dda3130ae5404111b89b4c3133406655ba98478bd115827a908f953b81d8114e00ec9f205df7c1060ba916bee4e0f6f8b9e0db6572fdff01bcc5486e8d2537
SSDEEP 12288:etBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:etB33QTM2aIlGs219sdN
TLSH
T1664523057C7A4A94EB3F527358BC52A6F97BBE4BB288257F071354113938A678F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 51a60e44a82f6e7bc11f1de3d46248847977c2076c65426fa920fa378dc69fe6
MD5 de0928387211b1a0d1f3848e26f076f7
SHA1 93539a4e5f22ab5810a96b33419cad3c25586f02
SHA512 4a2491891ec05a52a343a64ff0059666196b096dda1b94d5129bd1d63dad73586615c459c5b15ec644f3a0c56694fa4ad6353ec80eb35ab53358f45122b30226
SSDEEP 12288:O0Bjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:O0B33QTM2aIlGs219sdN
TLSH
T13A4523056C7A4A95EB3F527358BC52A6F977BE4BB288257F071364113A38A738F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 45cdb3e3d7466c2fc210eb69968b77220ceb01181516b4fd0020c9b506c9d0ad
MD5 fd5c42f3878beefe7d89b0e36ac13bb4
SHA1 744f03f82d5cb669e723f6e0461fad0e7bd7c0f8
SHA512 27da2af7e2105464b7cdf57bba9eecb9ba75ab84451ab5fcb38bf69e10af8b23c1162a0786adca0c01d4e02b4753ca06858b08f226a5055b103b66b0a411a547
SSDEEP 12288:8VBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:8VB33QTM2aIlGs219sdN
TLSH
T1BE4523057C7A4A95EB3F52B358B851A2F97BBE4AB288257F071354123A38A738F3504C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 fb2e9a62516899cdbbda5d6089367f694ab0b7ab386343e90a1948fa4acf2806
MD5 17f2509318dffdd45b8a8302e9dd2941
SHA1 45f03989d64456d6921c960758a9458dc9417e7c
SHA512 7aea0bf8c129458056376da7bba91efdbee393909b68716fc94ff3e300bc3c48ff893ed1b61ad018a05a36417bd3142265f782c3508a757055524a73e8395f30
SSDEEP 12288:/TBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:/TB33QTM2aIlGs219sdN
TLSH
T1DD4523057C7A4A95EB3F527358B852A6F97BBE4BB288257F071354113938A738F3508C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 fb8aa969dd93d671dd4d12bde9a9da47dc50009caf966f483ed80c34ea02ccc7
MD5 d87bfae51b9df78b98c3f96d748d9cd9
SHA1 f959ddda632b77b8e7993c598ac45430fc12d252
SHA512 402104b422edb17dbec4b19eaf6d4d8d87d0e162670c2c08bbffd4f20417ee23c049cf894dc27734091e342359a264d44ed795d24d99faff5a00308cb9759071
SSDEEP 24576:3fwvUk9RX6wkyAIZB33QTM2aIlGs219sdN:lMnYI/Q4XIlGs2fk
TLSH
T15D85DF29EBDC44E5E1B7923C98B7460AF6B178591B31C2CF0256536E0E37EE49E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2a5bba507fb2ade969b564a791353f2472273067cb9628a9b0f87332526d901b
MD5 70d8d4f27c27d23e0aeca92375665aad
SHA1 be88c5de0ccd204e8bcae0059e1e42732ac4069d
SHA512 21d03c9ad9a9bdfb0c1e4e6b64e64c498f2261b55141dac90354da67714df4a10ca78bd8c076c9127fd28bfb295ccc8e7bcbfccf321b3d36c165904e4e33b9f8
SSDEEP 49152:IYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0AQ4XIlGs2fk:fySzP4RR
TLSH
T189066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cba824300a25bb4f6c4142b7cb65ce9a33d0a0ce1bcd1a7db38c0f8ee62a0307
MD5 6967dbc105fdfaa6a0c4e77bfad77e5f
SHA1 2b28cf30b7bc5be4f65eb1a65dcbd0f66cd53f7c
SHA512 b8026d179edfc3e870250497442ca2a9df0cd38e074a48d3d8da5c1eddbb990dde2d0fa21555986576d40b3b4953f2f32320a0eac664d9494ae3531359fd6861
SSDEEP 24576:s47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYiB33QTM2aIlGs219sdN:s47JUQjTirIhCnDHUPfF/QQ4XIlGs2fk
TLSH
T16A65AE1EA3EC01E5E1BAD27885154A5AEA71782E1B31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 acd3abeec98196cb15ce9a792abdb8c80f6cb41a42b2edacc44d7bdb2f562ac7
MD5 f3e2edb7c44966edc743f9f84d25d943
SHA1 1d334325d76cc1373f5df505e2b7c6027ab2ce88
SHA512 236fbb073e71f959df0144a5e6c1d95118b3d426e50ff43a6928667bd6e8cc28f349b6107954c89c08b6401b65edf25518c90bb3c7e7adfcebdcb3118f61051b
SSDEEP 12288:jbsfdBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:2dB33QTM2aIlGs219sdN
TLSH
T14155F10AD2A802E8D16E6272CB654641F7337C6593E093DF13D1F43E2F366919EEA607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 43c2db282b9e585938f042135321c785b34b36ae9f1b59115c4fc6c7c0956262
MD5 142428f6656ff3cd4374b3d8251c47e8
SHA1 44c4e9a7b3e27448f6e515a8c1b2a3cf7d25fcdc
SHA512 cf693037454568f925ee2c308afce20425b37b4bb51617d9cbae682bbf5d9ea0851e62c242f5518a398486bcd0d30eba00d100c5a150925f4cbb55cd2e4df0b3
SSDEEP 12288:w70zU3fPalPnmzj/s2lgXMn+lGJaRqSlU8:w7qUPypk/RlgXM+lGJ0qS9
TLSH
T11C2528017626C74FC6A940325E33C6CCA7B07D01EE456B1773C89B2FD576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 8e6115475df52ea8bc7c2011836456c6578aaad8bd8a32f30ececb67c098bf58
MD5 9993f7115b04849a7795bd1e118286a0
SHA1 c123631196915f720413af91a4e7c8d2e37b6c0f
SHA512 325c9039c9ee283dbc863ad5d535065d19187b8dc71ab2ff17ce42e942321457fba33ca7ff75f49c6cdd10a30bbaec795e977aaab2cc28787f05c5ed11edc3b9
SSDEEP 6144:BEklkpudTvirrB2Omt2WXvIStI8O7t9UuPAv90VZsmM+Ft/Q5oisbP+xuSIPB9iD:Ap12OUXtI7tuiAFsrFZYb+YhSfcmIIe
TLSH
T12D55C7409537A38FD1FB6032472A9B4C7B64EC07B6056F26B388453AD86AB15A0FD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c96a5d4823ea18f60657a90ac53c6080263a89afd1460ddf6978eaa1f5f40040
MD5 33bc6c7eae7b4019451c582cb1697361
SHA1 f230a6f92d242317cbbb290f95b4f1a8617ceee4
SHA512 107e4e428bcc99346a6a95f386c89f7f1d3c4dd8c59b680e86174a5183a271d90c606ed3379e10e5de54954f5c77c476a2fd16de28b1b1e3461010b022dece4f
SSDEEP 12288:G07FBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:/FB33QTM2aIlGs219sdN
TLSH
T1BD4523026A698E94FB7F527258BC9131B93BBE49A34864FF561324563938EE2CF3500C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 46e799f9c7dc862a7d04f6441b343b6a2e0c49deb04158d7451366cb56c1383f
MD5 134cb9b3ead52525f7e6b9534e6ac074
SHA1 99ba9724f942484adbaf4f7f2cb76cd710bb82d1
SHA512 1bd2513df39f759c2bde1dc86dacfc69b1112218711795fca5f16ca51b2e4a0d8f4545a62a189cb030208ce7aea60e7f7d3b74e2e54e321fd1f0e9126993a35e
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYfB33QTM2aIlGs219sdN:ugb4mBIBhGFyQ4XIlGs2fk
TLSH
T1EA65AE1E22EC02F5E1FAD2B89DAA4417D6B278161331D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e8bfcc6179f4e07985c37811d5591f999e103b5b3c7491d4c53ad2fa62578031
MD5 20063c3701ddde60b56a2dc8c29aa0d8
SHA1 dd144343fe8f403a90840d318f43ab16a4297aef
SHA512 42deffa7d85418e808d1033465ff0fdfa22ad49cbb024949fd22e498ca4ead613658456267f8e5b385462e5359dcf2223698b00a2a2e34f729cd09263b9c4467
SSDEEP 24576:0G88u8FpJqH1bzria7/mSB33QTM2aIlGs219sdN:H7ZFPqVea7/lQ4XIlGs2fk
TLSH
T1F485F16577E102F0D47BD13889964663F6B2B8251364EFEF07A88A511F23AE54F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4dea8582bbe5a49f14bd7536ad9301ea70536586276925eeb05d531fd2238d44
MD5 0b5e2db471fae85c95227b838248820f
SHA1 651fb38c0ac613d4346a47d5b84045d2294fa5fb
SHA512 8f98cb4a0b689e84558769ab6399926c5ad8d87690d4718bc27abce0d0253d76bdea7fc33494c449adb5a5e59977b093b26dbfbe3e815c1bb5d3230a42915c7f
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmQ4XIlGs2fk:fG05lO43bHRR
TLSH
T110D5CF6A62EC11F9D1BBD17CD9C6460BEBB23815033456CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b3e292cd8282c2ae48ac577074f94effb7c8d7e996b7a1dd43d04a74e6147f19
MD5 7bc6e0cb101c54e0291e68881e3c89d3
SHA1 e61b898f52d6c1e5c07f0788bd9adda3805481ed
SHA512 4a511b9fd49dab34908eeffb16a147a4c63ed06c12073f6481c193c52a36e82abee06dfb684fb1013ffaec28b7dc286532537e08fefd742727a4f368e2608fd8
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidngB33QTM2aIlGs219sdN:aa5POZ3BJt2pasx2+meQ4XIlGs2fk
TLSH
T17D65AF5EA6FC01D5E579D17DC583461AF5B2342253319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2c046e60328e6ef33351da7e484b864e37472577f0ce36c1e166b1682441bcb9
MD5 8499608902c865e3be9fa06d720fc348
SHA1 280f6d43057933ee471e33164aacc6d0efc1482a
SHA512 e23a25145963f6ebe98650e8a18e66d537a3f61752665974d342f5d41293573b06e18b97e59f8185393a0f27944cfeae0d869e25c89a5193816da65dede3bb04
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkqB33QTM2aIlGs219sdN:UNc/zEOVHFFQ4XIlGs2fk
TLSH
T1DE858B1623E901E4F5BBE1BE897B9546FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6c804abfded4c8c19c7e63a8a85ea268604ecac0e5681d722275e7fa84af910d
MD5 fbf8a47d54d82c4fc3c409373b71bd09
SHA1 801da8e9d07950a4419ba688528f6db7c6fa0673
SHA512 9ae3cdaeb54c51334cb1687b60fcbf8247b15cea395d21fedbaa3350ce072fc6e25c1c8753799cf1b9dfcafa67612cba855ab357e8abb6cdb71c031ede7e9db8
SSDEEP 24576:LTkNvNnaFeYhJNtmZBmsB33QTM2aIlGs219sdN:LTMwBtOm8Q4XIlGs2fk
TLSH
T12D55AF6EBAB846E4D1FEC6B58D238512FA727461133252CF5390C13E1E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9f637862c40228c84604b5f4f951c0e9230dd0e7e364ed5bb14d9ace4031c68d
MD5 cf4bc08913468156eaa4e100deff8b05
SHA1 3d4bedc4fb8edef16dfbdff6126f35a121bd26d3
SHA512 67f2b1109106acf6a736ed2c98348d344bf95e869b13849d40b399c7488e3e44c72f36a27ff192cb2f996e65c2c8c8385d7066dc2b0845f6e503b4f00fe37d8c
SSDEEP 12288:qHvUrBFrEjwaQGBjxngm3jML6br4sXoFvCy9M2u4hmIlGs21+XQs4/UH3Na:qPUr+NQGB33QTM2aIlGs219sdN
TLSH
T18265F11F22AD1CE4E67AE17D89964319F772B852131192DF02A1813E1F27EE8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9d70059a1e9666f34f824e281a504162118736e30640bdcb92b87e07fce72730
MD5 6c5892f54e9db7808d95d6a29378d69b
SHA1 25f3e44eeaad4922722172418e4b12142e710bcc
SHA512 b1b34ed99cb0638c12540af4ece545f6293a0e754b30c3629e8ddf6cd7da82815516b3c60430a604cc5473d701e0c229bb62a5010d209854e7a861a937c0ac28
SSDEEP 24576:YD3FHshBIYQgARB33QTM2aIlGs219sdN:YDVHeBIAAXQ4XIlGs2fk
TLSH
T1EB75E13EEA6D04E4E57BD1BCD9638606F77238A9032165DF029181B61F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/836-302-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/836-94-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/836-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/836-287-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/836-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1816-40-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1816-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1816-45-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1816-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1816-49-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2468-300-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2468-113-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/2468-107-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/2468-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3148-386-0x00000259404F0000-0x000002594077B000-memory.dmp

Download

memory/3148-317-0x00000259404F0000-0x000002594077B000-memory.dmp

Download

memory/3364-219-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3364-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3364-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3364-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3568-125-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3568-119-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3568-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3568-130-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3568-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3676-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3676-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3676-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3676-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4568-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4568-253-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4648-64-0x0000000000400000-0x00000000008E1000-memory.dmp

Download

memory/4648-6-0x0000000002780000-0x00000000027E7000-memory.dmp

Download

memory/4648-0-0x0000000002780000-0x00000000027E7000-memory.dmp

Download

memory/4648-8-0x0000000002780000-0x00000000027E7000-memory.dmp

Download

memory/4648-5-0x0000000000400000-0x00000000008E1000-memory.dmp

Download

memory/4680-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4680-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4780-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4780-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4780-13-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4780-22-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4784-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4784-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4784-183-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4784-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5944-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5944-82-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5944-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5944-318-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5944-88-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5944-272-0x0000000140000000-0x00000001402C9000-memory.dmp

Download