4ea5666447f453177bb6369f55a62bf0339807851d29b73d4298fd6a9e0e8a7e

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
Size 1.5MB
Sample260810-xgdbvaaa67
SHA256 4ea5666447f453177bb6369f55a62bf0339807851d29b73d4298fd6a9e0e8a7e
MD5 42e692e5c5a9b5cc437e044c5526f390
SHA1 fb816a43d4841154539461909bce2b560bf58927
SHA512 97c0e7d9e1b16ab3fce7a91b64735e74da733792462beab2b885948838cfa8edd5a614442d08dccc495bb596dcd7a391d7052774b4442c8c2c3c9b04523df4f2
SSDEEP 24576:02Uqb4KErZAce/STOxy9Bk82HteuH+mWj/NyBo4kx929bL3Hnx:02H4KMOqTOxyPvuH+mWjQB+kn3Hnx
TLSH
T18465BE503283A833E4715FB14CBAAB91DA3C7D72DFB0A8CB17D449AA49B82D15570F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4388	elevation_service.exe
2304	elevation_service.exe
5104	maintenanceservice.exe
360	OSE.EXE
3536	PerceptionSimulationService.exe
5692	perfhost.exe
1628	ReFsDedupSvc.exe
900	SensorDataService.exe
3644	ssh-agent.exe
5404	AgentService.exe
1152	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\525d00478f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004de865fbf828dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034a5acfdf828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047c9113bf928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1628	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5404	AgentService.exe
Token: 33	1152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1152	SearchIndexer.exe
Token: SeDebugPrivilege	3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4388	elevation_service.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3516	2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2008	1152	SearchIndexer.exe	100
PID 1152 wrote to memory of 752	1152	SearchIndexer.exe	101
PID 1152 wrote to memory of 2536	1152	SearchIndexer.exe	103
PID 1152 wrote to memory of 4968	1152	SearchIndexer.exe	104
PID 1152 wrote to memory of 2168	1152	SearchIndexer.exe	108
PID 1152 wrote to memory of 1432	1152	SearchIndexer.exe	109
PID 1152 wrote to memory of 5588	1152	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_42e692e5c5a9b5cc437e044c5526f390_amadey_elex_glassworm_luca-stealer_metamorfo_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5104

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:360

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:900

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3644

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5404

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004E4
1⤵
PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 650f0dc9223eb7ace3bce9826e5fa8b3728fd0a1e960696782e39a78ac5e6e07
MD5 64a1516c1025860172d878fab83a7b95
SHA1 62a567e1e012c1597b857e33283ed37962e7d044
SHA512 e4c266d59443d3a0ab3a57db4263a8adfed1cdaa4940e3ca40741e0bc1412952c7a2d7a41fc7ceda4902db47b52ebb8d0a1dbb64a950215df4c52aade0ebe66b
SSDEEP 49152:Pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnXB+kn3Hnx:N3q6sjBe+k
TLSH
T146D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b8942e90fcb73ce11db9f2c763bc56b7726c34a49bd2ac9e781b082a49f6d599
MD5 76f50b2684694c15db542fb2282b6714
SHA1 759937b9d493f619322d6796def3e10b170cb99e
SHA512 174276bda0e32ed6f0122c26c6ae528692029e8cd879138e4a762d6636dc84c8c3fa4960562c1d819c5853826a93cd06f6a9809bfdae5c4733efc5eb6f66fc09
SSDEEP 12288:31XLsswWkxy2lRq2czA2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:lXYfDtczAVNyBo4kx929bL3Hnx
TLSH
T12E65012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7ce0aa40dc6f114fede777541a1bfb3628129ca9017584c34af4944ac800e3b5
MD5 74ffc834006740777e513ef960ee1795
SHA1 70f882da3280153371e2138d5e34699cf948a4f7
SHA512 1b13216f015876caf364005ae8fc7017962f01a43304724057ba3f5668db0cc75f6a2492614be539842a6ac25a94230a2df92cb1b93006f965406e7d388015a4
SSDEEP 12288:XXZNYVLeyUji0h90ZD0wxpGZIVuArHsfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:50Le5ji0hmxfrMkNyBo4kx929bL3Hnx
TLSH
T109859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ea91c8c35ef24a71c7dfab99301d973ef5451223a41278dfaeafa40f65044fae
MD5 1c63ba18f048bea8f05e8c1ebbbad0a4
SHA1 2d5cf6bbbce4592ccb315be8fc539f16da06fd19
SHA512 288b56122477079a7c4981c5e4d3a52566f79d029b1630ee4d54e1006da1cb462632962c2717a7bb310dba31552cd2bbe1c36b19d0e9cd44128ca9223834b0a6
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWn6q8wyuWNyBo4kx929bL3Hnx:n/ezSC6vUzPveHjyIB+kn3Hnx
TLSH
T1A4755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 95591ced3170aa6dcc739c91df98714121b96fb28566dce8cb6768457ce5cddc
MD5 432f5bc7a6a28c0c8efbc825f2887d7c
SHA1 a49f7e124fbdab15e0663c599aa76f4584745913
SHA512 02c5601dec01aeefee9d3447f48c3761cca3adc8d7534cb01cb64b5a9037b6ee818dabefed6c0bdf6001c0ba547cf6170ee67252c1b4da874068e787ed34fdb9
SSDEEP 12288:+VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98iLDAptNyvUgXZ32dT4ePc7N29CD:+VbqPb88hv/l+YpNyBo4kx929bL3Hnx
TLSH
T172559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3033eb6daf9bdc50b807d320f273f179d5168149a1ebb4405049cf499c207629
MD5 ad3c1d3e29710e07e9b63ae3d37f27ad
SHA1 1591f7cb1b2ae7de1571e25890c1fd1643953422
SHA512 2d3288cdbacdf44e99ca52138110241b0ba67b23fcb25dd2625c53c2d2f5b82f1ff103b4c6b71cc5c94b5c66bf021450934b8bafa9bff979492d802d7a3a78f3
SSDEEP 12288:gmLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gmINyBo4kx929bL3Hnx
TLSH
T1ED4523124B0C627AFBBD3E70755E8454CC35BC8D0D95DB98DE62ACBB58BCDA2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d40c511a40220557a9001122de2edced3f4e1d321739cdb932d842cf0b8b2808
MD5 d9bbc6a246b51838bb7b0ac5e1d04be0
SHA1 b2654dfba657509021e22383fe848410056f1ff0
SHA512 9241de3c6e20ad4cc13f71c83400ecf9e3e5509ac2501a599b3ee9a8d487bc7fb2fe0bc5e84cc9886413feb9f355573e50b932224ad9244cd08e521524225394
SSDEEP 12288:ZeBNUbTVO86UKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZJIUBNyBo4kx929bL3Hnx
TLSH
T19D65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 edcf7214bd05c706f4c1678ddbf7ac1aa32dda808250fb5bf7a44aaa062bccef
MD5 5d74366774eb1e533bc85db9e55303c1
SHA1 89ed1c8dc5ad95af46e1ca4021e8c89be7c34d86
SHA512 c1933796a3e99d6afed842f423bf26364310f3393292f45040f5dd9c047de15c5b71c643b66084ae870e82748523e3670990a6392827a6fff6c5e4c0b63ce0ca
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THw:lQvGAdlCEL8c/DRNw5CL+k
TLSH
T157266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 46441b452c20d3427d7430ca93b8dd07ae5176b329dc0030d1ec8b6fad29ace5
MD5 07bb6e9ec567c6efa8ab7aeee6da73e6
SHA1 608b6822817835ff232cf7f0cb227dc75d2a109a
SHA512 bbb1e839473e92b25c9f2547967912c2eb1411918bf272e8c7816c4a1785fdeac7397da3d27183c817e51de7f7226486f10748828c59f023457ce1f42b65b3c9
SSDEEP 12288:RAwSfxL/2Dc3XDLLmt0LDQewsAj0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:yOewsAjrNyBo4kx929bL3Hnx
TLSH
T15175E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 18042dcd3d9a67de8704040fee8dd514469068ce8b03d825da8c3c2068e3c824
MD5 aa11072347fc58a00a5320d97f1ea06d
SHA1 ed3c6fd6277f891b9c03bd9a04a4a3be4a081fc3
SHA512 2abf939c1287fa94beb76212148dfefae7f863c724befef89e3911221c3289249d3648937fbbd3f3a30de3ae6c353fd892a8bf1c133dbaa4f6842420efb6048e
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHA+k:2UEtQevvqc2W1cpV2tI32A
TLSH
T1C7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 69b0bb34683b6e366a283a7f6644b5d8f921066874fb8aa9cddf170a93146c7e
MD5 f3ae0338538da97fc82d0d6e5aafa665
SHA1 d2302d70fa523dad41dde0279481385a77569d7a
SHA512 69ab54244c08db09ea6c64b88ad35954498e00a710ad63e1ab54724ee5d330ee916e0258a0bc9720ecc8043201093dedbb5c3803dd2fe121872153fb08f0ff40
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/zEB+kn3Hnx:foquVjnmH+k
TLSH
T127D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9989adba05dc3f06c698e08d6b481eefe43f626960a71f4fade9da82404d7189
MD5 52523e9a6a1a6a7de291ae9ab5d2678d
SHA1 818d1ee68892adfb064216045283caa24465007a
SHA512 91cb398c7d89d4b3d0554caaad37fba5066266b3bcca4ed33b020e84ba98d20e1cf28b623d9265a1626562f7bc905b10daf06505e047d6e45b39fb9f64e52bca
SSDEEP 24576:XAhGL3IFoiwtA5l7S53CNyBo4kx929bL3Hnx:XAMUFoiq5xB+kn3Hnx
TLSH
T15B359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dcd4df27f2dd310761181793f2edaacb6dcc26ba6f987e4a4e65323485d7219d
MD5 08f6011be16be8081aed372257840614
SHA1 2ec6bc1d96880d845b4d6937418a5eafef3fe4a5
SHA512 294c4c38bc8a1c6dcc7f2dd36c6055848bf601748401aabffe0bbdb62e0f58b2daedebae68e0d6e189be1c1a63d3645fabd6e5a5fe9eb4f8b71b3b0d87d916d5
SSDEEP 12288:0mw5HEjsChNzBFgl0WDm+CpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:xwu6OWHNyBo4kx929bL3Hnx
TLSH
T1D265010677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9f9d10dce7eb1e2103f6f1eaa6bc15b359b22d8b2fba2350123964512a74d125
MD5 02135cdfcd32e08775259eb82e18f9a5
SHA1 4a13a860b5fdb5c8f724f3a1be775c5624701af6
SHA512 c84277e469ad2f632784d182ad018f7d43ebd1d25fdaa4750098ca3544fce38f9b78e2582be921baf89252336ba0f071890fbed96244053d7df9682f92a87507
SSDEEP 12288:2gZ1IyELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tZu8NyBo4kx929bL3Hnx
TLSH
T1FB551216239831FAF2AB2678D8E58644CB32BC461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ad75207c2b6cfe395ef4e6dea678cbd32224ea0a366a9e186aada52d60216179
MD5 5538f3496f465271da60dd4e1e8d8563
SHA1 79b23125ad0a4884d8dd281e887596e483bcc14a
SHA512 165d5de837c3be1b44e65971028f3beea85182de2037a1476ccbe4a2cd9f14c3f48fdc3f6426c54e1709f3f70128748a1481384301956f74b0cc18093cf4b6b0
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:zQRQyi36YOcPbLvw2gAf+PN3C+k
TLSH
T1AB666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1120ebd1cac011a74c1b1cabc68fcb2b9c65ab19e522b551b3f904d902b8978b
MD5 294ce6497ef9d39bfdff846ea7215b76
SHA1 7f931a0e5d7c40d67ba17b298c82f676fca69c71
SHA512 cf6e4ba38f143fe154fd203f8ea46f2e3ae40a940f8db4edf0e23f488979c4b4fd1621fe26caef7bac627e3c8438b7fc14dd2d31ce50a9cff0fa2cc743733d3a
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:wQRQyi36YOcPbLvw2gAf+PN3C+k
TLSH
T127666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 25946fa0a51108edbdac23945edd5871d5e29fe888cdf9c1d4ce0da270f7dba5
MD5 cfd14b0ffe26e86fe7eac0605cdda55c
SHA1 fc53c000c4a308513a7195df880c66961bc1c03e
SHA512 19fadfa59085c7196b3bb1ae4c5e6adc879f4a94f4ee3756e9e153f497f300da19c5289b924a24e93519ea793b296ba5fd0ff277d40885a01308d2429d2a6e73
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0MNyBo4kx929bL3R:068Qg55nhceWu7PNU3/UB+kn3Hnx
TLSH
T188B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c06d69a9397dc5ca9fbb973ac887083f7bdbaabf6edc3dc30dd29529f4baf4ab
MD5 5e256ac7a4e26df5dbf5f877747243ac
SHA1 476e86dd27d8a9856cfc26540fe196a31e0cb411
SHA512 44778a3a51f47009c69d91f7de7f7dacfbc59f38c69c103055240c02db8a4efeb03280396eae7cb0cfe48299e2e4cbb9677fc2a5b0437a65e7d197de8913fd5d
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99O:Hy5112gYy5azzVvt69nLKnhZd+k
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8a7cd4fae3d582d869c0be0a9aefe0dd5718d815a41188cc286e5ec78b5ecdb1
MD5 ae9a3c6284fe37abab2941b9bce2e8cd
SHA1 ae90491fb29f8162f5aa46a1c37dca89b7a7a920
SHA512 41d2df15fb45a314b8c2f96f2ff48fcf858023d8488f5dd90cea70efb533ad1b7bf7e9cccd9e8f0f2a0c75d189aa9ceae22cbed6a8f8275b39d8820433a0bbd2
SSDEEP 49152:HB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glyB+kn3Hnx:Ju6Jmdxd2da+k
TLSH
T10DD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f236d1f97ef69c9931f85f658da9e67379735fc7862ebc3593927bded1268862
MD5 a8569b3b201bddfb3d0be3baf75cfcbb
SHA1 c54dc21b6dfc4b7534542c923720209394110795
SHA512 36a21f55b5ff59d2485869644c17bd8b5fc9dbfca84448aa138f09403f45c8e2e10ee246b37b95477538c5a9a2e9416f9f6787d2cbd919901d201c93b8982da8
SSDEEP 49152:M1hpsNoJpF1A63U44CwH7R4x2B+kn3Hnx:MmifPWRH+k
TLSH
T1E1B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 872aabdb76326a4a9f5b222907690a2c2608167280a74e081896d607921ea1a6
MD5 62bac19b46b12e7cabe54c4a10f8f69d
SHA1 e9807b0ef0b5fef532ff8bc11f2cc753dba25f63
SHA512 c5e9f0e626ccaf0720aeebdb48ce4e64a785bddb7cdf496377a7e45c11890efa722c10ba5b0116f7fc5dfff16ca4ea7f8927b99dd3dea344287d086dd4a9b024
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqnB+kn3Hnx:B5dKii61B+k
TLSH
T193C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 90d76150f2b7a8745dd8a8ac462bdfc815620aa49868f81456b41e990f3648af
MD5 d3a04e68eaaa5439888992bc9ef3eae5
SHA1 a6211b39e8a9ff6493c28b1b2a5e4e71e052a77e
SHA512 5c5ddc86b6449c2e03df9d5cd2c8ab32add1bc8623ee638eaf4003d6906299310dc7ebe70ff903b782429191c93ef65e9fc73688c9959b76d29b687a40b70b6c
SSDEEP 49152:jhtSn8EApI0fig3giDn0AP5wCB+kn3Hnx:CX2imphz+k
TLSH
T1F295BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1d83086f7826afcfbc09c1229169a748bc833d45f32b17339cb56921c0282111
MD5 698744868cadcc3fad0ee0bd4deef8eb
SHA1 4799841610973cc349367d685b05906f0fe3a26f
SHA512 3ac534a5344efb91a52014f8a414b68915fc63fd37ca9493c7c766a2ebcc9b2af300d44403c7f98c5069f3c830a6ef0b2605a91d633cb16ee6a0b8fea94f17e2
SSDEEP 12288:zzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zgNyBo4kx929bL3Hnx
TLSH
T1634523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c38d72253db43d828196baa4514e96f5cabe47d2abb9df6146412ba9ad93dc99
MD5 a101851ad2364ade87ee50ce9498722f
SHA1 9048e213ca063801eb22e86f7d68826f18036f0c
SHA512 1be19aa1950a380ab1f17de0c313c3898b744c2b8301b25c5c7d02eb00a7fdee1f53500799eee2fa61a896c76010a98535d097e70279d356f01bd7cef5509411
SSDEEP 12288:IQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IvNyBo4kx929bL3Hnx
TLSH
T1944523125A0C227AF76D3FB0644A8098CC34BC8F1E9593D8EF67987759FCEA25B21147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cb4a68146b091c02a949af14dccb4b2285ad42c104e8c8ac75634f027e60a1e0
MD5 334b1fadf88854eb231341fd95fce2b2
SHA1 c6a906c43ecb6892c23d9949e95acdcf34996bc2
SHA512 a0ea413e56dfe12370767fe64d1cee63149118ff1a3e68eea2c940d8822f0d944890e712c8f0e84119a8851c63e1213ac298bff9eb2b4312c9fab4122bc7003a
SSDEEP 12288:qSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyExX:q5NyBo4kx929bL3HnxJ
TLSH
T1084523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2a7def59218115ea9c560e143b139646c78b4c9cf8e65afbddb7f8076d14e7ac
MD5 72c0af4c97a752326606084d090fa1d5
SHA1 95e9dd78dcd3ee75c9be31e248ad0a12b2953964
SHA512 fd73ed09d24ca36edf4f060c685ac7ac399dd490c6f33e33a9fd520ffc7a923ce20758728195cfd5c7b5a35ff227f0acece19799c8fb4cc55c7e818dcaebc98f
SSDEEP 12288:XV9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ANyBo4kx929bL3Hnx
TLSH
T1394523121B5C12FAF97A7BB0D85A8054C835BC8A5B7197DFDF1248BB0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 799f86320a0b23528f37f79f2b22b9c47553d6a7a0266204ea67413e92aa23a8
MD5 63163c4f897152b09d62842a2ae31d70
SHA1 0d13fb05de8bfc373c0d2f73ed94eb077490c651
SHA512 cd53c4fcca4123139c0d283d2bf452bd30d77332fbc2cc8f960321f3c047905dce34c3c66309b4c9ec1735f9b0d0e312a57af0090eca46a22b6c6fb93568b8de
SSDEEP 12288:eVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:eKNyBo4kx929bL3Hnx
TLSH
T18E4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 22ee3e22b2219491917e28c0435601220d364c0fb3f4f561a0d911d2787fb613
MD5 781dd2e35a775e112d9dab7cbe7690a3
SHA1 3038544a8946b46a5dfe094381293bd51a28b005
SHA512 62901a046b470d43d5ce35a1cd4f39c7f5d18eca9cc4e955d0c921e06e3c019aa4eed34c2f0161d953afabdf2db540160bcc40245b67348d6ea1e81e15fef79c
SSDEEP 12288:d8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:djNyBo4kx929bL3Hnx
TLSH
T10B4523125A0C627AF76D3FB0644A8098CC34BC8F1E9593D8EF67987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 06b4b6d0cb64538a358c880ff7bddb2362d05804174f703830eb276aa51d7f38
MD5 29c73f4a9be2bc3d0377e939f44ff126
SHA1 e56975357eda8258fb1a860418bef4ce5576726d
SHA512 b14f1a9d3f6dab4a2230b7953b4037eda1d73707bbc4836351cc4026b7c4e99ba8279341f653a1077084e2aeeea789fbcec13ccea67fe34a248ab07ece3c1741
SSDEEP 12288:BILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BXNyBo4kx929bL3Hnx
TLSH
T1A54523129A0C623AF76D3FB065498498CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ac0bd755dd6d4530d494ec27225fc3648f1c969c70e1712709232752ebe5a92d
MD5 d7091e9cdec4a556e533c7b53e84002b
SHA1 acb7dbad6a86e0071b850eac20ec2e9926607592
SHA512 8801e1752585cf4501570c4154aeb6f57b0b7acb6b04f1a2d2a641863e4ff497dfe0bfdb164906a2c7acefa707b04ca0a9aacf447b2ff0d61d2b281060d2b661
SSDEEP 12288:QiZwbjzzFEoS2cPvywLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:TZMXzFVSOPNyBo4kx929bL3Hnx
TLSH
T1CE650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0ce4551e1ad8db208174ac009473e7a0b2d36e77e270249bb693d99c6915a684
MD5 3f65eb70a218dd2d78aa4b12b6586593
SHA1 7560b2acb8da939cec80a645544b70d3976eecf2
SHA512 39cd872269a89cd7fb8caaf9e47186b4056b38e31d2f5c339b4b53f0b343aee63a99b1294252e3d154e2e0ae4ff6990ef6434a8517741f7ec2136412b105b532
SSDEEP 12288:KXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KsNyBo4kx929bL3Hnx
TLSH
T1464523125A0C227AF76D3FB0654A8198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7ee68e053e9c52a7598e85bc6ff0ac5fa5a91bdb50d29355d7804751fc37e3a0
MD5 f91b8445f1d1951d0466aca49407e725
SHA1 756238dba6e529b7dd6ecd6b0f75dcbdcfb1bf50
SHA512 24f1d11b05e4c91773707fcb58f2f5b4c030dcc18c8546a936b1cb477938f83e7d968bf209c1eb2bfb7f6cf4ef7e17ad6458764d18087d3312021f5c3d255a58
SSDEEP 12288:UbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:U4NyBo4kx929bL3Hnx
TLSH
T1824523125A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c195cbd1ef84c862417f0044b9871f57b2e93710c7c33d1cbfdbb6678dc26a6b
MD5 c437164fa0a22d4984adeaf419366fe9
SHA1 01cb64f83f4664f92901b7d960b49835dfc56d1a
SHA512 d79fb26ca536125a67ca506868f79d707bada3778360ccb22cc52a54fba8b4e03b92d7f594b6b70cd41a3e22356858c26567a11388f93ba3d63060582ae9f4e2
SSDEEP 12288:2yPz5L8ELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LzybNyBo4kx929bL3Hnx
TLSH
T11555120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0eda3869d7cd54252af44b7cf2266e24291de234ab70419a03ee55964cc4b850
MD5 e3f33eb96cdbe0947d2bdaed8ea20dac
SHA1 4926ea5b1b002efc59194578d8883b8579e9c759
SHA512 2c444dbd04f4ed798c0f34f5451f210cf96d6399e4bdc22e8c286406b7b1beea635b64776212a165ef9edcab32abd0a0b0aeac3d050c56a34cc1ed6aaeb6fdd8
SSDEEP 12288:0XLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0sNyBo4kx929bL3Hnx
TLSH
T1F14523125A0C227AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B21147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 410ed7887175006855341ce83f5cc1215488c034eee3fbc6af8369d16153c733
MD5 4b0eaaed9bd716a539d59742b17b44b0
SHA1 563870b84a5f10ad7a7a50dc14ce4dd93c9a839b
SHA512 a575ab1a37cfb00ed3f0dd1a364b33f1642c29ba107e44b44c212f964ed7eedf5c2ec94bef22b9b404bf2b0c94bb898295fee9d743987c9b051b85939693cc08
SSDEEP 12288:jXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jsNyBo4kx929bL3Hnx
TLSH
T1164523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 110ae6ca50acb5d42389416ad0b20029a113de0ef6e66568bb9822e1c8b11c70
MD5 ccefef791766c514db18f87eae949cb7
SHA1 a36e71d38e6efc825330f53b75aad03203922d50
SHA512 d7c9de0a8f5c535389375f7d4732fe04353eab0e601a71feb8110e0a844b0688b59648de2ff14340014b5efd2f0f37497f5233d5bb256f9279693d3d12fb9a82
SSDEEP 12288:8yPz5L8ELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lzybNyBo4kx929bL3Hnx
TLSH
T1E155120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b4984b518a713f129fdb011d96dfed73789e460c7bee170d3f234347c54143c5
MD5 3a9355d8adf9798a81bf3b8441f455b4
SHA1 20b05bb16d013af7567b32e74f6665f6ee001a34
SHA512 7ced9407233e5e0a816405414d9570736bbf43246f079773074f7a0fa063fa4fbca9ac52ea06b3aa19d12cbf4c8d2dbf96a529cc315b8bb19c88e8021ed9b677
SSDEEP 12288:JCd98WYoaLHF3z0z04PDvhCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:UTtaLl3z0zDJNyBo4kx929bL3Hnx
TLSH
T1416501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 09b99ef3975391244de88b19e18be852558c35b35f249eff5b8dfd96958121db
MD5 24131580bf8fe79b774caade38b4f767
SHA1 fafc5ffa32f30ce8ea1cdc5bbe22d28e99211265
SHA512 d5f5082a44f0c21857614d9a86444b891346d23ab5c6cb4e32d7d116ecf20f38020be74fc5ed382b947a94e78ce2b742b57cba6f46754542009a2946deb77ba0
SSDEEP 12288:Fi4e7ARdTfgwCHKy7GLbbdIvBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:F3ld9CHKy7GZNNyBo4kx929bL3Hnx
TLSH
T18A75CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6c1e8e8a2fef05d896273f04b8b3ac0cc924f68d75bfa0848615242363e53470
MD5 7542f2137b269fc8f6e0a2e8e46d0a99
SHA1 61d761daf309488cc77a15efd6da89be4ffa1f10
SHA512 ec72ccda133cc5e4dc6daa3cd22117893f7bc14a8d350573ca4d06748b0f2fde02754ae83dcad3b679ca4a24e2bcfb6ddc28bbd3b4b6eeff55c1aa0a67a19813
SSDEEP 12288:6yLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6ZNyBo4kx929bL3Hnx
TLSH
T13F4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 eedf63cefc103a8def4a4b9583ef8ae163779d293f2fe9ff0c899cd1fad55419
MD5 20577707508debdbfdb8db9e50f252ad
SHA1 f2eaab0a769442b9a8491a250f9d448a1ec5c38f
SHA512 ebc81aab0ba0a2ecf16b2c216526a81e7706b2d9c454441a3d4a9cfc020dbe31fbc28248d23b6d5429e160fcd99afe389167e38a099689feb6b9011b4963fc09
SSDEEP 12288:4kLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:47NyBo4kx929bL3Hnx
TLSH
T1624523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 369cc1785013402c7c2a56d5f8389a7ec644f2d505fb8f5630a05d2599b927cc
MD5 c31e028e1febdc5ce5757dfe40917558
SHA1 6d5bdaa93c49fd4c56cb1efd4640d4551ccfbc97
SHA512 e0386e10e6a5a05a0d00f21f051599b77dcd61964e81282920d34165197bb50e682ae5288b9e314c776ad500cbf58cc933c190cc3775443dc45a7b33e0be9292
SSDEEP 12288:/BLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/+NyBo4kx929bL3Hnx
TLSH
T1284523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3af98329dad2d7f4fa5dd9a282b1a24e637130106e1af7d1f2818dbeb2bdbdb8
MD5 201916ffb475123372ebb664d34a363d
SHA1 7f88c09462030a578ec211152289316125e9abde
SHA512 ae487c57995e57a9eba27ebb9bc8462371be26dc86a379548af343687e8a889ac105d97f29fd6eb45a35711eb8b83d3303b1019e9d35de8c7018c3c024689dd5
SSDEEP 12288:eXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:esNyBo4kx929bL3Hnx
TLSH
T1654523125A0C227AF76D3FB0644A8598CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8591dc7111c5832d01948d513a9cced8bc909b0da21281452419a4500c0c02c6
MD5 c8111d3187ac694648ebec701d248287
SHA1 422b08d8edb0b04959cc9f3f976e5e094306a293
SHA512 472fb7f7eae535d140c38bb76d7c442658017648abb50d5996f140f23f252a068ccefeed6beac36048d317e9027c2751eed5c0736651eec625d99c331ad5fd52
SSDEEP 12288:HyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HZNyBo4kx929bL3Hnx
TLSH
T1FC4523125A0C227AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ff2c4223537ad818bbcec4e9e5a983d4a8c3dc9a5b8b82f3664eef59cb999457
MD5 1c58b8dc13a902d3e06e3f45d0f17c11
SHA1 d99cf9b9f4d18ff76d4bc42e7bfdca8c8d391927
SHA512 210b637f729e620de0fa5c36bd5cff8714544311772fd68b5b74417eac7c4997d7e4717644f0918c7f7352917dcedfe44939eddfa35261c197a3561d4b533a1a
SSDEEP 12288:kPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:k0NyBo4kx929bL3Hnx
TLSH
T1934523125A0C227AF76D3FB0654A8554CC38BC8F1E9693D8EF27987B59BCEA34B11107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 27b8838c82c5768f74addfd83d8883973100fafc5165793973dc31dbd10c2c11
MD5 560969382bdd1091aea8da47cfa37960
SHA1 0cec25f3fdb28552270770ceab5863f1aab9d45a
SHA512 eb701e39b3effca6937e49147962a27feed8a44aa0c168589dab4471facc60f68316667bc17416207d5a80c3608b566c5ad01c0989c9adda67fba879c0e16352
SSDEEP 24576:Hfwvqk9RX6wkyAIoNyBo4kx929bL3Hnx:LMnYILB+kn3Hnx
TLSH
T14A85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e0527d2b6ad95d80383fd035200785c6095e9901308ad557103468dfbfa4a976
MD5 261313cbc8ee7d50ca21633df8b39ca3
SHA1 658e145b10a31e47050511b585e4d3139b07f783
SHA512 ee7019064d2f2ac9b168ee3f53bb2c1ce41489f425e18642cdc3b21fcf4e71d1c655b5f5cfb9c0a23f33011a7f4623bcaf6f30ec2c613cc43e2ceb17af2df506
SSDEEP 49152:uYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iB+kn3Hnx:dySzPi+k
TLSH
T1AA066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e64ca6eaecd91743672d37cb268a608dbcaa26b7db23ce1007fa317c45318725
MD5 d80a641774b987e5caaaa18d6431b0b3
SHA1 b4821a61e833e008df808bff72a98bb81389f20f
SHA512 867f48285185bceac69c2b301b04df9b50e4cc4e564de3f85b3d22a4c921381c40599f049e091de75d7557eb6d3d48f773cc4330459a0669048dbb1b4eb7f81a
SSDEEP 24576:547Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY/NyBo4kx929bL3Hnx:547JUQjTirIhCnDHUPfF/yB+kn3Hnx
TLSH
T1F765BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ccb00f3e5e4f2de82bc5a8151eb001cd4a29cb21c69424d777782f2a0137853a
MD5 ae40e899934ef91a32fad4ef1251b183
SHA1 651a376e13da74b75a43681e2450ef2e04aa5c30
SHA512 f6e69d9248931f9b66d75a050ab332c6890ac06b335a2c53dbf0341ff42490288210c115722f321cc1dd186cdc3a5358a50d096fc7a515ae6ab0ef6e218f757b
SSDEEP 12288:vpsfHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:A8NyBo4kx929bL3Hnx
TLSH
T12A55F01AD25812E8D16E2274C7468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 ced968f2069f5c33d9dc49487016e91c737d942fd0e1b05ff74dbe9b021c6068
MD5 6221d4c539cca2813cfee26d00c83aa9
SHA1 e35fc545d39aee90dd605654986d3d50cc8763f4
SHA512 523f2d612fbee8713ca22adbba890fef540f1dd1cc10798f4328c0fd8a8a5b854a3e8669e273490cb4b611ae063ce49bae23a09e38b06c31297817e4ca4e883e
SSDEEP 12288:Qe0fU3fFp9NoVcnDa5YI32boV+nS8TPaF/fokq2r:Qe6UPXZn+5YO24+SsPaF3oT
TLSH
T1062528107626C74FC6AD40321E32C1CCABB07D51EE446F0373C89B7F9576A59BAE6682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1476d1b6af4a0664ff0abd42bfa90a8459051bdc5dfc4dfe4a86c9b76b4d17c7
MD5 0e21267cc4c084918c38ffbcda4f4f0e
SHA1 bd869f8f5199b70efd06d11677d6985905455631
SHA512 670451bf3f5efbff6eb18fb84c5e631901f89ae7d0e231c2f7f60d354391f38396507b44c744d942dec0022bc9190a76cac9995a5387d2b75412baab7ee1dffb
SSDEEP 6144:AEEHWzPmiTlW/OZmh0fw92VBu0nBAf1FY5W3AkkeGSqtMx2SqtMxieE3H2EmNN+Y:T6/OZmh9Anu+B21FYYNAY
TLSH
T1C065D9816037D38FD1BA6032072A5B4C77A4EC16B7496F26B3C9443AD86BE15A4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 1KB
SHA256 03be616284b140672112b00d6c1809d6f40ee6a611247ab84ac689132b3e3942
MD5 c7e2a6f1f2d5dca3e36f7a3108520fe1
SHA1 149f7cdb4262a6e4261a84ff179f80f8a662fec7
SHA512 a13ac73be6828b591a15ffaf6286e5daeb308ad7758640213defb60cceb0c57724f09075c65519108e149283d2a8ef45daba0a21ef68e23ef80ead48ae3dea25
TLSH
T19A11235D4F685E9A2F55E213343EC10836ED3C04F0DE70E8D6790A8D1CE56AF6368254
MD5 SHA1 SHA512 TLSH

Submit Download

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 1KB
SHA256 9997eed85a66c4b7954bf851bfd3815901a23ff66b3018697902ea38828d832a
MD5 cadd7e82d684facb6f1207b97dab36c5
SHA1 3f156906fe7133613afd90c91d97c4902d999d49
SHA512 7c32ba74ac3254535ced497a44158a66fadf39f453c98f78af90c61f64e7a95c0c4ed7888cc7413b924076707d2df97acbfe58fabb5817fd34173bd8b8c1a49e
TLSH
T1C91112590F2C5E852F54F213243EC10833ED3C04F09A70DC9A790A8E1CE56EF6368254
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2459a28064a1f431e4f0689b863152036bc572ad5b10ed552d8f8ad33af00cf2
MD5 0951a2ebb6b3d420d19f91c4eee31377
SHA1 8775ccf94972af23a660b3e3d07c55748c1a8b60
SHA512 957fe109a5d862dfc0d60db9a2ab8a804027b50eddc5dea59a4312e303167505b53dcdd84ac2bb425948c5f30fdc98efb9c5d0c5ec8d7e1193b148608e56812e
SSDEEP 12288:Py7/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:uENyBo4kx929bL3Hnx
TLSH
T1CB452312975C663AFA7D3AB0645EC124C839BC4D0F54D6DBEE1258BB59BCED28E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3c0e3054ad040722b666d8bc8d5fbd02ec29e4f017db2a3be3eb6cc666635645
MD5 78ee20b653ec4124777c180602f2f9f5
SHA1 9f65e068bc047c26f2bab9993d4b780f24ad1335
SHA512 6bdb2d526eb67b7005513a5ba5d2824366d3ce2fed27073de5073baa7d9feb5a1fcdec3584370bf6a60fb4fb532f4ad424a6f2fcbd90e9194454f2fff6fce438
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYWNyBo4kx929bL3Hnx:egb4mBIBhGFQB+kn3Hnx
TLSH
T18065AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 cf3c3c4ce72ee2af2e182bc4cc03abe61e401a6eb24a87141677affb8f1aad95
MD5 ec87a124b42bc5803c21f3bb1351cbd7
SHA1 97d790c272f92e3b09ddf5781ebefa101f0692c9
SHA512 ec882283523e67dbcb92d27527418946105812a64f1dc50bc60e713544d1e7c70329afa2a3071122bd840229459abe566df51f8f2494a63414dff025028d0c69
SSDEEP 24576:RG88u8FpJqH1Jzria7/mPNyBo4kx929bL3Hnx:07ZFPqVAa7/VB+kn3Hnx
TLSH
T16085F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 304edbf29cc47f4a4f3f11716f46283855603877efa61887bbe60ef5a1589ef7
MD5 4f0466212fc4c231d96ca1184689e205
SHA1 4808a5b080919c8120556b85fdfbccfe76f69036
SHA512 d42f55b754c15b9b17aba8e2f3a908e3e5173e748ef1cf2ffa82af0a80c1a055f0bc26336fcd70f5ead3c34a52f92f604eae46ff4f229296f9d84c05d102c1de
SSDEEP 12288:cHvUrBFrEjwaQMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cPUr+NQTNyBo4kx929bL3Hnx
TLSH
T1C965F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 89614b4419b10ab455998dd6501bc46075cbfe4ad2d156c66736c171a4f9cedd
MD5 9aa0ff9a96dcb00777288cdd0f11c164
SHA1 23d4805ef292c45d438e4c793fb4babba98a12ce
SHA512 07046981ba7306fb602dcb72ae5183220e858f4b8eccb010c52e5fe4192775ab80294832a4ff12d40d53a7799a2d9501401b4ef1cf86efd83e4017a04cd31f8c
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsB+kn3Hnx:UG05lO43bF+k
TLSH
T123D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f48f0dc9dd88822735d4a2a12f7f4b4a98c42e180a3639d659fc543f1b1cd91d
MD5 18b9976a47ff3ff0064969c49480bad9
SHA1 ae2a03ea90de7c6e56fafc4a48cb7a73a0af2ebb
SHA512 eb9b7df55880f73174c600980731e5bafc2509fd81b1791c8acb55e20f97dd5c72e12091ea23816aea4b35e2e84ba311a26a535a3a4cf301d226d66981b979f1
SSDEEP 24576:Tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn1NyBo4kx929bL3Hnx:ra5POZ3BJt2pasx2+mUB+kn3Hnx
TLSH
T10965AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 621a3f2a0b6fb3ef5cab9874d71f42147bf5b314c63a777caeb697339a9742c3
MD5 1d11ba06a9635fed8c185c9224d958a2
SHA1 91062f156ada5c335f0221828c5fc7bb556e1258
SHA512 bdd7fa97cc0a36fe170d32e303aca282574f78e2b0f1424a33ae0f2c336cfa47482739155e0dd0e4362a7724b80070ad6bab80115aeefd7d29113b317579a69a
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FknNyBo4kx929bL3Hnx:9Nc/zEOVHF1B+kn3Hnx
TLSH
T122858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c036b1d527941d529e26193b1222e1a016d33585cd213c68ac5af17c2b5a046d
MD5 15b6eb4d15767bfee55e10d22e437d59
SHA1 40b0d980c645f6fecedc165037f8c42c1182a6c3
SHA512 8de645ea9e9f81bd4162d90447aa1a7f3ad1aa6e88d9f16e0053f9acff2739a4bd2e5c06c764ba3147975a78398eb0ee867aa4a2a3173b1c7f9e6740c60d5a0f
SSDEEP 24576:DTkNvNnaFeYhJNtmZBmxNyBo4kx929bL3Hnx:DTMwBtOmmB+kn3Hnx
TLSH
T1C555AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 228d13053561b020ff7b198804af7ae53e7013516746f2c82c4f0dca29387dd9
MD5 43aca5a202d7deb7d688e03e86003068
SHA1 5bb9052698b5a703b359b38c0d9a2f264817b800
SHA512 0b03b1ead0f2c2ee9a10a447dcb6279d2d868e71bcdf8be3337b82f6466422093ba77f7ab4c8c06ce03f35de218324ea9b0a54796899ce4f7055a97a4439e42f
SSDEEP 12288:dQcMxWDXN1Dp/fshBItT1IQgATLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:xD3FHshBIYQgAANyBo4kx929bL3Hnx
TLSH
T1F775E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-114-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/360-120-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/360-281-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/360-113-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/900-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/900-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/900-364-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/900-152-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/900-153-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/900-159-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1152-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1152-195-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1152-201-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1152-194-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1628-347-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1628-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1628-385-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1628-146-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1628-140-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1628-148-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2304-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2304-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2304-193-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2304-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3516-1-0x0000000000CA0000-0x0000000000D07000-memory.dmp

Download

memory/3516-8-0x0000000000CA0000-0x0000000000D07000-memory.dmp

Download

memory/3516-442-0x0000000071A90000-0x0000000071ACB000-memory.dmp

Download

memory/3516-139-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3516-0-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3516-370-0x0000000071A90000-0x0000000071ACB000-memory.dmp

Download

memory/3536-319-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3536-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3536-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3536-124-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3644-166-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3644-173-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3644-167-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3644-363-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4388-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4388-15-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4388-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4388-165-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5104-105-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5104-98-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5104-99-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5104-109-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5104-111-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5404-178-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5404-184-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5404-191-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5404-189-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5404-177-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5692-136-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5692-332-0x0000000000400000-0x0000000000535000-memory.dmp

Download