bf18a77341fb89e76ccac7f025b1e0f3c4a9553a664da5cc42516fb465afed02

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
Size 1.2MB
Sample261030-eqmmrswt3p
SHA256 bf18a77341fb89e76ccac7f025b1e0f3c4a9553a664da5cc42516fb465afed02
MD5 5829b56132e6f2c92067c058569c6d76
SHA1 0e966f2fc06879e190ad94480cee4d249a57d95d
SHA512 5fb88a62c61ff94012bc20d6f6417a366b6528311c0ee791c80f559133269b44cfa256c68284d83903819c61ee50e7af0189f6096a631c28328ca4180dcffd7b
SSDEEP 24576:ur+E4OH76S10tXW2uy+c+R8JdbcxQKXaPKXoP6CVI+g4GnQ/tbw/2Mkjy6Fr7g0r:s+E4Ob/08Vp/R+dbcxaVQQ/lFTjN4
TLSH
T10745E0127BC8D436C2B335318F62C6B467AAAD704E354307369C3B3E6F74690993AB59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6140	elevation_service.exe
2708	elevation_service.exe
4092	maintenanceservice.exe
4388	OSE.EXE
4768	PerceptionSimulationService.exe
4484	perfhost.exe
3416	ReFsDedupSvc.exe
3164	SensorDataService.exe
1284	ssh-agent.exe
3532	AgentService.exe
1752	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8d4afe2eb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f1554aa2468dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a862b7aa2468dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000929cbc6e2468dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008be9fb6c2468dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d658d36b2468dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1d92daa2468dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d26bc46c2468dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5536	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3532	AgentService.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3416	ReFsDedupSvc.exe
Token: 33	1752	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeDebugPrivilege	6140	elevation_service.exe
Token: SeDebugPrivilege	2708	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5536	2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4088	1752	SearchIndexer.exe	103
PID 1752 wrote to memory of 1148	1752	SearchIndexer.exe	105
PID 1752 wrote to memory of 2636	1752	SearchIndexer.exe	106
PID 1752 wrote to memory of 3008	1752	SearchIndexer.exe	107
PID 1752 wrote to memory of 5072	1752	SearchIndexer.exe	111
PID 1752 wrote to memory of 2044	1752	SearchIndexer.exe	112
PID 1752 wrote to memory of 2576	1752	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_5829b56132e6f2c92067c058569c6d76_amadey_elex_glassworm_remcos_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4092

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4768

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3164

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1668 2288 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1760 1660 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1760 1660 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1668 2288 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3dd76a9b218c1780f2a802753d71d9317e053371ef9c2dbe2b6aac2b49d3649f
MD5 37f4c9eb9ee9b6ff99c21245f64f0d9d
SHA1 2be08b92b3b012c8b7cc6b28117944267513a0ec
SHA512 254c5c52e59850e544530e20f6ef5b0e539e20c5b09bb35fbe6b0156f11a2cf2006808a43a3813c012843aad0cded41196e36c6bd9e31e1b60b04d17b528e952
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWQ/lFTjN4:23q6HjB+Lm
TLSH
T184D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9e4f444a58392f0a767bd8436b43439a01a9f7652283efe550affda0dadec761
MD5 6a732a2aa578460172259c76d0b1f7b8
SHA1 54e0965b6ba72e4590fc88d35f3a456a45e46ef6
SHA512 b268aa0309f38566442eccc4ef9464ec6be5dae18774361663cbe012d7ecaf20d77f447a2e7679f0c846e4fff82e53228650f4df0b4e4bd70fa51a3bff892cdc
SSDEEP 12288:c1XLsswWkxy2lRq2czANGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:qXYfDtczAtnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1E465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0653e78728bca99499a64598a8b8645abbf6fd64b7697a87f64967c775b1ab04
MD5 4569b7757d9fad3899e5b77ca9661fae
SHA1 0e954b4b8aabc8ede5fd4caea781893148bd7f34
SHA512 85ae0daa7bde37200a87237ac1468c634e6987f9e5f3cf2129fd184e09ce4d771cc1b5fe2578029d3b9d8c5f9e2e8c21ba2e92eb05c4d2b03b4f1016b1b9dc35
SSDEEP 24576:U0Le5ji0hmxLrMOnQ/tbw/2Mkjy6Fr7g0ol:UPji0AlrQ/lFTjN4
TLSH
T1E5859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f4ffddc1a3ea7f4c3ec50af6beb536fb6c604fd928e48d9261991ff85847f198
MD5 39e198963e6b4f08ed79a89a6206cb6c
SHA1 0dcc7686203d368c1a49fd02dc6e80029d644ad8
SHA512 b59aaff781d13f40a62526dd7b7746547503bfff26b4677f1ea9b55bd5870b5924be53f7fc5026fd04c4e0905f9bf8d9f08af413aa6e330e6c5b679a1b1916bc
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyuInQ/tbw/2Mkjy6Fr7g0oh:S/ezSC6vUzPvxHjyfQ/lFTjN4
TLSH
T1E1755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d697ae5c182b160af2ab564c5f4777df62ad34282b37cd50f99d7444405c114e
MD5 cbc3f6ece1fce52a6e46c1764350d7ad
SHA1 c1babb9070d3cb238a4c609ec006d46f6c4e4176
SHA512 f7ab75d8d4d1a8ca62e507eabae4a14ad3ada5727519fd250268ea1cfdc911e23197a3775acca3aecaa1cc1089891c3ce5f45c94325712dd80b09e24caab3409
SSDEEP 24576:cVbqPb88hv/l+6ZnQ/tbw/2Mkjy6Fr7g0od:cVO88hXl+CQ/lFTjN4
TLSH
T115559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f20990046a7371620d617d0fff55b803e69bf85fa91a8e7d29774399abb269e3
MD5 419bd517fec9e24132bb38e42e52c0ff
SHA1 35e63c6b52f7a237c403d23ccb5e70e320ba96c5
SHA512 45ecd7e9332a965d140aef3e9eb89b5d41cfb02b9082dbea19c49e7923be6070f540fd1dfbcd817856c42e1eb9a352f6eb1b6bd38fe39080ce4792b8b11b60bc
SSDEEP 12288:azqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:azqnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1615523796A24F887FF2B06B15CD284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7b92572cc4eb7a10486e9073a5db21f26bc2e75991456d0ec118f43cb8c425d7
MD5 f7ac74c5f90ad0971fc28c2d6bfe0f85
SHA1 8de7a7faedcd970cd760d238e9974ed3a6b977ea
SHA512 9023dc7bfdcbf85b6a1579f1d95f9ddc793e538f982e1a6d214b8e9d328a6814bfcca819f61c3e58005c8e088066031d737c2588b9554b29950174821921e04f
SSDEEP 12288:ReBNUbTVO86UBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:RJIURnQ/tbw/2Mkjy6Fr7g0od
TLSH
T15175CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2e35224a6efcf78c743fc44e82a9772c336daad9bc567fab258b69692708adff
MD5 848d3574c019cf1fde658ea5c056a8fe
SHA1 695e664ae0d2ad694c5dc4ce4ac35bce9066df39
SHA512 2b3823b5374c2ae3aa0c9fb91d9d99c90167cd264e590fc600644790548b66a16e171f34025411c73bfba6cfef4657ce1e123033a42a0ae0b15e35af3473a8bf
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:UQvGAdlCEL8c/yRNw5C7Lm
TLSH
T1AF267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6e1abe0fa306eb20d6f0c3b3d1e451b1092d72507221964bc7baaec9b9376a49
MD5 88a395e0e4f03488288f9de8c88a58b0
SHA1 1a83e81f1c45ef26ff72cfc4a6d0a0c87c6b438c
SHA512 c5bf8c63e5d4c7febc294964fd13713991fc15242642147cc1884a054070172d1f887ea45f6c942def5a658204d161cd1442706e87866e809a4f28d3d48f0fd8
SSDEEP 12288:+AwSfxL/2Dc39DLLmt0LDQewsAjLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg4:jQewsAj7nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1BA75E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7bdf38cf43c03ecc0b94223dfb2ab07ed15f39a4f0e381fae4ccc1781a2c0a15
MD5 83ac845a1da4f61502fadc8bd433721b
SHA1 0522e420ccaa6f47b2b329182e515fa3797d6652
SHA512 b74090baa54eb376b6dfe4126725179b7fbe133ebd301cbe20f667e2eb9a684b4181580203dafbbe3a72521ee84fa772e3cd112d85c6b7d1b139be6462ab5873
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoL:dUEtQevvqc2W1cpV2EI32
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 67107b706fa5064fd0929e66b16f7e89b463fb0ffb44936bd2d3e36e880cce65
MD5 b64dd180f5a232494074655028232c61
SHA1 f86a3a18265f9ac25401dd488cb28048073d83db
SHA512 1301a893c2db9f4d4b3d3b28dcc782c377a55bd48df15bc3c424cd3d445f7f0b8ad257aeea8231436383a2202d7e7595c3de3358e61aea28b162cb7f1888be90
SSDEEP 49152:9CbRquA/m2yL5zQfFiV+XenmE3/zbQ/lFTjN4:6oqtVjnmfLm
TLSH
T1DAD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5da596912fb9a1d571aaec6fd29fd0d88ab06f54cb725568c70a2edf75ac4fc1
MD5 649b861454520483131fb1ace924c9e2
SHA1 12cc7690668d200cb446416a4375ef70385aa248
SHA512 78527b6b6ebb3b9e8e2438fb011a11185649a93ffc86d4d049a18eba6adc15a43d9217dfde1fec5863a2048a1bd29d3e8cdb5ebe7608fa7f709006897670521d
SSDEEP 24576:6AhGLJIFoiwtA5l7S53cnQ/tbw/2Mkjy6Fr7g0o+:6AMyFoiq5MQ/lFTjN4
TLSH
T1D635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 11e4b6e2087e613acb262f8f7e7be0e29a4f52b51236b58eda58f5f5546c06f7
MD5 a365f17508b5c5ade7c787f48699a29a
SHA1 e499ddaee4139c6f6303b151cceb95f09e735dac
SHA512 5d2e669d78506c8e4945b045b47455266a6d72eb4d0b4598112af63a54c09596d7a801c2dcadef677d9620a91a2145ac0d8292e6ec6035ca4e234bd669ac8955
SSDEEP 12288:+mw5HEjsChN2BFgl0WDm+CoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM1:XwuHOW/nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T15665F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4ffa36f986ac3c45111dc543ab382a4deeb0dac2cecd41311160577495eb694a
MD5 1f1e589bb9b3953442c4ade6d4b40b65
SHA1 0fd5c170e19de9698cebc4edf4038f59d39768de
SHA512 7251346a1ba2c6f264a2fc072220318c9837c2e8f879deefbb9047364e5c65a8f024999d961edbb90212cacf642ab1ae7b214c4062eece2511a97e5ff9e85438
SSDEEP 12288:WXZ1IybGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:mZumnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T10A55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fa8b0da00a94222df4b25c23199c3ecbde43fb2390849c5502ba2952ccb5010e
MD5 7a178ba4ebc8d0719797e880f02bd891
SHA1 61d909992fc1ed42a1cb6f95b60097efb32ef368
SHA512 b47a1044a71e2edcb67dc5963a0ccfdf453eb9c8d9f90ea472016d76f377df0ee41e28a9ea15ab0a27b553d1cce2b87046ffe7623517341b74b24b02193f0905
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:FQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T1C2666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 767e69a80fa3f7cfbeadc2b44499ab6df08ab132b68cf9a74a154769bfd175a3
MD5 d4d552aa30ac957824aa3b80b8dc322c
SHA1 ec162213bae1bdcbae2a24116ed56735e1711aae
SHA512 daf53db67f974c8d2948c8405ed55964ec90b1e20a3d2db4d8324d63a210a970512b850daaa1ca8fec174b54539a061eadf3b7bd98add61704761a3db9bb52a7
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:sQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T156666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 eaae99867607a9278f801f328d2bbff159d8ba9062e1df264e3ffd2894cb4c75
MD5 c4ec37ac11ef430a8bf37d0d79d50bb4
SHA1 505af1f36f288c6ee2428fd38b1009912faef684
SHA512 19cb6090d395ca08116a0bd893203a6f498c1985ec88d198a579f9fe677467d0b457b265cf568c004f3aee69cc8fb9ecfd68103ba8269750f7301277fc55ebee
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0WnQ/tbw/2Mkjy6n:n68Qg55nhheWu7PNU3/rQ/lFTjN4
TLSH
T13FB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e673e5e593f75eda2641f22563d63201271393fe277090aea965d6b6edb67523
MD5 19bea904c65f15b0a70325e0f1b2588b
SHA1 3af338152a866f3eaa2e60720e6ec65afe3c0a38
SHA512 faf9eda93c01cd1730b17480a2f26f664aca0eda15cd692a575ce7813fe690840e7525829314d55c11fd8a43964f1ad2ede79b7cc9c5e7b5113cf5853a09c01f
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99z:ty5112gYy5azzVvL69nLKnhZlLm
TLSH
T126167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f76486bc2e49be3f79bb36efa1a5d37ed7625e68a4b8078867db2eb59b531d62
MD5 877de80d35f410f85746d2e08d61097f
SHA1 98545560760d3a33e66a6a7d714ce418bef6a930
SHA512 b7551e510d3acf324c2ea09acec41f2eea39d840fc819267de3345027d77b897702942afaede599be435c3f78d779b89b84b02d19eeb56c56548843528aa7de8
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gldQ/lFTjN4:Xu6JmVxd2dSLm
TLSH
T187D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ad7e3fbf2ad931a22a3895aff6d0498f41730ae78f96476d1a98c6ce693d1afc
MD5 7e52bdd61ece2556a05461382284690a
SHA1 99ef01f45a07678194a77d55a6a5f48bc1945ca8
SHA512 409173a9799db5099368328594c0c463e32f587ddfa691fa4b69d025cee2b8d71e233d9cf9031afa07642583fd875fe4884ec8a153afc223d65c37dc3fa95512
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xxQ/lFTjN4:RmifPbRfLm
TLSH
T19CB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3649bac636c49b53b300f1fd6a5a233667bc056758904b1f20f5a1dfa6e7ae20
MD5 940bbf97fbfb1bb856d3c50ede1c00f0
SHA1 960a81ac1d04fe79d8a25645d59d4e7c46992687
SHA512 b0276c4a19c7a5d97ecd2a95c1eb1507c60acc219c58947388ca58d49aeacd349cb646abedc857322e24fcac5cc8b19761a5083f459b50764aa033285e5a480c
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqmQ/lFTjN4:45dKTi61xLm
TLSH
T131C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ebb889acd00c2db3ac4733f501ad2055f24c2d51f3cf7bbfd71322cab0af424a
MD5 357d9fed4e655aea20452ee239670ce0
SHA1 8d40341e0e84de4c607ee2c85384a6d79e1388c4
SHA512 68a542af8788058aface1f8c5976612c543e59aaa7044491670c21278972be486f50df6db6c57f2473c773e6564acbec9560aeeafb4f29a1981b745056244c8a
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wtQ/lFTjN4:wX2iyphTLm
TLSH
T17295BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 687fb7d5b5742d3fee69c747e8c08df117ecf73435aaf1a92b10265d17ec3b28
MD5 b6428e4e93214b95aca841c4ba24f3a4
SHA1 06b216b86026525c8a2395427fcc8101c5d13906
SHA512 838a19f76099900187e25bea9c7c467f6c50cfe014a834a72da9c014ffb99324c642b7f45aa10080fbaa9a755506607e95ea37c3ac1f8f79cbe4fe791a635abf
SSDEEP 12288:qCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:qCnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1635523697965F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 044b8aa14f828aa53e798ec676a3e16cfc7ff9500fb30be1d54253a59089e391
MD5 c5ff126bd02ed43dc55de3cdeac4b46a
SHA1 22e3b89ede06f59ff032c444fca68b0c814a40b4
SHA512 6310085ef512f6cb98c4767277f05584dcf27cf523d1dcd7e36917c49e5c29a0a03d5ee3774d9bee097025ef8361d1ddc9a160220e404d1eb2652b87699dd754
SSDEEP 12288:CnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:CHnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T10A5523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2646abdf1f36b9f5c8bf643b2abedc38b69708c6c74146e566f24f7557eeacae
MD5 d3768e3e4e5ce41402c831414cdc40a3
SHA1 859e9a659cc8c1a8fd8c7ad8dd1fc93226937c42
SHA512 4b06eaeb2a8e8484c380a6143183cca0b7686cb9aba9a67f373cc6894541d0eb7b2fecae496f47f0454946aba3b2be93cd1f62623f49f2df2d550ed61f951612
SSDEEP 12288:Z5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:ZJnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1855523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 53cc18c800f6c3a826e8e88b242042ad92cb296aefcbf787089931b3ee834442
MD5 fbfef5b266a93a517d7b5bd7a693f922
SHA1 26e5182a900c0f2645478b3cf81ef5c127242ec9
SHA512 f738d259560c692a8e428fc2f91075421bbe0650e5ade631e05d225d107cf7fcf765aafda90ece31ebc3698c17e59a5a233cda20562727055585ddfd28b94a9a
SSDEEP 12288:bV8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:mnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1315523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a5cdc1915294a79fbbcabf4199d56b12d77be0151b79eff391252a5e6c8dba0a
MD5 58177c20b82b8b86910cf8563e828ff3
SHA1 5c0c004a56f5a4d9d87f478e083be61e1937865c
SHA512 35de17eb9f1c01056c3559c95f1ee8c31159a623c2cd3229d9068b5067ea3c19bdb4baae319ebd27939f4b08891451fad71479479bb4ea976a73b48bad3b755a
SSDEEP 12288:ikGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:iEnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1C75523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6709ff3bc657322cee6d6ad46217bfa75cc3d76dcb03374b51dcc635c7d25633
MD5 5f9687f81633beab96ca2c942603c1ec
SHA1 8fb1eb2a96303d47cf2cb61c2cf4858616f7b09a
SHA512 963cadd65acadb78049ea8e6ce3e3095300ca767b2fd56f62007afa015e1a832e8edb7367f9190734e8eb999c273d47d49de899da91b29c188ccba5ee97b222d
SSDEEP 12288:TjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:TTnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1925523797965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 41b043d3d0e4776e22c613ff55ca447b2aa87b7532b0759cd22de60b5274b100
MD5 66adcaf67bd0782d48b9d8695f6a98ab
SHA1 ea78246d9abe808c30d920c283ed8788ae3c2c43
SHA512 7ba9378e81972e2166e85d9779675778575051a5e2cb1155ef12925ab6fdffb7bacd9e7138bd6946b8571f0ecc1babe00aa39cdad29f46890ecdfa0b8e2e455c
SSDEEP 12288:CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:CvnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1D35523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 aa16da635a2edf9a34b7a8e2bd2c4833b30b18502381c65225124e0ae0b39fcc
MD5 6777706c93044f66ed71cd7de4f45bef
SHA1 ef96372b29a2be922db0adbe597db680cc2d469d
SHA512 7dcebd1b7c4b33e27c5fc19e3e05d389dedc377058c0320856cfc5e3f95bd674eda98d9ed80b033155a617f43112e9b76fa2320574eec342337e55c77255af73
SSDEEP 12288:RiZwbDzzFEoS2cPvyHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:UZM3zFVSOnnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1BC7501A9B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dfb2be6aab18c690369760156092bd5618d7f23f37aaf9748ab917f89111a77a
MD5 7302043ae7c4d496dbfa9dd7ddd4dc58
SHA1 a493f9113b89ab2765a96c7435444b238c070f3f
SHA512 1d889fe6e5da7b44d2bfa508fe8db8aa477c7d917f8aec6bac2f1ba1f7d2bca8ad03568383dfd2dbdf73edf8e30ad2ef11ee5e91d7b197b4e2358145db457e75
SSDEEP 12288:pWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:p2nQ/tbw/2Mkjy6Fr7g0on
TLSH
T14C5523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 93e8460de98ddd0113cc2174bd7464e28e48f6cbc3b4c71ec4a3a39119fba280
MD5 06cebe1d77af4d925b6a4f9acf60c72b
SHA1 171977add71603eff8fce5f699f8661877298965
SHA512 c0a948755780a273b182afcdcdb67eac698dac78bcb6e9a6ccc3f8dfe2e6b1e9c3ccc34461fea653940b1de276ff086f1404c469d372636f632bde069255abb7
SSDEEP 12288:/6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:/6nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T19C5523797964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f9b807fe0539a2cda365e1d21f4590788a98e85b3064ef2ecd9e60187efddcc3
MD5 c49f0d30cfea45c8fcfc4f31bd418287
SHA1 e4d19770844bf17d3b40820d4a74d7a1ca058c96
SHA512 94c5e306df68ff98427dcd7258a26aecad6f4bd063aed2b0d417fa561ecff74ed28ce6158b1217efd81614854512625daae15241c260638aa44a43cde44f2f9c
SSDEEP 12288:GyPz5L8bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:7zyLnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T14E65021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 76442373f2ce9d024f3cc2e40defc99545f345669c36113cf80442b356e896fa
MD5 dfce673b7cae4df99cfd70ce315a0a9e
SHA1 00d1608b116d8cf23b359e7eca5943c706577cb7
SHA512 5157f4f370eb0acc799e3f46c350decb70b085033b90f455f1e1a90cb76cdce197229148ac909e81c705542a7ba3c35ca937db6b32f1ea5cd4afa241b6230c2d
SSDEEP 12288:AWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:A2nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1385523697965F98BFB1706F54C8281829B3F0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 91bc1b92db482aee4bf12561662c9d16c03e2e02fb880dd3b517cf9172bb9167
MD5 c7334f4feeb88acac5b8198e151b8dae
SHA1 06f5fc49b8b92f9fe9349d20c770d6b2d5379344
SHA512 94746579f9e1f8cd01a6ab3d01b47a822395f842a5d187d29e80265d87fff6e44cd9218222430b188d84f5e4b0032f921d020ce218aa9526837dece04395ec71
SSDEEP 12288:0WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:02nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1395523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 962cdef0412000b963928c437c60882fd69afb8203082f1ac0eaf79e726e2faa
MD5 e90629e5d20353e5a869d252c71a0366
SHA1 78d81557fabd6d85f43c529b43ecbab7fc076e2a
SHA512 dacbbbd018c01fab0bca092f9469b31946fc376d4e67a14d5ceffc7a67710aa7eec1d582b419355e77c8350eab64dbac9ea0d74a894bb5faf12615732aa7d469
SSDEEP 12288:HyPz5L8bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:qzyLnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T14F65021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 de8573aefaeeb5b7de2d64f190e163f62684773c30f49f525a011dae096da1d4
MD5 06e0d7eb91f68c1731c35213618bfc76
SHA1 e5e197aa3871c012ff465616ae57e1ea5c191678
SHA512 30e1b5b46a23e36569b1d5d9b25c9af9cb966eab0390e68e31d99b3024986423dfccf04b71491bd3ea30a0b7a56aea7253b1d6f915ab86b52a56a7a5cdcb4acf
SSDEEP 24576:0T0aLl3z0zD5nQ/tbw/2Mkjy6Fr7g0ol:0TDLljIQ/lFTjN4
TLSH
T1487501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 4dcdaafd975b9b5eb594a49b571c62e89038ddfc4b0e3b6a7c93d3729c133b30
MD5 4fe2e82e41a7bcbc3aefa33cf207d98f
SHA1 ca3b26b875d259beb8603490eed94dc099b15608
SHA512 53deac5a8397d24a90cf5e37719dbffb9f487342e47f7eb3ccad8e13b1c7c6417c45a4c4f2a9766d57a0ca5b7fd702ed8ddd53aee548d63efd2f063ff6f3c7e7
SSDEEP 24576:731d9CHKy7GZFnQ/tbw/2Mkjy6Fr7g0ob:b1d9CHKyajQ/lFTjN4
TLSH
T17785CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f56e487e5dea40e16ec17294cda1db71767b4ac0e1e1084f78adfce053c0e227
MD5 ad0d1e7d1fe7c871c2bdbf1fb66d2f59
SHA1 b1ffbf0fe6952391a2d3fa51bd413ad44e35b000
SHA512 bf10efa157c1e44011e01c800a945d6f78d7debe517ac7be49a78a4b1e2f2f4f57a30d411e8e532f9e8cb06c4d77ef2866cb7d4895d5e3b5ba2bed46d1f6db0e
SSDEEP 12288:6ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:6pnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T18C5523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ff92eb3ae15ef1231eb456ef11513bdf39a7e658ce7d466e96197d949ade6954
MD5 581c6ccb98e159c756c9fc12f0e7834d
SHA1 2ca96218035101f5ca2882441395adede9a278cf
SHA512 55507a102b8a698b89f4f9ceee7d1da1172159f977682100bfe4cbaf58aedbac23a5296b74a46a4fedfadac411a0da31621cbaf06986220b4b73851818468a4b
SSDEEP 12288:U7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:UrnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T10D5523787964F99BFA2B06F14C8381829B3B0EC6BFD1938F77481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 19cf80cf2443e41ce20710d9dc2ac83108c71e977b17e1c04f624d326c009a86
MD5 3b2e6f6ddd65ed7d962fed2f75687c6d
SHA1 6e4d2fd3d5168700b1206fdf71043175187348a0
SHA512 81d481968b08788dd946fde37e58f0324d884291e3fa5deb2a0a33847e83e6866b95b5e9207e26a4008c07702d9ff14becd1f854566ae992e6447a77ba8b3d55
SSDEEP 12288:ywGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:yQnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1B45523797964F98BFA1706F54C8281829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f55301b879f9ab5a27e7f794d1cdf4b47c55e0fbae72b0ec665f9fd3f67b4cab
MD5 c8dc9f1a729c52850411ceeea6cb02a2
SHA1 2f231784a31da0fe58e483dbce0f69852005d73d
SHA512 e9eb2d1840c404634bdbc7b040a955610aee898bef48e28ac092894aa0944445fa4608c7f1b7454cdb0c39dff6071ff5fc6dfc858ff3c8b41a3721023d27a35e
SSDEEP 12288:MWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:M2nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1655523797965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6f0fe48f129c0cdbe94665f25e311509262a0a6afd3f8d3a6c5afb712657916a
MD5 928ce741bfeefff8bac433a42a0c35d8
SHA1 fbbafa91088914b0640a7b563c374b1f2c2234ec
SHA512 71b83349435ba1161886b51715fdc1cecc2137115cf7339b0887e7bd8e69889912f5a9619630bcb592ebb5064bb90ff1dfed5b14b287f07c4c7f051cb36d09dd
SSDEEP 12288:dZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:dpnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1F25523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 47471b68e0feffa97d03975b0b43628316459ef80d83b1d388b8bad0b85120a9
MD5 4198e5ecb90fe6e95858c261aee8df1e
SHA1 6c1de2e7f7b74a19cb65fe38f5a6fb041c192188
SHA512 e5b7c2407563599d4b3002c7488c3da3dc8808948177fb13d316d9043df70ee397b5f1821e294f87e84b1bacbdb0801ebaedf67d9c280a5ad7078e6ff8b65675
SSDEEP 12288:4+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:4+nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1E85523797964F98BFA1706F14C8281829B7F0EC6BFD1938F7B481129967D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 32b6b174bbed00b40e6864b7d473f8b5198bb456f0e478755abf4990f9ed6f0f
MD5 7951c7222c9889b7ee247062c6d12f93
SHA1 7ac7af9504f51123a6e6ff92b647438ca4a9cfca
SHA512 ccd535d45a3fa197f2def44127a311b0127213dc30b5a90b2508478ec0b0b378ec7bfd79f8755d83102fc897a2065913c045e3c9fbd27385af04bef91f2ae9a8
SSDEEP 12288:hkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:hEnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1D25523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 7e2d63d7165c4e7ea55aebe66f1da6035f683811e7aa28ed76581c064926662f
MD5 e5c2a6334302611f4877c4e019d7b93c
SHA1 cfbb5562ae42310a0bb26969a56f492142d8c1fe
SHA512 f274100c1619447760469b85f7d244f11a6068d116517196947ec7e2b50d257b0c73762661c92e4a87712f72008fced391af7ddceb6b884dacdf5f6dce0043de
SSDEEP 12288:uRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:uhnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1615523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 ef1d248cc162f604b4bbfd3179f346d9cee032eca970f8b4d0ab9c658d6dea84
MD5 18c7dc6af9494d2f2ae68a442fdfa92a
SHA1 658a8917b67de137772e0e0cae58ccf0acb8679e
SHA512 7ff7b92737c9200b292245693866d27ba90a501782b5f79e2f883e4023785063edd484583a0727abc7de22ac29c51fc39f803824efece6f2b75ad2338b3db730
SSDEEP 12288:0kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:0EnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1B15523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 aca001c4606dca6e3a4c5340459bb58d8a1c2f52e62860562fefebbd50e2c547
MD5 a2dd2c79e9124bde45ff771cf3d83302
SHA1 bcad0d28ca20c121f581366f8ce59ed2ec03df1a
SHA512 59b5594de7acc4463800d5385296cd14fae31087aec7e01c2045c76bc104cefd3294ce5ebc5c969db20de9b6b6b19e8e9c3aaa8344235201909d185ace417019
SSDEEP 24576:pfwv/k9RX6wkyAIKnQ/tbw/2Mkjy6Fr7g0ox:YMnYIKQ/lFTjN4
TLSH
T19785DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d05412e1cbf66c4345b22cef339e5d505202ac9debfadf126d417693057dbc2f
MD5 576eaa46220c2630f54879ccb96103d4
SHA1 adc77e2fe2c9dd7c451772c5be561a963a698180
SHA512 6e134e8499f3616a2d1fb309212b6c068b75c8dcb35d114ba77f1ac1138e06b5a180543cfff98feb669e8a92c063d80cb9d6481d310697ad1fbae0f15eb86665
SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NQ/lFTjN4:vySzPqLm
TLSH
T137066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a8df88cd2831cd76174ced033d4189457547edea11a51fc9292bc407e19f4318
MD5 288e8c4fa024deb4513d6b1caa73c205
SHA1 e24ffcf6341b8a1239e7bdc5d5b77784c55b7ae1
SHA512 f7210138715c6f876c6d9e463fe5c369fa934787bdc9c423b7945f0eab4a531376507bebca92305fdd8c7d3d56b3ebe5eb1c795b8ccb92d97327ddc0fb142292
SSDEEP 24576:S47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY3nQ/tbw/2Mkjy6Fr7g0o1:S47JUQj1irIhCnDHUPfF/dQ/lFTjN4
TLSH
T1B365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4c2e0eed1bbbacab89d24829009f0c1f66d69f7f567f25292953c676f40df626
MD5 839d9c2f1d2744914f99c84d9598fd27
SHA1 3cd572e5eb07c0fd05a260604b2ec0227e1a7c2a
SHA512 7cd0b5c88dd571dc938dbe63af5c5622cecd1545418f83dcae418707051c3cfe181ca0c695eabb7d1a941e586ee5938413f4b919299e759647e1dca1c85601dd
SSDEEP 12288:bssfGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:XmnQ/tbw/2Mkjy6Fr7g0op
TLSH
T18B65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e9d244af171572964f723e0c35f396452fa0816018c0f2a6261e0d347a99cea6
MD5 b22ec1def835be4ed7ac21d8f9c20c61
SHA1 3b1234970a5829697ca4aa0d5f7cd1579871e917
SHA512 a8cf01af6fed8026805e4fac7a2da5ba9dc2d1f14da855bc653666d0f9fbb3177749417d5ef94a0efcf6297c92120fcb56374fff6f4b49535a1d52e842beb51b
SSDEEP 6144:g1sBC2naBmVc+UnIoc+IeotMxAdgiy6O4DsI1g6uGZ6hdI1CfB01P6geFQJVeuBC:j0jLnUg6uGsfOdsNuB8e1WZiHxw4I
TLSH
T1503528107666CB8FC66940326E33D1CCAB707D12EE05AB0772C9873FD576659BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 34d83dd5c2da39274107f3727a2053c6d4502e6c1ba45b1d5631d61eea9b59c0
MD5 33c344833712671140bb64e7ac6342a1
SHA1 882f4aaa66a3a5094f85ace5b7ff3c0e7ab18b17
SHA512 0f370b8b95684e2e2ec992ea00a9013b5229a4093fcd421996f80d36c5cc6953506e4305f36289aa7e6e142ad6ce6f35a38363bd30bfc8b7bc9d19a233355531
SSDEEP 12288:dskEQzD5WvWWhHl/sYh9/1+rtV+rkkEPD/UE+Jlbqb+:9AKkluK
TLSH
T1ED65E7419437A78FD1BA6032072A5B8C6B74EC07B7096F26B3C9453ADC1AB55B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f72ffc183d72965aaa947f3819d836eb239850bc3f8a299f51f461e04d892250
MD5 3275a3befd750d28b51d2622ffa5565f
SHA1 7ba271a9e1d1678ffc7b7209727d0a3d28d3db30
SHA512 d73fc8c104b973a3554920eb31240d4bb914e461f69869d6041d15d1e6d1080d5470b6cc845451e2a71e8cf08b754edffe7f477422531c4880d3b753707b660b
SSDEEP 12288:H67uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:OunQ/tbw/2Mkjy6Fr7g0oj
TLSH
T14A5523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c6c820e67079b07e5ed93f40cc08a39662d40109d9f3b99eafa45d2942dc82cc
MD5 4536913d2acbe944869b696b8bab82fa
SHA1 e96ce07c6b271b75cbb8c75e49ff88109a26161a
SHA512 536e648aef310db99ffaecc7c103dc105c7bdcf2fadf75fcb55d7907577ee7ece7ba0c93dac2dd943ea5420378674561cf1282bf533a0001ed1cbdb1601ab9b7
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYInQ/tbw/2Mkjy6Fr7g0oO:zgb4mBIBhGF3Q/lFTjN4
TLSH
T12965AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 63052714455120d8704b6f8a595e0fea1849ebfaf5b2943f6196215c6808751e
MD5 f0af3b40f7f0909a0144930923f59d51
SHA1 398c05d075f27f4e9f5faa530e7fadfe5e79465e
SHA512 bf0448a8864fa1abbca69ebcbf27710d7e6c02f0778d57fb9abb3edabb226d79bc4a308908b7906ce7e0156dfc7bcd7e10fbb1f7133a6f8d0b139522731ff9dc
SSDEEP 24576:uG88u8FpJqH1Qzria7/mnnQ/tbw/2Mkjy6Fr7g0on:l7ZFPqVva7/wQ/lFTjN4
TLSH
T10085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a2c6f1556c57ea8bd803d46bbad6f88bdd1feffba0a44e56be2af7f991d3deb8
MD5 4b7e705858d3f8a1894cd4a26938dd07
SHA1 b69033ff3a3e7d8f6cbdfeb90cdc488bc3457c25
SHA512 4e5a847c8230039421b019249e89767a7d0e29f87aac747f9297d6c49e89e850ffbb33f44f6827983df3f840141ccad97fd6cd27bfaa756076507205c3601a5d
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTQ/lFTjN4:aG05lO43bdLm
TLSH
T194D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f75d06c3bd2bd3681ade2509336e8ebfa44b9912327aebcd411dbb05aaf2f25e
MD5 4fe18dc6ffc8ec1ed7e9ed2a977d4d87
SHA1 ca9ede579e6906dbb755766e4f692e608a1b723e
SHA512 ac34043ecef0ba9bcdf9a9cc5bc08a4506cb8b343b2d21d73d3ecace96d4cfac278c75509c292625220468854ebd9fc6270a802bc28329337f893bcb37af8f2b
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnNnQ/tbw/2Mkjy6Fr7g0oz:6a5POZ3+Jt2pasx2+mrQ/lFTjN4
TLSH
T13465AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9ebfb07377344b2c20e4c13165aa34b00f7d1ec0dfd36acbb1ded3789047c08c
MD5 85b67fe1d4c1c3c45286469653b1e5d8
SHA1 07a998b75bc0de475e5a7208db57476f19652a0b
SHA512 f093d60f7e079fbd14fc0f2b8ff8faff150bcf5e78bb8a63e8a8ce08077d69d33b1d955796c71c8c4309c6876150d75ee6e1c3ffd5f59a76ce5aab884fdddf60
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkfnQ/tbw/2Mkjy6Fr7g0oN:dNc/zEOVHFQQ/lFTjN4
TLSH
T161858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 06be71af2dc01d2f768509ed10f91e5e2d65b21dc5b9d01d8a5dfd9efbd343d2
MD5 9694f42e734562f945868a50268263e3
SHA1 4143f475247d4b1a9d1b09dd6d0fb6d422c10dac
SHA512 653a0974c68d49ab2aa88126636ff2da3a03f3a72666be9f8a1e931fd268235cd30512050e6ce9cf11f87d60c9292439371e440c381845c170836100763433a2
SSDEEP 24576:/8kNvNnaFeYhJNtmZBmhnQ/tbw/2Mkjy6Fr7g0oi:/8MwBtOmhQ/lFTjN4
TLSH
T11555AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 499cfad83b5908ce0320fc7729e5b51bea5ce9ccad564090c55956b2dccf0de8
MD5 035ff1e2290ba66a0ce3fdcaebc7d557
SHA1 f6f472d9175a10e3b49cb3c3bc6ef68c884ba8e2
SHA512 55b56009090de9a56fd07f085b415faa47689e48d8163b33fdca54916d59e86917e29937770d4620bf643d752173271efc81b54f660659fce0a16ff2dece37da
SSDEEP 12288:4HvUrBFrEjwaQzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:4PUr+NQjnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1ED65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1db773d04d5aa35a195f583e644b7ea0b5751d1af16841f1d77ba99ff1e235ff
MD5 3dd0f88693a3f56d4e4bc170ea2d6a85
SHA1 f37925810d6f9281a0c1b9a1082cc3ed97c6204d
SHA512 bbe3b3f6552a379742cdee79a6dd95d398bf52eb35e21b9ec705093de1fbfe833b4e20da6f817d04bf9b0e88cd0ad4aafc349c5647f8ad364121394cdf2bc17d
SSDEEP 24576:4D3FHshBIYQgAinQ/tbw/2Mkjy6Fr7g0o6:4DVHeBIAAiQ/lFTjN4
TLSH
T10075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1284-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1284-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1284-368-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1752-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1752-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1752-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1752-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2708-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2708-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2708-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2708-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2708-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3008-401-0x000002A703320000-0x000002A7039A0000-memory.dmp

Download

memory/3008-384-0x000002A703320000-0x000002A7039A0000-memory.dmp

Download

memory/3164-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3164-108-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3164-102-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3164-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3164-366-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3164-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3416-381-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3416-89-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3416-95-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3416-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3416-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3416-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3532-135-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3532-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3532-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3532-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3532-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4092-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4092-50-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4092-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4092-39-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4092-47-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4388-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4388-277-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4388-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4388-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4484-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4484-84-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4484-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4484-79-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4768-294-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4768-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4768-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4768-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5536-0-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/5536-77-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/5536-315-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/5536-8-0x0000000002530000-0x0000000002596000-memory.dmp

Download

memory/5536-1-0x0000000002530000-0x0000000002596000-memory.dmp

Download

memory/6140-20-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/6140-21-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/6140-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6140-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6140-15-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download