4b5123ac041cf9072e8f54032a6acb0fa6403bb9d9599a72694b286aa516123e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
Size 1.2MB
Sample261104-wr5cmsyw2m
SHA256 4b5123ac041cf9072e8f54032a6acb0fa6403bb9d9599a72694b286aa516123e
MD5 68b9464c4d398940d19587eee2b8c561
SHA1 abd73884250e2b96b39fabcb4d9d960755064ed5
SHA512 d408c10a0f3bce0cd00c173436c09eed14674c8c522b86d0f7f480fa80311381a5e0cbaa6fd13fdd8b50b47c6998aae99906dca7ac64dd7e120db624e929c0bc
SSDEEP 24576:o6BTkng4T7UXVOPsjDvfNSNVk/0gOGW9qg9sqjnhMgeiCl7G0nehbGZpbD:o6BTknHTgcPaak/07/97hDmg27RnWGj
TLSH
T15245DE2C7A80C436D0771670D65C8BA8F4B5B831867B088BB7C51A7D5B799C38A31F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2460	elevation_service.exe
5900	elevation_service.exe
5560	maintenanceservice.exe
5216	OSE.EXE
4572	PerceptionSimulationService.exe
544	perfhost.exe
4356	ReFsDedupSvc.exe
3652	SensorDataService.exe
5744	ssh-agent.exe
5568	AgentService.exe
2104	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e37b18c3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000769dafcd876cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b360930d886cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1cb95ca876cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fda8acb876cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000258f1ccd876cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed2de9ca876cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4320	2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
Token: SeTakeOwnershipPrivilege	2460	elevation_service.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5568	AgentService.exe
Token: 33	2104	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2104	SearchIndexer.exe
Token: SeDebugPrivilege	2460	elevation_service.exe
Token: SeDebugPrivilege	5900	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 5204	2104	SearchIndexer.exe	100
PID 2104 wrote to memory of 5220	2104	SearchIndexer.exe	101
PID 2104 wrote to memory of 4416	2104	SearchIndexer.exe	102
PID 2104 wrote to memory of 4168	2104	SearchIndexer.exe	103
PID 2104 wrote to memory of 1276	2104	SearchIndexer.exe	105
PID 2104 wrote to memory of 1788	2104	SearchIndexer.exe	106
PID 2104 wrote to memory of 3908	2104	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_68b9464c4d398940d19587eee2b8c561_elex_glassworm_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3652

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5744

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4168
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a5a3ca774952dbd49c51bfdc7e7925c409f2dfd55eab15f2065ddf67f758b6f5
MD5 db4cca124af9a012117b7dfd69268923
SHA1 e62b92b0d0c9ec8f9d1615ed9bcfa4864a459d2d
SHA512 5751599ec1e60a09fbe6d39e62b3c7cdc1563e3f614bbe4197fbcd467c885d31359d4075a4d0295d1af20b2521769db20b69c655c96b8d0fb56c6a088188783b
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSDmg27RnWGj:23q6sjBJD527BWG
TLSH
T17ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a5537e394c4a582c72df478ed6239ec6a26302b4baba1cf14a4669643ffc7a87
MD5 caafc75912266fe1919f37e290abb155
SHA1 33e9acf90eca267fb3f2baf920bda4e2de7c6a6c
SHA512 126625c499d73d24639df35ba11b96d4e1136772bd6315cd28ffa82f43744eeea320a7e63f52c1633c4fd1104beacbb537bab99dd4ac934be24d03bc1ef29b46
SSDEEP 24576:0XYfDtczAJsqjnhMgeiCl7G0nehbGZpbD:ztcUDmg27RnWGj
TLSH
T167650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ea2ef9bdb05c87fa8346e5b1fd5c5525964003055b34229b59e398a5e58fb865
MD5 89973c208ab70bdbcbb373976b12551f
SHA1 73020ae1fad74ab6a1ff295535b5cec00a6a414f
SHA512 8bf117376a1539839bb0d77b6651c0cf7d1f5e6afbfa1ce3c2135d076a87ed6cc370829d874557cb853b82c28c6328e65e9277a89688051465ea73e335479c8a
SSDEEP 24576:j0Le5ji0hmxxrMOsqjnhMgeiCl7G0nehbGZpbD:jPji0AjjDmg27RnWGj
TLSH
T15D859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4fd81e4115b34c1f3c1ef59e2199ac8df84ae962d83b3a116b9c967f7bf95a9d
MD5 80d3780ce12e6d5f7e67ed4dec835088
SHA1 b7c8a91c5029d57a48644f964074edd95bd0b74f
SHA512 34b49321c912045c63ece5496ea178321524cf8c6c157ba42c8dcaf047cd8c2c124aeb4fa4ead60547ad7eb9d4f4f56e60fb08fc39b04f83968ab73772da9642
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyuYsqjnhMgeiCl7G0nehbGZpbD:h/ezSC6vUzPveHjynDmg27RnWGj
TLSH
T12D755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3bb272ca8cd5d8c63f45dde7443b525a80ecedbf7e3202113ee9baa3c8a6283d
MD5 b030f7ffd50edb3c05c065a5a2cf5f94
SHA1 666c155f509e5a6ab02e4c732dc189622d8fdbe9
SHA512 01788fc25cc597a02237a3934c9078ad2e28e9c9c895c20e3f20a2516b864f05522b36c69fc5366b5c4818e9d10452814c37c0a24b11d6384da9c670b435fa34
SSDEEP 24576:8VbqPb88hv/l+YFsqjnhMgeiCl7G0nehbGZpbD:8VO88hXl+sDmg27RnWGj
TLSH
T1C8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9aa2b8332e02555095b199f12bbbb62a9a11055b6c2fc33127bc28fcaf5c393b
MD5 cc7aecf365e1e4f49538dead2945098e
SHA1 5a0c097428e30a64fc9556656c0aa04bb39dcc73
SHA512 4ca531649739b0210773c7b68178a7cc7e88ccbb0fa5051e6e8fa79145618117d57edaa54f249a94eb3da029d72404d51596fb0fbf69d98dce0215797549d3a1
SSDEEP 12288:2LKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2LKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7e65fd2acb7dfcd7d7214d4cea01acb9248c6ec1d447ea9f6a9685b132a95ef8
MD5 4648de449063e6185f06907d833d7735
SHA1 cc10ec1c7e16518ccebe43f452997991422d6ea9
SHA512 4e53782a461a44b9770ba7f5722ffeb509da5d88ea4fdca45bf6135b8549ab838057aa1089622913c0f566fe2f5d9057b47552ce5af104f2bdc7fae235275c08
SSDEEP 12288:meBNUbTVO86UNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:mJIUNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C065CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1793938d66d5d8c0dc5c92e1d1829f8be4f8f5a83652dc2c03b1fad9a9836a09
MD5 e7c40806f741ce940896abae0ea07243
SHA1 8d1ee1c6ae7d526d75ad9cf7b32db877205eb36f
SHA512 a6b87978c205a3878998b913b47ca4f6db84fffcea9f41b8576efc2cb5ebc325b05e70ec83e1ac8667d6bd92b8c4b685835b57136678180112f6b26d6215788b
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THk:dQvGAdlCEL8c/DRNw5C0D527BWG
TLSH
T100266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c41da7677325dadca030208aab25e3b5827f22901d2030ece785d2111907e5b4
MD5 a6155e881b804b01bf3c2e532485bb1f
SHA1 9c23004d088fcd9d3d16277ff90dfb6dd0c1db98
SHA512 c4c8bef768b6fc0b2f6433d348b22d64f604468ac26214a591372b5fc79a47af07f9c280fd7b72e66669504e9b400b5b66ec461eab452b3a35ae3b950ae494ec
SSDEEP 12288:BAwSfxL/2Dc3RDLLmt0LDQewsAjvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:i0ewsAjvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17575E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a91872f18ba7219322c99864c970aa2f815bb5ce0df584959394c3833b0e9dc2
MD5 d9ad505765da44364e79521f10fce04a
SHA1 db9fbb265d12214b816a64f3aa2fd815efb2c344
SHA512 ddd722ae704516f7af6281bf7866264c27b12a26aa3e8a80e02b4e04904c3c7f6e7d98377832b79a9553c0a6f017b9fd3f984b8a66f40859e3b8224463bf7fbf
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHbVQBWG:BUEtQevvqc2W1cpV2tI32yB
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2193c9413844d773117c06d8d70872f1eb9263fd28146d6288a985e4e89ee85c
MD5 2f6de3a68df388349a76c52b6bfc310b
SHA1 a23ca24d1895701c2f85b3fa32f88e26e355587c
SHA512 c46ca42f5ab1f49aaf4de18da8f286d8e9fa3834972b7d043aa4442a6d17a4f0b986b044fdb6d328cd84196f222aca084e023bdf7ea791aba1171a90ca97792d
SSDEEP 49152:jCbRquA/m2yL5zTfFiV+XenmE3/zzDmg27RnWGj:coquVjnm4D527BWG
TLSH
T18CD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 224771a9d14d08e053f77cf2280b0395368713f8d50d53aaa8571fc57e73fa2e
MD5 d5171c13fa104206102bb5777de1cca4
SHA1 114d43be8298215beb7fd8c610a2608f0440a7dc
SHA512 fb3d2276ab0dad3f21159659f1e2b8b730ef50a129ce8a6a34bd743effd886a1e23a2c464d8849a9a61e351d38d4439d6857d7723d83331395da9d808ae103b0
SSDEEP 24576:7AhGL3IFoiwtA5l7S53ssqjnhMgeiCl7G0nehbGZpbD:7AMUFoiq5oDmg27RnWGj
TLSH
T1AB359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 7d4f7416949dbcf395a5dba2e90798519de8480fd315b8a1fe9782b1ccdbedb2
MD5 168383a7199e386bef7acecf23a06715
SHA1 86dc9669585cb62ac63c04d20052197f18109e1a
SHA512 81b41a27a6b50f9e3a8522c8271e3730d8528bb465e15339ea63e182cd5fdeb3d3df80bb06c6939235e778428c739e08d260f070be4f4f4aa27537e0655496b1
SSDEEP 12288:cmw5HEjsChNVBFgl0WDm+C4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Zwu4OWDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F565F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 759e44e8c3d7f9a1cca8cffe2db6cf06554a885bdb4e75103dbc34bb347d55e6
MD5 0ce522afc6452c0e27581329f965b4b7
SHA1 a010430920a59f2b83cae631c62ea26dc68d9b0e
SHA512 a6b9bd0820a1969b737c649924f06381ddc359003502c4e2e6bae9987a8f1da9379dc1551f908f6d7342078937ba226cc6b61474fc36c5a9e5032e1d221decd9
SSDEEP 12288:7eZ1IyfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6ZuWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B5512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2c7aba69dd9fbbecb96a8d204582b30544ff6bb0697486efb8e4fdcca347708d
MD5 69bd46aef4282911c42e58f6a9df10c6
SHA1 5d5452d2a7f77515777197f7e4eeeac1293fe36c
SHA512 cf38de8f9a4be4b50f79bd2cfb0cc15650296375b29fbb03a383acb1925e818c3e1da8a5f620e11f3ff4c0df823d7b5cf63d1f73a206bb6133d9256bb3c0b1e6
SSDEEP 98304:RQRQyi36YOcPbLvw2gAf+PN3lD527BWG:IQyiKa/X+PN1VQBWG
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7d69e810ceda46945ff47ab804f2411f4a30f318bea9e09804f49af1551bf9a8
MD5 a89589131a99da340420d8ceb63eff66
SHA1 2cf2d16d7225ced3393fd66e41af14b716c73a7d
SHA512 892b7380518e880530c46171724e1d897740ee6d921831e71624cdc7309c76574dad6f909e78e7c20e6f01a2ba25fa1bfad30e7ca4a16b7e843f313416fab973
SSDEEP 98304:0QRQyi36YOcPbLvw2gAf+PN3lD527BWG:bQyiKa/X+PN1VQBWG
TLSH
T1A2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 24c210f821edbee86f5e2ac4621019bb65596063dd8a9246ba8f04c1de83050f
MD5 79b33f2362e7194b9c783dc3dd659bc4
SHA1 b927a69b5934658293772ed8c90a977995b32f5e
SHA512 6bb64f38443632e1a079506dcf933504093ae57b7fc8ad153637c9de4e6412b94bbfcddf6b9797e8193ecdeb1e5ce2d06d2c581f2d922d971f3c4c6a056e7678
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0msqjnhMgeiCl7Ge:768Qg55nhceWu7PNU3/jDmg27RnWGj
TLSH
T101B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5f1561dfaa742a2bab9cc9596023cc7824af39e6e30b2e5f6b717bf88426c258
MD5 b100cbb13878d8a2061ae52416576d95
SHA1 1e53ed089e3fd07dd5a10db025b13b148b6dee0b
SHA512 05ef1f78e3cb9b4b088322583bc95e804d6320bbf6bd4cafa586b3878cd702132b9cc75b21c80a04cb40f7822c50c49ffa78a6fea5e8562649f32268c7efa36f
SSDEEP 98304:Qy5112gYy5azzVvt69nLKnhZeD527BWG:pLIHEWhgVQBWG
TLSH
T1F6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c56c7ed9a8eeda6d3e3db90ff683e435ebe1ff0f7daf33952f1861f02b93d5a2
MD5 23eb9ed64da30af55b68205a31b93ed7
SHA1 8e0e37e88bb97b7d80674e47579be453c91e0966
SHA512 1a9d0f7681ea1af429aa4e2fd32be40cac0a5f56f2785425f7ca996c14847de0fc857dc438138860cd705c0842cb948a7537ec2b2a14221260ddb5b29081a20f
SSDEEP 49152:eB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllDmg27RnWGj:Mu6Jmdxd2dlD527BWG
TLSH
T143D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 637f90bf387a45b823fe0002045146eea6cf5530e3d65e4dbbe95018d0a01ab3
MD5 4bf625101aac5a13fd492730e116adef
SHA1 b0a5baf5042687f5ce6d05c4baf5df04118eae78
SHA512 00c7d5e6cc800274dfd63ab17f79b4f5d35c41953007d4b16f1e11b1862d47c1bc6880712062646a67d0d82d7ab62e5c90fb13675082b2cfdf4b6a8fe041a58d
SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xRDmg27RnWGj:6mifPWR4D527BWG
TLSH
T12CB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d6c55cf3ec1fbda1c42c5e9d95fb861fd2e356652c8fb3f62d0c1f47bc22a782
MD5 7ecf24087a35da701a6c6955eb90084c
SHA1 7e7c998657cf48990dae7a4a219919049a07b179
SHA512 a3d8fef11ed8383acf79b68621b05a53b4b56aaf17980981a0d2226828d0608ae43c0e2eb48fc68eef6f2f9316abaf73dca64f17b17a3f6405fa4a61eacc1c6e
SSDEEP 49152:bSuZQIY0Be2KcRVtOnks6NMHqaDmg27RnWGj:J5dKii61aD527BWG
TLSH
T1C2C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cc383428a86f3f0a7ba32d252f4864a165b2f186b9bc5f4cd3449af160034fbe
MD5 f92454dfb680d62b327e6834126d1f33
SHA1 9c87e91642e8cadc523f40d8582d0b0d46391fb9
SHA512 5a96750b87b452e9133308084fe66a6dfbeb9f35fd9e2c31dda7407e56d119eb0862a81b1a1efaf8e9335942c7bd08cdabe827263f5792b96b1e5ca7c44a494c
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wNDmg27RnWGj:aX2imphcD527BWG
TLSH
T10695BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fcfc690914fd3fa615b88ccbb6d3d942a91ff5c055c8d751b715458bb16f93d3
MD5 4227bc4feec7e289d4358ad71d1d7f68
SHA1 89c46db53d1c7578d43326f6bad236779321ab5c
SHA512 93d47ddb695a3f60b7bf0e1b1be9bd8d9a504edb78d64fadc028a7a247ab56807eb1a6df9a00e952a1daac922c629e28ffdeba2913feadcc9af9bebc309f3393
SSDEEP 12288:RSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 29866d9e6d05caca4067a95a0fb70118719b835389281b1b0a8dfe206dc95333
MD5 682c2b6cdde3eac832c5f63ec1ffc047
SHA1 2ababd355e6caaa4d5a309869b5e7f19705bcf86
SHA512 4e25d27e5014dd22b0bdcb7011e90a7db3557a542cdf8c5150daa7e788a93f1fcc30506a87ba874ece76fb5151dbe9cbbcaf710f4a971bebb634d8edebfe1d32
SSDEEP 12288:dbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BF965C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 588689f52f4d1c7ac8193d6561f903d381b242cff5b62e7da55ffed3ade79f6c
MD5 902214710c739d5a189055f65d9cd630
SHA1 993492b211588d9f50a83bec6338601863f07bf4
SHA512 3a3679929d9fa9f604bc047f6ac120f5755278849513c4431c33e1c9de803d2d1f53f10602de59a2096d547a4df4e164f991a18a2b0ba652a1a4ef88b117d4e0
SSDEEP 12288:uVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E4523BE965C41CBE52648B5C3E5F14DAC073E5BE9200493BA9B7CB9FBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 80e46ff5cb7a45771d8de64ff4ff6720f95b1899fb6baaf9a9b574d7a09ddeea
MD5 92a045b83878fe7538affffd70a2a93c
SHA1 a2ca24a7b00ffa13f6879ed84eb81ac31b2f2844
SHA512 5f5b43b177744e2c93a896a5e23a7c689997e2a65eeb78ef14724dd6648d81885d6d9b8e2a6086838fda86acafcdc4b95ddbb52af5199a14d68e265428555d3c
SSDEEP 12288:3VMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEO:SsqjnhMgeiCl7G0nehbGZpbD8
TLSH
T1A245236B575C00CAD83285B4C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 602f4bb7998af79ef733472fa4cbaba0b9122ff1d109bd47ef42202e81a2e3e8
MD5 e903e6fa81be7ffe3159b42f2e71568a
SHA1 efed62bb72c1cbbf0ce19d99c4962aed1b5414a4
SHA512 a86452963242582774616da5941963d2213e12804726cd5b4dc84a13c30268fcdd9ac51c06d367f88d6c82a7873528f6d4dcebcbd95fe4bc87fe3c396ecd79c6
SSDEEP 12288:ekXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEO:eksqjnhMgeiCl7G0nehbGZpbD8
TLSH
T1074523BF965C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CB9FBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 14d2a5fea73dd57d86888faaa49b65263263ad97f8aa05add099c75114ba2c3b
MD5 7cc314ab21f15b51ed9848bed792d760
SHA1 6fb2fa56d3b59deb65bf47800057f59812d5be2c
SHA512 56ea83ea547f25fbbbbd63b2a4ab9ba7b37667088cc7adeef0aba15fd0dc0c45d0422ebbeb008745671ca7110c9fadac093f00b79f3280ccb0cedbb8cd871901
SSDEEP 12288:J3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cbeabc39afc082cd3d204d389628ca1edaf529f5a1e1540fb62f0318106bc677
MD5 02e3af0f154acdb7ea19e096c1c7e8e5
SHA1 d65aaf13f64fb11e6c725ebf09ad3dfad0f3ce54
SHA512 48b74fd588a55953a3a5cc10d29985b72f03d1fb559aa324e9430561a5bd4ea89a9fe7fc933eea8b082a13de8bc34e3b221e6b2ba9db98cfbf17eeb7a049e8f6
SSDEEP 12288:LTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D4523BF965C41CAE62644B5C3E5F11DAC073E6BE9200493BA5BBCB9F7B14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 fe71d41c8f4a0a864f39e08d11284869747474c3b81161dce567ed57bd1df341
MD5 a002ba2ca4893bc9790f55d27c9106e6
SHA1 69542f87ef9e591f213eba76cfa6f3ebd37ec6b7
SHA512 e9f859eac089dc7f6977720be9dcc5c4d600e84f4ba959981d9f967c87961a75f1377a258a17d5fddf0b9198a74c60b7f8de5efb4aed65212408194e3032d2da
SSDEEP 24576:GZMRzFVSO7sqjnhMgeiCl7G0nehbGZpbD:GZMRzf7Dmg27RnWGj
TLSH
T1AE6501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0eef8afc5d1ca01194ef8aeac969d9afd5886d6abb318e6c2d2f61db4d08321f
MD5 800771d5013084b8790c362f8cbce97a
SHA1 c3f44f4d711341d3cabb514c7baafdb096c7159a
SHA512 4b42711c06b2f073bf1142d7641bc7f79acacfdd36f24bda185e4831f303615f38fc9e1db1bd210904cd7507a74968c305d0fec58449411d2dc28176d7c416c5
SSDEEP 12288:YGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BF965C41CAE52608B5C3E5F15DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1291052f74ae1af16e847c3a18e84962d54a6195e9166ce870223eb082efd65d
MD5 1a238287cf0053fa75be4fd0d4ddd297
SHA1 27e6091c9d8d2df9c99ec51c07ac4491c5a6e7b3
SHA512 53ba23f978f15b2d414e568cd2d08d9164ca1f807c48bf44ac01093636db2ac041024edf612c923e1c1ea22cd261b9e89f4916026db6b4b39142824a0bad30e0
SSDEEP 12288:t6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A5B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5edfc0bf1aa109b6d26f6a9737181fb0a930c6222fe724d2c60cc458b5542695
MD5 b87f041c178ba95fb5c71f5203b2d115
SHA1 1b8ebc8b39dc14ff017ed81a06d701dbd55eff71
SHA512 72ec0310ec5f0e66a9ab5274c4e8f68e27b6e27661269987bd04c6a3f99050582c5e5684a37ecaa27b0a4215c82120942cc9bfb440a506b54b9f602e752cec52
SSDEEP 12288:CyPz5L8fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fzyfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C55125B73A530F9D1378138C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 602ba23ca702b463b0274695f841116dfe8e152bfc910178b72515672f8c84e1
MD5 05d2a9b85f1bd3fb8762402e7b3801db
SHA1 8f3968ccda2e236dd3c0a2f2e3036669eb653eda
SHA512 013dd96a66e498dacf0dfb81042c9b988afa02c0a00dcccdbb9df8be3fc6b50b3a91b6fcf4a37300c100ff76110cfa4a910b0f4b9388b5defafc829e5795ece6
SSDEEP 12288:5GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E4523BF965C51CAE52608B5C3E5F14DAC073E5BA9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 285fb01a5cac790132e3d9f9deb7b520b26942320ee5bc9550485e837a982752
MD5 72857792e8540a3255c5df0382b811de
SHA1 b14d9d2a41b2c02e25123c259f6461f3555f57d7
SHA512 e7adc22f791246f1f3c9cf437eb160069b52b512b7ba996429aa2e67b69dd8f2f1f66457d15407cccb367e4ace0d89ea916d635610f72fef5daefa7d481bba9b
SSDEEP 12288:7GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D44523BF965C41CAE52608B5C3E5F14DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 41c3f914e8a85af00714d997d990883000b3889afb69990efa98064676923530
MD5 ad1af09c7073de01bee32015d531afb8
SHA1 7f64babdc87cba5d4e494082a08dfa1a6b8df226
SHA512 989f6eab4353216dcc3fac3f5ba3ea57dbf2498456e4d2d372d8cb013430ab70fa899b25718ce056ca0e9139efee546d4405338ceffe61b962109700c631fe6b
SSDEEP 12288:4yPz5L8fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZzyfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC55125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6b8c3e8676aeb17eb480af2a0cd6d1c0fbf8d9c3da3f6ec8bf90104902a7747f
MD5 7945ac9df74c450b281e485d2801591b
SHA1 48f1ce3c7530cb20aaef51a7e9a3ccc33b316bdd
SHA512 5652784c4110033eba2220a0b03ad32c8ded1199aa8084ea6d37fe174167a44b42186c99228a1819d1cf4a2e803c41e336dde0feda04bc49feba0fd828a934f0
SSDEEP 24576:rTDaLl3z0zDlsqjnhMgeiCl7G0nehbGZpbD:rTuLljEDmg27RnWGj
TLSH
T1716501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 29371fa6a0056a45b2fe0e61d089a1f67634f007c749f45b8d6235a0eb2509b7
MD5 21e4e8c4defaf8060f4b3a90490c7b50
SHA1 42ccbd5574ca34b9c691c3f8ad515706e1555cc3
SHA512 bd17b947ad5ba3ed276701e65689e92ea305b5834375bf806cbc13e6de090d28ef2bd5d4735aab0be849f4d42b01709ce6e5abf3887523edd6ff3679d68214b4
SSDEEP 24576:V3vd9CHKy7GZxsqjnhMgeiCl7G0nehbGZpbD:1vd9CHKya7Dmg27RnWGj
TLSH
T1E575CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 94b40bc925f1a384230b2788cf6c554a6b1c13d4a9665ee971a8f213358b4dcc
MD5 d56246b2abeb3d6a0614dd5ea11a5fa4
SHA1 f132f1b0fd8dd6543f445741670ada6ba547827f
SHA512 6ecf8eddb663333d9f9e6f4792eab89b815f9231db878a12c724d2a7ec997acd8d0bfaa1b01e2278667ac6e20bde9284ac4e692bc6e92bbfc9c3cbbbf13fb2a4
SSDEEP 12288:G1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1514523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CB9FBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d771d0f3686581f89db22790a7a46faa2e2155bd67e15dca858ba141530f5efd
MD5 45fc8340969dd973022ac5fc8ec9c471
SHA1 3fdf2db3fd77798290d69f3dbf17b1ee30281ba2
SHA512 5be51032a130719936ce74af2a1e2235b3d3ee40062a9db9fdbe2962c6b817fc740f8a8920aa28fcab4b705ecc8fe127a0fbe468973720d9b4b5927beb91375c
SSDEEP 12288:A/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1074523BE965C41CBE52648F5C3E5E10DAC073E6BE92004937A977CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 29bdf549d7e6033b3d2f246482c0fa4554f3d5089282477b5b440378a2e6e879
MD5 5224aeb127fad70616054cf95dbf1619
SHA1 e05a143f5ed47df550625ecd98e3359e572d9c0c
SHA512 e041673bc3f100e4232d53cf489cba5ed6abe692c8a49c6ae98bba0f5c21270da767b61c014afc3adb01b2fb6e17bf7e1bb959b47d8cc8a7af0def7a0648c8c1
SSDEEP 12288:3QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BF965C41CAE52648B5C3E5F14DAC073E5BA9200483BA977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2d52f1b779cbf97bb8647e82ad49a712d7976ea14edeb6a059c72f06e896f034
MD5 719f685c077a9d6c5a20557c84685f59
SHA1 5ee0e310e48633b0b3b4b9406e0c3ad79685b016
SHA512 00dd050cc60c5e2a28da9046528fe466ef50b99f7e0c4df34f7a8dd9f94bd37bb0fcf1de3de35ff89b533ffa8beba2f5f03f7fe76ca22c948c584f59e1f04097
SSDEEP 12288:SGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BF965C41CAE52648B5C3E5F14DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e561e6cec31935dc88c7d937631ecad39b0e4f31bb32f43509f31e11151e780a
MD5 18ef149d988996d20ec09946ba1dfd00
SHA1 6364ebe76d41eae87315de188bf7d15ab1112b49
SHA512 0a6e60605d053e847894da2ca2c83a003a39ae341325c6d948830de0baad2e76ee33cd8047c873c090cfdb0adaa731c81372f390550699a421bcf5f1eff69a9e
SSDEEP 12288:a1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1484523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b404aab35fb672a1da0e8676a0a708ae0871066578353f2bbc2d04d37f7af18d
MD5 286ff8e5491e94ef855f8632bf10a26c
SHA1 1ef47ec24cc8fabdde87516986448df20d096c03
SHA512 770455506851ef276ddfadc20b4a5af6d8a1adf0a1ad52dc94873bb858ef7449ec3f512ef2148c987255614872e7e2a34ca7db9c1e3195a5f4e362031518ee0b
SSDEEP 12288:8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8esqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BE965C41CAE62648B5C3E5F11DAC073E5BE9200483BA577CBDEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 23470cd242de07d30ac2e8308480df6ba7ec9e7e1c826cde3763836dac888210
MD5 ba12f1d08962953e8cd231da45c357b7
SHA1 7ea5cc4e76a691010b036696ffcff67498cf07cf
SHA512 0c0f28447f4bb4b3bd55ab1a9937b8cc2ca7a5d147214204ff6aaff305031a08e83ea9b5b2322e3d753fccab8578c7cb30dff3c783f5a4db58c96bcf04dafd74
SSDEEP 12288:qkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BE955C41CBE52648B5C3E5F14DAC073E6BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 01dfee4bc748bf58503208571f9d7122bc3e05f60b079086a87aa506bfbea346
MD5 5a13c948185f60a14a71331415dc16dd
SHA1 4d81196748ee34f10feac0d05d93e33e4d4dba06
SHA512 7518ad988f80a7781357f2189f68db46a47bc42a4fc4c0e6875d92b2b2839d6e7b923e6d0b8d912cc0d265983dd66c85d1330bb8d109770159aea3c85fb7cc47
SSDEEP 24576:OfwvUk9RX6wkyAIqsqjnhMgeiCl7G0nehbGZpbD:WMnYI+Dmg27RnWGj
TLSH
T1A985D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 959fe7c39cdb2ff7ce878a2c1a4b7605627b16047d5dc65001ae72ccb4c58fe5
MD5 83c577cd9d72f69b0e115eb627c19846
SHA1 8062985641095103b6d7fdcedca1178a4e8dc4af
SHA512 c5a72341fa8b70d31fcc48cbed454d897bae585702ec3b72f00750ea7eda43b5f30a93005c17f0832219dbb3e9ae5069a2fbcaf64cd34e9ac015ff34351e6d95
SSDEEP 49152:TYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tDmg27RnWGj:mySzPFD527BWG
TLSH
T15F066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0ad908db0eef05b88cabeb3b77b4f60ca440392494e22e8505a96b2f553f6dd5
MD5 26c2dbeede35523845e5c1ff55c3252d
SHA1 0fd0bd82aa992f3035f29e785386981c12b936c4
SHA512 a26f030c429e9391b22529cd4db09337ca5d4a2e6b7283e278b6281eb953b1ff6edf3dd5a3e38081658dfd706b8f4c2dd84a09df72a5f1eae2e4fd5fd25b9d6d
SSDEEP 24576:p47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYrsqjnhMgeiCl7G0nehbGZpbD:p47JUQjTirIhCnDHUPfF/dDmg27RnWGj
TLSH
T1E865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f92ce984e2fe6aa1c33b50ac6c852d90096a30aa43d9a5a6c3ef464126961aef
MD5 57f3f32c2a4fa17c64b9803e789e7c0e
SHA1 a0a482b0062a5d3ef5870c10937b89347f05a4f8
SHA512 9f890005243b107b212b8268ccc70b80bb64861d3f6b693bb31f346eeeeeef9886dffa9176cd37bcd4cc50732ac214abaf35a8cba67f3261c8ceb4811b849773
SSDEEP 12288:0bsfWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C055015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fb34bedb718e918148284973ba18ef0413bbba5a2535f8af5b319e35b35a823a
MD5 cf43bcc86796a52f8145972db6c51f00
SHA1 fbf5ab852c4d060f64f83844bb1601737fd0d013
SHA512 b416c06ff4e2e2e8399ca518672b94adbf57dd22f3fbc289749bed7b6e6c0a812537adcea313fa825678242e08773ecab128439c667dcb158bc1b973e9a2a80a
SSDEEP 12288:kcfutBqVP4qT/00clbN0r9bLWSSeIqUwMEW+:kBtu/kr0r9bprIP3E
TLSH
T1454528107626DB4FC6A940325E37C1CCAB707D41EE09AB0373C9873FD576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 b9d8b73bd553ece45abd7363a4b10a01e55bd90e6d30decd728f70852829ff45
MD5 709a41302a3e8449a27d8f2fcdf40955
SHA1 add3926a477bfc46090d2845e27155ea86764519
SHA512 5c6ebe7c8262a5953a29c493e451b96f25693076507923705a201531cb9c024e7ecb9b0ee8c07118749cadbf9a6d678be791bb5e11f8183b2330531ef979b500
SSDEEP 3:OlH/lrkQk4DT+Q3mCllltq3mCllltGlslslslslslsl67l:K+cT+imCtSmCtEEEEEEEg
TLSH
T12E81928D6B540A70CA8B2032802457840B30C08566A0C39B0288302E4C1826A8E23ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 96d67cd46cbd00f0e5a319a936b23f90a4f84cbda1f681840b49682e585e6fee
MD5 207237d931b614d8183a8b084caddd54
SHA1 f999db4545d0af3814bf068a79c12b1103776284
SHA512 de38c1c01f93f13abef9aba411234050308707de7b539244c96b29fee5138e920bf801270b584b99c777c833905e3b418815c5074221e025a53c3c35d8f916c8
SSDEEP 6144:rrOgR8QDFNSgL5nnX5RI1vI1ZI1UG0induMAc5LdKDeoH+t4GKBWw+cMGdKDeoHn:fOuFVnJVKncM7LntIRS
TLSH
T1EE45E841A536A78FD1B72031072A5F4CBBA4EC0777496F2673C9443AD86AB56B0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a12c933a80672dffa4669cd63d53358a98bd2390e7152ae9a3198cf3ee521206
MD5 f063d70c0a68e8a63c182672ff2b44f8
SHA1 8374f029e2e6eabdfe75e5edc9d15ad378c50528
SHA512 496b6a7e2f195506f6a78327af9d7656b87859b306f7f42ff860f884180a77555cbe7163db34b42c0ae35b034b869fac08cd94fa3ad2e994a85c47803f1038d8
SSDEEP 12288:f07uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:susqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE45237B935C518AF93609B482EAE12D681B7E669F1044C3B90778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 709bc3373792f9750c9582a3e13a849be68c43c51c3ca16d4c899573175b1c71
MD5 14423ba2c5053e93ac15edd987b9ed8e
SHA1 4f8d1a279b8ddcfffa22e0c04a64d248365760da
SHA512 32d8163dcd378c021a609ec2a59fa798760279b8c7f2b47ea959b163dfc3ea27011e3bc3802ee90753a11bb617999b98d03d3a086d1d4663943eb711b4280524
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYYsqjnhMgeiCl7G0nehbGZpbD:Hgb4mBIBhGFfDmg27RnWGj
TLSH
T111659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9e63f380f3bfa6803cdcb6d43269fd09eef2e0437c1bbc8e610bfae7010ab97d
MD5 19ab0c36b8eec75b747b4005cd8db5c5
SHA1 d24be25e3d51ce1ee60c4871279ea75a919773ba
SHA512 ae95c0f3388aa3689af12d61e5c65db00f7253373f28b7c27fa6c2cd3fdcccfdf3bb7a3a882d33b22c036c05f8a3e791213f0c00f9133fd99c9f58608f12e64f
SSDEEP 24576:NG88u8FpJqH1bzria7/m7sqjnhMgeiCl7G0nehbGZpbD:A7ZFPqVea7/sDmg27RnWGj
TLSH
T13C85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ca832c72c2108d281323d9e041e5762ad6c26814cf6f08eb483a71957e998613
MD5 649a32b3d16202cd41a835cdbd5d7b60
SHA1 beb1d982b45b4bdcbbf68e1f138a77978009a0d0
SHA512 63a6e66ba89ab6c64440033d8655f989528ed2bc01684ba241d713a619dc5569e297dd48c62a4159fb540366111cbec537a10f324a891faffa04f07c913f3595
SSDEEP 12288:pHvUrBFrEjwaQnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:pPUr+NQnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 949eb97385b0d931d6a67082a31e7fa6a7d652502ec8f87ca1bf8a7b2c96d30d
MD5 173cc0f6dc455d5543dd5ca28a619464
SHA1 a2948877a1e82704a292429e84cb59889e89579e
SHA512 25f71d0a2993de0e56bbffc2445444ba64d51841b9f8f46617fdcacdfeae6346201819ca2bbbf92816d98b9842cdfe5541aa10537abda3cdce1b05a114ec4b64
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLDmg27RnWGj:nG05lO43bGD527BWG
TLSH
T111D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 490e7e856a63ae5201b81c4c07e898a5dfc07758d6c1f9fb04ba607e2ed78f16
MD5 b893a69e3dbde0dafb55fa172054c3bd
SHA1 6a19b9e1641bf1995150771a3d2befdeea7e4af9
SHA512 67a173d3b066d2f20d63b97de3f39ea76ad542adc476d425b8e487a27dcf533b3b54eb6d7d9837fa28f2226ee89c2861895435450c259a857f3ea9874edcf9bc
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnpsqjnhMgeiCl7G0nehbGZpbD:0a5POZ3BJt2pasx2+mjDmg27RnWGj
TLSH
T1DB65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2fe1463b5c209cdb62a9e777158f7c042cce697eb2ea36dc2e956e54d97ca0cd
MD5 ff035942695bca9ea97f9e54edacc342
SHA1 ed1f922d4f05cf1748856eb07023195e5a9b0afc
SHA512 8c2290d6cb2ef397e8f3cd316337d44aa32366c3ea60957acde3e2689c87815bf3fceff2efbfce2c4aa70b1a7d963ca01b28bd28b6ea590475c12c461b0c99bb
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkjsqjnhMgeiCl7G0nehbGZpbD:rNc/zEOVHFMDmg27RnWGj
TLSH
T1CE857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e9aff641a7bb6654e782c6d87b192eee4a2215f3e6f61db726b5d99ee2daf44
MD5 19e4c56b5e37fe332bd56411a3500c2b
SHA1 2260e351a5ab9e372d24ad349205a63c77d6a633
SHA512 f834d714d13ff79ea760480a9e83ea6b88df59e7c5516a909dad5b185af7254618561f723892222d7578c4156766b0ce09075fb772d9c2b1535ef71f2bccac4b
SSDEEP 24576:cTkNvNnaFeYhJNtmZBmNsqjnhMgeiCl7G0nehbGZpbD:cTMwBtOmxDmg27RnWGj
TLSH
T18155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 439616d7ed5dbf2463bcbdba579da67cb017f086cd787708f1831b4620fdfb6a
MD5 d7e2654b57886e56d9301bfd8d89f24c
SHA1 d1bb2b204fd8a78c8c22f308dfbe6e32957f3a01
SHA512 e022e8ba5dccf147772d3918c2e9bcbb0c5857f85667a8465e4116261409c3a74f81f563515efe8b213d50dfe2489c639a66d69c55baf375a272f5820ebd9960
SSDEEP 24576:LD3FHshBIYQgAysqjnhMgeiCl7G0nehbGZpbD:LDVHeBIAA2Dmg27RnWGj
TLSH
T12575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-309-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/544-85-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2104-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2104-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2104-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2104-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2460-13-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2460-20-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2460-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2460-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2460-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3652-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3652-314-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3652-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3652-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3652-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3652-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4320-7-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/4320-1-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/4320-6-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/4320-44-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/4320-0-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/4356-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4356-329-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4356-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4356-89-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4356-96-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4356-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4572-73-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4572-81-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4572-295-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5216-279-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5216-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5216-69-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5216-64-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5560-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5560-60-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5560-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5560-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5560-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5568-128-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5568-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5568-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5568-136-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5568-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5744-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5744-116-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5744-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5744-122-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5900-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5900-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5900-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download