f9f38e9c23ae71404d50ac15083d2572d13be1b239e83ac191bb5d0569fc1867

Analysis

max time kernel
148s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
Size 4.2MB
Sample260418-per38ahs4k
SHA256 f9f38e9c23ae71404d50ac15083d2572d13be1b239e83ac191bb5d0569fc1867
MD5 348b0978310f7d0be269ee91e3653eeb
SHA1 fcb8b721b44def275bc73a9e55ef632ff75f9b63
SHA512 cc9982844d0e602fe450c68177e44deafe97bb0e6f09880b7eb2ab8fad685e05ac692260a8870ab332ee83b41e18a53608887c37eb5585ebffb25ef3501ebbc0
SSDEEP 49152:vskci5+YkUkd8/7CGhBfeuQF0klCldHjQHXO+DpnXhCmnGxLhmd6LJT+Dmg27RnN:vR+JwGokcrMiLhmdEwD527BWG
TLSH
T16C164A12E73119D9C037C170A3266323BB61F99D077836E71EA85B316E68EE06E7CB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4452	alg.exe
4392	DiagnosticsHub.StandardCollector.Service.exe
712	fxssvc.exe
1596	elevation_service.exe
1912	elevation_service.exe
4108	maintenanceservice.exe
496	msdtc.exe
2148	OSE.EXE
4224	PerceptionSimulationService.exe
2872	perfhost.exe
348	locator.exe
4796	SensorDataService.exe
3464	snmptrap.exe
4872	spectrum.exe
5116	ssh-agent.exe
2736	TieringEngineService.exe
2676	AgentService.exe
1496	vds.exe
3304	vssvc.exe
4788	wbengine.exe
1780	WmiApSrv.exe
4672	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2f9d99f114bf40d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Desktop\FontSmoothing = "2"	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Desktop\FontSmoothingType = "2"	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e409a5012dcfdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b66442022dcfdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcc941002dcfdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001deda5002dcfdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052a178002dcfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030dd54002dcfdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4392	DiagnosticsHub.StandardCollector.Service.exe
4392	DiagnosticsHub.StandardCollector.Service.exe
4392	DiagnosticsHub.StandardCollector.Service.exe
4392	DiagnosticsHub.StandardCollector.Service.exe
4392	DiagnosticsHub.StandardCollector.Service.exe
4392	DiagnosticsHub.StandardCollector.Service.exe
4392	DiagnosticsHub.StandardCollector.Service.exe
1596	elevation_service.exe
1596	elevation_service.exe
1596	elevation_service.exe
1596	elevation_service.exe
1596	elevation_service.exe
1596	elevation_service.exe
1596	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1164	2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
Token: SeAuditPrivilege	712	fxssvc.exe
Token: SeRestorePrivilege	2736	TieringEngineService.exe
Token: SeManageVolumePrivilege	2736	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2676	AgentService.exe
Token: SeBackupPrivilege	3304	vssvc.exe
Token: SeRestorePrivilege	3304	vssvc.exe
Token: SeAuditPrivilege	3304	vssvc.exe
Token: SeBackupPrivilege	4788	wbengine.exe
Token: SeRestorePrivilege	4788	wbengine.exe
Token: SeSecurityPrivilege	4788	wbengine.exe
Token: 33	4672	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeDebugPrivilege	4392	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1596	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 3928	4672	SearchIndexer.exe	105
PID 4672 wrote to memory of 3188	4672	SearchIndexer.exe	106
PID 4672 wrote to memory of 828	4672	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_348b0978310f7d0be269ee91e3653eeb_akira_cobalt-strike_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4452

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4232

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4108

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2872

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:348

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3464

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1824

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3928
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3052 2972 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3188
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3032 3064 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1cfa60f6113ca1d3dd68a016f2665a41f32430d47e0551014a2dabfcb11e67b5
MD5 2f7f522630d42835e9ab3aff680ee908
SHA1 31a2819993696cc85db2e8e62d2559585fd5e6af
SHA512 75e06a91d4097750da422935429db57837c37e593bb8693c88ce7a8ab6c2fc9cbf551d99f243bd1b3a75ac03630a3dc09c24c21a4543a640458a7e2b384d0e2a
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnODmg27RnWGj:Q3q6HjBtD527BWG
TLSH
T1EFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f7ad5214f8692fe8563cf93af7792faf8374ab73f786ba9f1b0a0b29ed01e075
MD5 55aab24de86c37b16b13d7a436f9a6ea
SHA1 546fafd6e0b2d8baa879d6a735e9abf8c52a410b
SHA512 cc1085393ba27d38d01098e54bbd7dab687ee8f45dffa295a16941ed85bddf9d3db817ff6fbe67514282506f3bd5eca507eae8d1dddb832fe8404d405b04ec38
SSDEEP 24576:tXYfDtczAFsqjnhMgeiCl7G0nehbGZpbD:4tcUDmg27RnWGj
TLSH
T1B2650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 73e94cdc5fa7e8c20295d31d53fbc61f7e0ebfffa4696a788529169da95da010
MD5 0ceebc5b2ee679331318944c1eccaef1
SHA1 41401fc257997481a6599a958ca7a0ef314bc8aa
SHA512 d023d9d5d1bc0595c3f0c3f9bd3573b5b96c44f10f6274e8e57a2f5cfb760f0261216556c610d127ce63d7c0c80de437719b7c3ad26dab0492ba346bfafe09b9
SSDEEP 24576:M0Le5ji0hmxsrMSsqjnhMgeiCl7G0nehbGZpbD:MPji0ASzDmg27RnWGj
TLSH
T119859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9dab2dd1e9bc1e960ba02b454ebe223876a37b5319649c8b88ca1ad2f66a2e8e
MD5 f37cbab71a54fd60f4f07823293b8669
SHA1 7a88452f2d7d62519d10223f89eb797099d55027
SHA512 4fbd7076fd05ed8174d573c0769ea0e72d556d99cce10ec4bde07483965352bba03a891c6a1b3748104236c6ba94f8f1a090b443ca2c80a4ae7bd808fea80a82
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWE6q8wyu4sqjnhMgeiCl7G0nehbGZpbD:t/ezSC6vUzPvxHjyfDmg27RnWGj
TLSH
T19D755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 36c8b5e28665e096432698d6fafd17d9e889437e47291dcc1d48956e16da6ec3
MD5 387d5e3cece36045404f2109618b6e28
SHA1 8674137f05e498551c811b8ce69661f46fc719aa
SHA512 bd5fde638d96cad8072fad41e5fb33b04170233ac7a13e4d5af122423dbe1570a2d73e577cafd1ad114154a2a9e03d0a2536e5130db4f93fe4b6ef05c0a38d3f
SSDEEP 24576:EVbqPb88hv/l+65sqjnhMgeiCl7G0nehbGZpbD:EVO88hXl+yDmg27RnWGj
TLSH
T145559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7c75616e4c72f9bf06d1f84d4c3db2b71e0deb2d1f6b33190d647bcaaa8dd006
MD5 fe475212b14535cab641931919a37db3
SHA1 e4bd19f1a4c5c7f4fe72204f52df6bcd3178778e
SHA512 7925739f7ed5efc6da72d7b395d018ee74e0247d2209b5358ef522ab16b2beb4cfc55d1a4621091c4a7940f417572682665055a60b4b06bb82919a901b65f8d5
SSDEEP 12288:ijGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ijGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1064523BF964C50CAEB7608B5C2E9F11EAC137E56982008536A637DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d8e90ebca9c173841e4f2d60f639cd038e192c7fc8c116a560352d8b96bfe96f
MD5 c7354a1f2c02542561e47a8c53b51d49
SHA1 eba645760e61a3e9fe44e12590d9700083f121ee
SHA512 f70a2f61b3793d325631ca594ba0259f41f46b67353882cc7deb4f885ccea58b5a0dcc3031057a21fa494ec62bc87e53953695ce3679015b2433ab31eb60e760
SSDEEP 12288:weBNUbTVO86URXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:wJIURsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA65CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e102e3710b4573d3ca2dbeb025e738b4b5d19749d8abcc8c7760631df7d1ec7b
MD5 c76708d6b57ef3755cda86798c70a28e
SHA1 9f00d063226517753b6abf97579e5506aa1ab725
SHA512 84ee1c4e43c9e6b64f14801ee7c6f148ec33529f2150955832871e2e42fac0a6755dc033014e05a81a86a6d9bf93ddc0d48ca3796edfd60654613af53aeb2810
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:GQvGAdlCEL8c/yRNw5C0D527BWG
TLSH
T1EE266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4201182cbbbc8f77cec18a9f198d3193334cf4b83c5ea49f1413408122d30785
MD5 44f9b3e8c27a8acfd9f5df1b3bb06057
SHA1 ac1ced2178a8175ea5cad5b2177783bb2e967462
SHA512 b3439b3978322ba730cb61160856c7cf4d976085389d33ebbf1395c0cee2452ef58896d16aec2b2d14289e3faa99443b3e8c78da090efe517989aabaadca465e
SSDEEP 12288:PAwSfxL/2Dc3ODLLmt0LDQewsAjfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:YHewsAjfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14775E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 255988ad982cd5d563ba5839f5378598291eea476cc271429f4e68a6a2c4cf99
MD5 5bffd5dcb6cb5f88b3b51503cf4e7226
SHA1 92c02cd896e176c6786cbeda20cc43f3854e996b
SHA512 9f892c214b645845fb8a07ca4f7377b0bc300e8f015f1b5bdabf1a31a832af520d048cee6d673ddcd04db56349e8dac6be8e753600a2641f22a3e0248c25f14f
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7VQBWG:QUEtQevvqc2W1cpV2EI32SB
TLSH
T1EE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2f76a9ff0f166bfe0fb5191ece97778bbea5765b401d88a5c11979514ba669f7
MD5 0e0eb1f6c9ef8db5d5eed7a85ad7b3a7
SHA1 c02152bc35eb09f153b92a76292b93ce4ccb0dfd
SHA512 6348f7bd5814e117f21018542a4cf141fd569884bd1e0a5de50dd8f0ca83d09f2e836281ab11fa1ba000c34fd3cc5ae93313c5a014192348079b80d9e61ea3d1
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/zjDmg27RnWGj:poqtVjnmQD527BWG
TLSH
T105D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 afd3bfc96805390775c19f092d56864e57b24e1eb3f2ae6c658334e17e9a5de4
MD5 c65b429584512ee856e88be7d87a5e67
SHA1 ada411b7f531192a24a46aabd7b0e9cb86aac5bc
SHA512 bcc68e12b0122230ab5354047045c9639f0a33674d5452fe0af9c4ca82763f6489e3c8fa45fa713cdcc28183e045810d12cfb9a32319e31fd11ebe3240205566
SSDEEP 24576:uAhGLJIFoiwtA5l7S53UsqjnhMgeiCl7G0nehbGZpbD:uAMyFoiq5gDmg27RnWGj
TLSH
T1C5359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dbfcd89042790cc7812e65acde2108e14597d188ade621ae7810bd9e1e5dd3f9
MD5 a0c4ab74a9fec375a868ff0ce293f320
SHA1 cd00ae1ad129c44735db59ebc896240207f19fd7
SHA512 7abbf0b2b95839a68bd9e99a9c67de935ee806f57762d4f1c6f009ded3e1c7c8984d402c3328dccb7305c6464af44665433c8d48f5e101c498fba527e1358fef
SSDEEP 12288:1mw5HEjsChNnBFgl0WDm+CYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:wwu+OWLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B65F15A76A81CF9E9674139C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 73c14dec1ef9b642608678a8ef8a940bcfc36a02feff9491877e802b6e514097
MD5 b6d34084f67784a6cdc27ac92e64bc67
SHA1 8accc55ed980450ffe75bb03feed3ed146f47631
SHA512 ba61064b156704252edc99530fd03e7ee323a54c12f188e05b7166b3db764c4b3d316598f4cf335c8c53e25dbe8eaef5f09b35dccf94dc458b83a8475d5d1bd2
SSDEEP 12288:f3Z1IyvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vZuKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1975512AE239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a385dd3c70c22b339217020c65b1c437891c995f0b375839d98bdd373cb3e22a
MD5 2db4dedca6a34629a850ff823bf6eff1
SHA1 31a25f38746472e716194285c3ccad36381027ee
SHA512 03323641a62f9c1232531e505c2167d68633bea0b28336e7019cf7725ee91d335c462cad9abccc5492a7bedc87984fd823ce6ea012b552df12db4fc2e3a3c97f
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN3hD527BWG:rQyiKayX+PNRVQBWG
TLSH
T1DD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2a7eb8da25b50e8d0027420acab2bfbdc8d10d770d17353d647c99b005651216
MD5 7a7feb0fef96ae605d6163411cf366f3
SHA1 3b00fdd167a36f563efd77afb5cc33a988f3c424
SHA512 dbce4bb97754f302225846e4d339d76fe1f48570b3b8ed392fcdfefee2507c92763a4afa9bf455a1be2266ebcf4fa1a4d00e3e955019adfbf496cef37b1037f9
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN3hD527BWG:6QyiKayX+PNRVQBWG
TLSH
T1AA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 051b589208c420ed312b91ddf611b2dbbfcd2f63d1602b5faa6f543ea91dbfbd
MD5 dc6ce5a1d5b3765d1e80c318f549940d
SHA1 b97b24e935b602fac7712678e877d8b191b7fd51
SHA512 4dc76431e7094ff758bb8132fb9df55970b9f9c281b404445ade1ef0efddfb6c02fd4474bc7a44243a1883b7898ed7ac6a748997baa9fe9854b857acbf895f10
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06sqjnhMgeiCl7Ge:H68Qg55nhheWu7PNU3/zDmg27RnWGj
TLSH
T183B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 221dcbc72a62c1c377b636d5ae5bb4dbd1b8bb92946fae1a4e82bbf667f841aa
MD5 f161baf8f4c1dbc9829259b560313f88
SHA1 8c2091c6487c7b87626367025191060af9a45ba1
SHA512 aaede7049dba16bc8b34f6aa8a50d6d5257e663a5f1e806d1106f782af2cda7094e472f20b319285187e23c3fe5b34175073e655fb2839de0fe06955dbc7d957
SSDEEP 98304:qy5112gYy5azzVvL69nLKnhZKD527BWG:TLIHmWhIVQBWG
TLSH
T122167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 631fb90f401d3b5067525163d07304163133c102f1dedc50f66aec8d0547a903
MD5 2f0d28b8719869b1c27785784fd17437
SHA1 41604df68f544df3c83c88b825c14c5e28ff6752
SHA512 4eab0cd60aa8c5395d369d94db90f9a17c9a67f6f97c93b08e32d826f031a9d1804fa93043602036cf34a963af196ae5ded6ee207b6bfad1ff62007cb6724b55
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpDmg27RnWGj:zu6JmVxd2dpD527BWG
TLSH
T1B1D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3bc2d951de3dfa05ae3af7be413f8bc1d4db945ebaad5889103e46d120261c48
MD5 0cea0401f5406e38dd1b46c90ada29ff
SHA1 a0d1c85126aa9e344345c21c0624d18358746494
SHA512 1d40730afcea6414b69bfc2d9348866172fa4724990295086b56c9c175bc5280e3000847effdcaa475c6b63c37ca997a508e4f6a5fd78e010cad42460219e695
SSDEEP 49152:K1hpsNoJpF1A6UU44CwH7R4xFDmg27RnWGj:KmifPbRQD527BWG
TLSH
T170B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d6d0aac8cbbf056e4bbc7e2c805a90470d3930bc6c3e95b7cd439058a08fde89
MD5 2e7833ab710613b6179209e14ead5f6f
SHA1 660cdf9b46f50158b15e8a25952529a9f6fe17d1
SHA512 2e284bb4b9bd967b9237febd75922825d087697711e118b6c53fb0f4d3b54444409d9dc8fab71d21dbca817b8d60e424353955d365db75a67956c5db07e5a846
SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHqeDmg27RnWGj:l5dKTi61eD527BWG
TLSH
T1A6C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c50346df5e41e9be759ba1a5479e0b237681be48ed97ddb0de1f31658a5fb2a0
MD5 c26ef8ddbb0df6b88daea092feaa1f10
SHA1 dcecdc2353d47242bdc222280e011808cc97b1d9
SHA512 eab09d577ddf13c7ffd4d912c1791695d592b5a2e74d924ab847b66d2d95744112ec753325200fe9bcac3679e0f26b31ca72d6b13f498a3bc0baefc018239b80
SSDEEP 49152:7htSn8EApI0figngiDn0AP5w5Dmg27RnWGj:aX2iyphMD527BWG
TLSH
T1EB95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2f0c877d8eac83dd40387e241def0bdf316729b585a12812513b1448c981354a
MD5 2e7d3d8127758e03aaf84d6ea8d147ac
SHA1 7d74b6b6782e626707ed1dc509d1d9524891ec78
SHA512 28ae017ed7867e7c9eff863025499106f7a370434a06e5fb52b30a3a74124952cd8410131c52eb9a16ed5e26457d61744b40281abfad1660bc46904ad01e0d08
SSDEEP 12288:4eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4esqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BF964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 050ac9c0f6db1b1f5babbe165ba363fed96498da44cb7d4da862977535c7b647
MD5 c217660f5e49e52fc9cfe3c4adf8e1e1
SHA1 3e4cc50cc354d5de555dfb3da69019fba9a9898c
SHA512 4d17a4dccf1ddc82f4932a05b78060abcad0727444bf399ec7afcc1419be9d36a062e5170b2bcdce6bf5f9e58e1c182e39da3ffdf69115787aea5d2a8d776606
SSDEEP 12288:VTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BF964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5d7a8b052e5304a55f15a96f6244fb80ca3e86b1027b09fc0b37c5b0a913a02a
MD5 f09df87b0656e3d9f7c37e2f3086d327
SHA1 55f58c5bf67d06060bf451af19efa0da43167603
SHA512 e23d5b0baa39e614dce5539f88da4b06677d5660a1162f95ff06d7cb15ac6874acad075dd1087ea9074a2d0ae25e6d0c1e44053604ee6fb81636e2dc5a13291d
SSDEEP 12288:GpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BE964C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 19978461e9fbb88fde6011641ee57ff3d1efa2f516747b0d08f9945a1ec1156b
MD5 161311be3cc9fa76a18a6740b1d40528
SHA1 2dabc9b1f895a6e89ded81e02cab1747be9cbb1a
SHA512 c239f6e508daa7bae5c9104d001257f033d21a99939505693936ba868a6524954f6862b7424c20326f78474dc92380eebfea29cc549de81ca93990391d1324af
SSDEEP 12288:4V0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE45237F675C00CAD83685B4C2F5E11DE8237D56EB30059B6B522CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 edfe43290a461cc6353dfc9d7b4d6f56dff7144fcdb303a553d10ad611a70dab
MD5 212be996cb88e2b2b647dafebf9a70e6
SHA1 e843c686707f6dbdfa34cae01493376d46194fde
SHA512 15bff259a80ee9b6f5bb717dcd55705e8810d2150b91af296448890b30963ac06345561661eb03c74d0a5ae2ae4d902bf25e54fa06c249eaf157cfd298b67dbf
SSDEEP 12288:k8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:k8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BE964C41CAE52644B5C3E9F14DAC073E5BE92004837A9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ae79a9e243981a239a77caba3b56df1c11cc9fb3cb5125e85ec84b63aca996dc
MD5 0613494d7e61a969bb01c153ec72c57a
SHA1 b05ce436c355a3d1d3e357b9ca30d6d227733fb8
SHA512 98983bbdbe3d315df6831d66e522f201f565ff6161b64b582f93b9017f5fe5a3e34d42d200ab8b14f5531ec499fb457921524044925547f78e8dabc1272e0e89
SSDEEP 12288:Q3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BF964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 920ec291bf7009e497890fc4d0e84398370380326f86699bc8122857f1cf6e7a
MD5 ca6f1dbda07c765eeefbe93e9244de4f
SHA1 535f6650859f7273659f80c60238b170695e5ef7
SHA512 1959f784546c89a1243a688172498884120d893d57d79ad478a8bfe054ea271dbcd0f3080d936fde0e09cea9971f26d5446da0f278324dcbbfa8641a49a732d4
SSDEEP 12288:P7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE964C41CAE52644B5C3E9F15DAC073E5BE9200493BA5B7CBEF7B14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8f3ce65f3753530c6a0a892d8264e4891f0d3a7a0dba9cfe3f5763e01fd1bc0b
MD5 1ca69bb647d648645dce49c0cb655a07
SHA1 8524169c9ae72b702b4eca86f02c306979014672
SHA512 4e168bae1a354a2f7ccd1a5e9f53ab4116de68b0e89b35fd73f5d9abbda0c3290b0f8403b2e8599aee003daa4f6f5fbcd4c2580dd3d71739e598361684d9b8d6
SSDEEP 24576:TZMYzFVSOzsqjnhMgeiCl7G0nehbGZpbD:TZMYzfbDmg27RnWGj
TLSH
T1196501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8621917abebbe70f4ed6b57224f0a19c6c90d7abf76028cb2be237d1b2e03058
MD5 7bcc9e2c93ae75aeafa1fffe1a2b4950
SHA1 fa06e214720fa9b2cf403e2fec73db371553fea3
SHA512 d8f9fab6d78e51e81493389f34897f878f69269b1fb41ac2cf81bf95192e2d3f82bf5c77135951464f68e794faa653a8bcc591dd944fdc29a52dc0fb5bcaa8ae
SSDEEP 12288:qaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BF964C51CAE52604B5C3E9F14DAC073E5BE9200493BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a006ededf6758fd34053e9770438e07872faa4b51dcca3bb8dfa5e2075aadb02
MD5 253d2054049a9ee692798886806eb015
SHA1 1b4761d257522545c1efaa4426c6ca69db8b826a
SHA512 b7a8bffa08a428d723102d11b52a1674606e106c8c1940fa855bf8d1bdf6a09a5b9369052d2c944f2fdf5403a07c850aa8b4aa40aabb26feef4299441f22e4a4
SSDEEP 12288:GWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D34523BF964C41CAE52644B5C3E5F14DAC073E5BE9200493BA5B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 447537b70670b9490555a6ec98e0a1f84db2a6ee81f75b53371e6a71b5e7fe58
MD5 1339b65abac045722fc323e3a64e7f08
SHA1 89b8a9b0c7837330e21be7ae433eeb28381009ab
SHA512 4775e0d39d4dfb910a0577f4a5c3502411e7879516e4e6bd88ce07fa220b7596bc19744ee3cfc36f652d9aa7273c18186340c0f2007c6d544268e2e58ffdcab2
SSDEEP 12288:byPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WzyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17955125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d5d6af4292799cb9cea3a4837b309a0bf0833c8b6115050301ab01b77527c4ff
MD5 827df8411a05097a9a47800c208fadef
SHA1 a4a3c969c87a42289dd4fc2c74ba115158750829
SHA512 435264df95480279a8078054336ce0eb908678be9b1cf00b4cd5038e6942cf294bd6d68a304d470f0416492183a3f09d1807aaceb1cd879c3834307645d53a88
SSDEEP 12288:HaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1704523BF964C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6c9e8d32e790c612947ef9833b27c803e825acc3a3cb07749ce3510befe5f428
MD5 5237470177b26d801f45bdcc70ff81bc
SHA1 4c5fef93914e935a5005457e3cd7cfa41b1fc40e
SHA512 677320d1a276354b66ee36547fd7183548e349c052a7c058288a81c17be71bea8a8a58844e74f612ec0abef9ef22cc2dd3257dac61922a31d5b9a23945ac4958
SSDEEP 12288:xaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D14523BF964C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ae09eeca08c07d7ff0c597c7f06b35a99e293690a8a6531096e0c87c010d6e37
MD5 08f87bd063500867e31d8f8fd3b2d0f5
SHA1 9fb179a0a61418a4796f621ea153b39a0c83b8b6
SHA512 2b39beba153305e9db96a65a3a5813f1a94601ae453ac13136f07766753fa78b55024d4f10f106d638be9d6da6fcb3cf7a7dfb144d05d301c8594e7d229bc260
SSDEEP 12288:/yPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ad66f952d5d0d40124f371762af561196ce277c4f554d26a529abdfca52c9d5e
MD5 3291b695bd55382a36f4a7ad6218253d
SHA1 b74c865392d50980160369fac407c8487eae203a
SHA512 875e0b4daef268f7b1f9ae07c28845b21bad8307f22239d5f2e7c012710566f1e36bab939b56c1dbb25d9214d8b43a083f4ceb682cd8505172b831f4572029ad
SSDEEP 24576:3CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAtsqjnhMgeiCl7G0nehbGZpbD:3CUxPTY+8Wg2lIL8lrIUJLWwoDmg27RN
TLSH
T1F265AE1EA3DC0896D4BB81358A51CA06EB32782E1B3196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 006d3a95cdbacd558336a14f2e17afd357e5d90071ac1cded5af3641561d7752
MD5 e66457025bb2e59381be94a7ca621a82
SHA1 cb940fe5d62da6fc170a674daace8d1ddb4f443a
SHA512 2419a7ce6bf53875a1c53a0da501aefe0fb23a97fac8ba21be7ef72590a542d469b40d7ea7e6825096de5c3db47ff64116958cec3434dcf8c4365f3960825a25
SSDEEP 12288:SHsfKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 125f3b8db73ee0349660c884d84eef9601f75a8d9c779f0f5ff3f68549f02517
MD5 ddf482e640dfa1acc7c077df9aedd6ac
SHA1 b06fc9a94390797183642b1759be9b7886436114
SHA512 fb43b5d1787c2d0a0f7f4d0612e923d2c828434b40deedede59989471ae5b3f05da723a840ae677d0841627db27e9a3e87acf6f42e6d1e714638ee0200778688
SSDEEP 12288:9JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15245237B934C508AE57A49B482E9F12D680B7E6A9F2044C3B94738FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a84185319df34464c3899a6a7aff08767a5966d3ae472d1dbecd9e4e2280e350
MD5 7b0a7d4703092b67fa812e648bb30f4b
SHA1 8cc1858c35953979ea4824c5f2e3d9a07e28c9e1
SHA512 f78429976fd2ed1321f5b2d606d3063e270d20fc64023f174c1595c0cca7cdcba60f11accd20aad673e8e8dd54aa1549cabe44d982ce33d9b532190f4351d565
SSDEEP 24576:88RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC/sqjnhMgeiCl7G0nehbGZpbD:1RZwQCyiHiQEaaPnM2Dmg27RnWGj
TLSH
T18385B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 b0c14a23c3a852766e311b9551765498d35481795ac72d10e418931ffb2b6cdb
MD5 519a0f99eb3474501ae3666a2f8790fc
SHA1 e51d2ac9665ee8f162fcba22d40677d38b08b8ff
SHA512 f4ee1f75c6b1fdc814d0c2d8458793a33a3e1d74db99aae0905132033a702c0ce2a4261f87d93d631259a9ba81dd6c72844ff44c3ad1e7e3a6570224c67a6ea6
SSDEEP 12288:7bxA1U7KZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7bxA1UGZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D55127E629C20E5E176917D86D2C10AD7327C26672093DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c15037fb555cd3f6e8b81b2b50263515c71b6a63838797e89519499877f10222
MD5 790409e190dc7ad106417b951952cc11
SHA1 2f99b5c8aa9bd214c312fdbfbf11b85ca99d38a5
SHA512 06b084d184e036a21fc8935cebcf3bb526ec1294fb5c821e46280d0fd6b37d1169fb4308be67f5116e996c18faf645df9c5b9ef1136fc7207eae62f3edafc0ef
SSDEEP 24576:pjsmP0yHaqrVqHra44KDzMsrnEsqjnhMgeiCl7G0nehbGZpbD:pjRP0yHfVqzlAsrngDmg27RnWGj
TLSH
T11645AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ce703bc9b6e6980e6605d2478e442f1b142b36aa95e62a64bbb906c99915e569
MD5 837e50da9617ebf90b5e97d3c0791144
SHA1 bbc72e97557f1879b0ed9e6daf8c62660ef18663
SHA512 47dd4bc2f894d332115537c58e0fb4d5d9f7dc612159c2e78313df9422ef265dc5a2e13d4a02cd189771bfb1bbc9dff25c672c05debee3974b7aa9fb8befe06f
SSDEEP 12288:CXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1684523BE924C51CAE93649B5C3E9E11DA8073E16AB2004D379977CFEE7B58D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 6217a6677f8e70ce6f6d8038dd242850686c6556f7a22c20b4e15348b0ea90d8
MD5 cc8a41a361f17c38ef89d9ec7b115b15
SHA1 42e644914c949397cec4a4c1656536e8f6610d3e
SHA512 baa33900d5fb40e11d8ca490b9c064750cb5da3a0e726b4d8e7a3b425dd35551c7f6407f2d1a1d7e2c3766c423621f50f5ca1efc0ab641565fa7b15cc180b5dc
SSDEEP 12288:EObXA4LWO+vAYFTFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:pzLBUTFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T182750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3a6f5d206aa9c3ba110849a66e3b6ebf5db057246d9a3361aa7027931e2127a1
MD5 d017e343affa353e5ee49e3d5f807f53
SHA1 34f3d157d431ca5bb712d3025c13f65e46ae5c83
SHA512 05ed62e0e434b6a52738414cc34f68f97d040d524e84df08a6f921da3516f1f41c346f8fb5ca39b57e040599fa7e9ed2b5d03d2e059902d3482e06e73a4d8b91
SSDEEP 12288:/70VmJIYNvUyBpOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:opYNHgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E065E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f88d0cda78e474a8fdba439e136ace35ef4d55e85657ea612d47c03cff3158a3
MD5 e68469e2330150865d344ecd26a909ee
SHA1 bb1f6972442e58b2dc5d01bfbe5071e027d516d0
SHA512 7dbbab7053bf95ab0ccbe96ec448eef74ba8ccb783ae175457f1ef9ff96d76454942f71c2d0912920d3814744c6d0a2304760903c85f481c57ea4c91af54eda0
SSDEEP 24576:bnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKo:bnXoJJYH84VVS6AmEcJas+cHBjSSKHPW
TLSH
T1F565BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e5ba4b90e8a0df663438d5c3becb80f2b3345f246858d55f78255084b4727623
MD5 e8e687c70af0e66e4d3c520defd56120
SHA1 52776b6e39683c09a79739d32c363a378efba8e4
SHA512 cc49cdc4a4416d4764176e7c3593cca9f86c8271d8186cba3f4f63bd004163f025513ce43969ef1e0d27fd8b2549ccd699c231ee1371def38e0157da77173609
SSDEEP 24576:gv7Xbxd9Tuycf8M/TYlSuxwr2PCmsqjnhMgeiCl7G0nehbGZpbD:gDLL9TuJ0M/TYW2PLDmg27RnWGj
TLSH
T185858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 a0220dd3383d98bb43bfd949ca466b1cb01a378bc81c1be58390fd80624a64b4
MD5 ccc6f034f8ce615f62f1e4a758e49405
SHA1 84724aad7636fc2ec9a9c1dc7ba2727fa63685db
SHA512 5307ada969a1b0c1db5102623373d1960df23dee16f2e89b36b50e7896102eea97e3d42732e6c452d584ef437089fbc3fcb66745c066a8479665501e8a146a92
SSDEEP 24576:EegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wFsqjnhMgeiCl7G0nehbGZpbD:EngOJOmPOHh5Dmg27RnWGj
TLSH
T1DB55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 c5805a2b0f25111e4a99d838be9e7af1b6f802937276af5ec2ca514bb447f735
MD5 c23f26a90cf7d286f7daab60f0a0da4f
SHA1 310c41ce760f8d82eaaa67ce81a99aef18d7a068
SHA512 015760894822893c82563426170c32d76c7e7be105a8a18f6b1c8ad9c07778f22ef401890e76cf8de332bc8297f3110ec6677f3094f2b99f4d3cc5b7445bbdee
SSDEEP 24576:aLJnJiTk3R3waE4JrO3sqjnhMgeiCl7G0nehbGZpbD:aLJnJK8R304lQDmg27RnWGj
TLSH
T10275E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FD09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d34305ff89a923faa71cc1a33f7b22af2c511fae123f3fc3d1e2c02c4ae50182
MD5 e1407ed36f2b4e72143672c10d1e928c
SHA1 15de860157f879561b64ee49ef43db65a02e7577
SHA512 32b8bdbc288a2a06d4671368a5f833a5a249adb0d69158dc38b7ab177922929cbef96a57aa844a1af27785213ffba852eb6a910488ac77acd414f4800a15f3d9
SSDEEP 49152:c9GqCzDScAZmlvTcFg8Ph6vDmg27RnWGj:m8D527BWG
TLSH
T1A7955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 0d53a8c8c81e7d1c4202f1985205edfbc0e993b2d41ed297369a10c3f90b3b7d
MD5 07c6cf1ed9832ea636379a1cbf74da4e
SHA1 9f0c145ab96a3135ec3d9a8cc3e96788c39d31db
SHA512 2ae797eae31ed9a5e57426f5e18f29003e220f82b8367e5e018a71a980fa0a2e76267f3b56648d3fd31901a43c15419863300c99ac6c5cc6ce05c9b73064595d
SSDEEP 24576:ulYJeXm5jUuEVsqjnhMgeiCl7G0nehbGZpbD:ulYJeXmRUuEJDmg27RnWGj
TLSH
T15955126E669C30E5E13A8079C2E2C508E633B876671017EF65E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 0205d7400d38ffcf719a3c2372b575750649eabdeb1dbd05062da0706e85cc59
MD5 608e2fa5cee7a6764234d4a5097ab39f
SHA1 787a630f78639c950384450b8511e55858a2659b
SHA512 459dfa5c276f22f28b387fb5dd9b5ecc6730804e872d87ed8ca00bce29fe1df0bb6d3243be83d13a678807f4da37fe236e09b455e144c75e1688503a0db8844d
SSDEEP 12288:Suu6kykXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SjtyksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E6552219639860D8EA760578C6B3C158DD367C219F2042DF65E1FA3FAF72AD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f191f84b03e991f9890bf0ee293ae0982460d54801cc04f4a68a5738b123a766
MD5 8cd71ac72e525c6b0ac1c31e66d4368a
SHA1 1697dda0623ed5e0da93e53a85e3aa786ee646dd
SHA512 08eaa6f7d8d0a8439d825d3fc9b5e48e7212ffbdcf465603ec2f493a71a330b03d1a379a50fe8177543af261284787e7ad9fa2d7380dba39785b6ddf44c70ba1
SSDEEP 12288:6PFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE525C60CAD92245B4C2A5E10DA8173E36AB2014E779E7FCFDEBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c736fe91eee38db28924f4528acb1ad1debb4c588914a989986a2d040add9756
MD5 6bb998bd788b6c5f03f287f2c8b42e90
SHA1 d5595d754e23176a4c50929d404fae2951e22002
SHA512 bace5bf2073ee00996097d23d51de396989719f04829494ae3f02db2999bbed0af759c1e00eb3b7c36fbf575dfbc6f1369502f53edc0404a31aa56eb4984bf7a
SSDEEP 24576:/C+TyQIu93VAumZr7jmqsqjnhMgeiCl7G0nehbGZpbD://TfIq+Y+Dmg27RnWGj
TLSH
T132558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 15e00b181ca2f2e9cfab30b4b6abe11414a696f074f900b5fc99d8a7d7bb285d
MD5 59226d641518146be1f68bf2fb2222a3
SHA1 460d825dbcbb4e3c25470414d14faa196fa688e5
SHA512 42e2ab4deb073fa7f001fa23f3e8613feb9fbd4b421a3467ad6556fcf4e34d53037e5bd1869f0cc700d278d673383ca1ffaabe078320a1d8895a814192c75a8e
SSDEEP 12288:TcyrWOstaa3kcsBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:SLQikZBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF65F11FB3AE0095E0A7817CC8858116FA737835571163DF12A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4a1ed08b885d418831e1b996b502600fe47e949c1e924666f379c8918cc2f053
MD5 a34a529e4ffb91a2e5d9bea2b4346c6b
SHA1 74d5aa535e39223f6f0224f328c2bd4833ffd227
SHA512 18bc8ffac49af3ecbba59f4d86cdffb33269467e7000e7219429ce99796e7511990fe7ee1c80232033626711ac571edc456e29cd729cd330a1aff438bf977ba1
SSDEEP 49152:NpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPADmg27RnWm:OpC7b4+80GTknD527BWG
TLSH
T17FA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 21e53be91681665aaa0389c4118a6326b9692a0932748482be178baf388c78cb
MD5 e5558008b772408bd32a6d101710e52a
SHA1 b475d211178a4afd181c9029b974dc71ca5bfda0
SHA512 bc675b11eb885d2366af136ac51d4b0566deee97dcbdb4afa0e23ece03623e4ebbe4304e3dbcc47cf4af2d496a6aaa5dcdc3444c242c4c7a545026b4ef61b851
SSDEEP 24576:HSAwJPE1IDAo+4Kt+l44135UQcsqjnhMgeiCl7G0nehbGZpbD:HqPCIo4Kol4/QIDmg27RnWGj
TLSH
T1E055BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 767dd48071e31da3020f5c84ad9c60d05f240834367c9c7c2eab456b8d50e67e
MD5 1e94809391bfc1f4d1d497cfcd104593
SHA1 ef593c632043ca74acdc64b1bdad14ac3ff606db
SHA512 4663df5517e51a9a5bb8a3ac7712de6888317f6b71073f6b75706c0b7e1f22201ce8e8329360fd75cc9a7f82bfd3f65bac55dbde37628d9bf0be592c8e92cde8
SSDEEP 24576:7yLXPLcK94tssqjnhMgeiCl7G0nehbGZpbD:7y7Po9tYDmg27RnWGj
TLSH
T1E875D03ED76C04E5E47AC27CC2A3C506F6723CAD033166CB19A495792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 5842a9a936c541ba194c37045aada3ebcc94ce6207b944cfd6c245601acf3234
MD5 228a0e41d57dcdae6069120ba8c4471e
SHA1 fbf36081a8ff4fac420057b9274c67d76a372eca
SHA512 ba8b654c6b8a40ee7c3d11604c28027a4ff28cd4ec9c55e582d8a071f42020195d5c103a24f1e5a62a93e3fa670d0081556b9c444b7f3dc725550be702471560
SSDEEP 12288:09lyvj3IkxjbBzxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:0Wv8qjpxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD65126E529820D9E43A4674C2A6D12994337C77173459EF75C5E8BF8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/348-114-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/348-171-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/496-73-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/712-69-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/712-64-0x0000000000790000-0x0000000000B08000-memory.dmp

Download

memory/712-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1164-8-0x0000000140000000-0x000000014043E000-memory.dmp

Download

memory/1164-6-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1164-377-0x00000000021E0000-0x000000000223D000-memory.dmp

Download

memory/1164-71-0x0000000140000000-0x000000014043E000-memory.dmp

Download

memory/1164-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1164-374-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1164-384-0x0000000140000000-0x000000014043E000-memory.dmp

Download

memory/1496-159-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1496-373-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1596-131-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1596-38-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1596-33-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1596-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1780-173-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1780-578-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1912-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1912-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1912-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1912-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2148-82-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2148-76-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2148-84-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2148-158-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2676-157-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2676-156-0x00000000006B0000-0x0000000000A28000-memory.dmp

Download

memory/2676-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2736-372-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2736-151-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2872-167-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2872-107-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/2872-102-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/2872-109-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3188-432-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-435-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-390-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-389-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-388-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-391-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-393-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-392-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-425-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-426-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-427-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-428-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-429-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-430-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-431-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-434-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-424-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-433-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-436-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-439-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-449-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-447-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-446-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-450-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-448-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-445-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-444-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-443-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-442-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-441-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-440-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-438-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3188-437-0x00000184C7DD0000-0x00000184C7DE0000-memory.dmp

Download

memory/3304-488-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3304-164-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3464-121-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/3464-233-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/4108-59-0x0000000001E70000-0x0000000001ED0000-memory.dmp

Download

memory/4108-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4108-53-0x0000000001E70000-0x0000000001ED0000-memory.dmp

Download

memory/4108-65-0x0000000001E70000-0x0000000001ED0000-memory.dmp

Download

memory/4108-70-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4108-67-0x00000000015D0000-0x0000000001948000-memory.dmp

Download

memory/4224-87-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4224-162-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/4224-93-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4224-96-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/4392-23-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4392-17-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4392-16-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4392-113-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4452-13-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4452-101-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4672-184-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4672-209-0x0000000001FC0000-0x0000000001FD0000-memory.dmp

Download

memory/4672-228-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/4672-175-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4672-579-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4672-181-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4672-193-0x0000000001D10000-0x0000000001D20000-memory.dmp

Download

memory/4788-510-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4788-168-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4796-118-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4796-183-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4796-489-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4872-129-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4872-310-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4872-123-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4872-132-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5116-137-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5116-143-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5116-146-0x0000000140000000-0x00000001401A3000-memory.dmp

Download