c3baab98d474f9d0ee578f8e4f2c68b8a9c159a6000f5c404d2ffeb4c899df3c

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
Size 4.2MB
Sample260511-b4d11acy8j
SHA256 c3baab98d474f9d0ee578f8e4f2c68b8a9c159a6000f5c404d2ffeb4c899df3c
MD5 2d4f90302415e3a87e1859ff3818393b
SHA1 2df4368cbdbc4e6ef3d1b99ddccc6db226ba36b8
SHA512 27272793f301940de307f76029768829b18629edea2c33e3db2782ea2157edc826ac7689917a2af09ce4ad5e141b44bb0b750588ce78d91470b3bc8172bfb679
SSDEEP 49152:p64Ujs8amuxKl7wXEsDhpyfRBzOAtmi2ZKuhm6EQ/lFTjN4:jUjtwSfRmEuhm8Lm
TLSH
T139264B12E72151D9C069CA708327E323B771F99D27307AEB5EA44B31ADE4EE01E78B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4772	alg.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
1056	fxssvc.exe
1756	elevation_service.exe
2216	elevation_service.exe
3192	maintenanceservice.exe
2376	msdtc.exe
3308	OSE.EXE
4144	PerceptionSimulationService.exe
4940	perfhost.exe
2476	locator.exe
2484	SensorDataService.exe
1148	snmptrap.exe
1264	spectrum.exe
4372	ssh-agent.exe
5308	TieringEngineService.exe
5336	AgentService.exe
5400	vds.exe
5532	vssvc.exe
5528	wbengine.exe
5628	WmiApSrv.exe
5608	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\77c882f67932a944.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Control Panel\Desktop\FontSmoothing = "2"	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Control Panel\Desktop\FontSmoothingType = "2"	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096f03e58e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d529105fe7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b2a5958e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd8d3c58e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099655458e7e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bdd4a58e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061fc845fe7e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2968	2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
Token: SeAuditPrivilege	1056	fxssvc.exe
Token: SeRestorePrivilege	5308	TieringEngineService.exe
Token: SeManageVolumePrivilege	5308	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5336	AgentService.exe
Token: SeBackupPrivilege	5532	vssvc.exe
Token: SeRestorePrivilege	5532	vssvc.exe
Token: SeAuditPrivilege	5532	vssvc.exe
Token: SeBackupPrivilege	5528	wbengine.exe
Token: SeRestorePrivilege	5528	wbengine.exe
Token: SeSecurityPrivilege	5528	wbengine.exe
Token: 33	5608	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5608	SearchIndexer.exe
Token: SeDebugPrivilege	4736	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1756	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 5684	5608	SearchIndexer.exe	104
PID 5608 wrote to memory of 5900	5608	SearchIndexer.exe	105
PID 5608 wrote to memory of 2860	5608	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2d4f90302415e3a87e1859ff3818393b_akira_cobalt-strike_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1840

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2216

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4940

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2476

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2484

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1264

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3772

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5528

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5628

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5684
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2812 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5900
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2852 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5ce868f0f9c9c949fe06bb1284b7463ab90b227ac94705d012fc6c4282413777
MD5 1413b91923cc7bff6a759271f700fbe6
SHA1 daae1d58d44afdbce5d42eda7ad6e15510538e97
SHA512 e30b9f9a425ad1ae444a595fa356f6d69e5ee89fe6fb9cd9db90c6e169a6b1a7c2ebb70249162009878a9c5266397486e2c11ba2992c36d4e159c1651a2af5e6
SSDEEP 49152:yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTQ/lFTjN4:U3q6HjBDLm
TLSH
T14AD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ab4872cec52a352be4ea0307256f87979c3396ac6ea70d2942126ead39cddda4
MD5 958fbcec565a6163f40fb4e29568c70d
SHA1 c8494a6fc7c1691b25598209a279670690b2cd8c
SHA512 670e6eaf49b73c784326730ea249a8306a8a29c752671fede04113ded1d539267a172cd38c568d53fc56c3cbbd6584ccac59b84c207b6588dbad2647d71a770d
SSDEEP 12288:V1XLsswWkxy2lRq2czAMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:7XYfDtczAMnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1A565F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0014be065d7dafc1299158b51c46bec04524ea7130db6cb0d985090064cb96e8
MD5 dd003eaaee87691a85a039e772570f65
SHA1 ff75e382eebbb24c0d65b5eeb85439e6c32ecf31
SHA512 c5c09d03a488a99ae27bc55f50676597d89f769aafe3c14e958e42a233f80f724893c590909b7a3adca4be4fb637c9a3c5c4aa20bd6d59368f24b952ef5adb1b
SSDEEP 24576:k0Le5ji0hmxLrMrnQ/tbw/2Mkjy6Fr7g0o4:kPji0AlqQ/lFTjN4
TLSH
T1DE859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 58c2f80c39650073d21177d8d53c1536319c83e887b32aedbd511d541375e536
MD5 42a26bc242fe5aa597a8b8d91d19aa51
SHA1 68eee59006067b74eecf288575a248fa8a37e9ef
SHA512 bf8add5ca4b2837a4d3bcb219e4349073e1527a7afd5931ba9e013a9bc824abdc92ae1824d0c3285646b2f2126627cdbbcd9e71b4929311a950455a85f2708af
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyudnQ/tbw/2Mkjy6Fr7g0o0:S/ezSC6vUzPvxHjyGQ/lFTjN4
TLSH
T187755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e93476dc4c802027a00099d1aae156c2ce60a911492b751d88edef78f9aeb462
MD5 2408e779a64659edb4f9df8e86d9e407
SHA1 da16aa81b2f2b655e9754d1dbee5add60b169ccd
SHA512 0e1ded73ebb3fde8baae23bcac3ab18a692b7360abfe89b4cb6da0c1647aa20b03dbcc7435dcca12ced749194f21cb648e06a79bcdb3296695bb50d8e2f936ad
SSDEEP 24576:FVbqPb88hv/l+6gnQ/tbw/2Mkjy6Fr7g0ob:FVO88hXl+nQ/lFTjN4
TLSH
T131559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e51fdd191f9124f1c1428b5c6591e385ddc76e0ac234dec3d7a9ae03513923cb
MD5 fb9d5368dd3d03a8768ad82479dd502f
SHA1 de1dd7e28d81500df4c3987d0fc369e3e7d524ae
SHA512 fa54df41150a9e477570d3a39b7373f8a8e624f1f955bf1a938549759e06f52c952283beeaeb29c1187858dbd37270e7573df16e9f3ccc209d7ddb67a48fc88d
SSDEEP 12288:zzvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:zzPnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1925523796A24F887FF2B06B55CC28482AB7B0DC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c87edf6d6858a9fac42263e7b44e2431bea0cc2ef512cc08d791c826098eab8f
MD5 05036cee65a4abe7522cbd0479e859e1
SHA1 4aa9f2aea350d7021c86d8df41905382946b6b20
SHA512 90ebd428cf2d3f751136775caeaba016d07427dc263ae63c4a3930b9aac173a16f064b05625e35d6763654f7afa11b6922a05389db4fa7e7f33f2554967ddacb
SSDEEP 12288:veBNUbTVO86UYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:vJIUYnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T10D75CF3BAE28FCD2C27E4DB95A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9babe63f1900fa6a0a300061ea2ef447de3ac582f409e8e951e85ce778474f2a
MD5 4cbac40d76abcaaf2f09f0c9057cf808
SHA1 2a46884f690b7bdbd724b61f0dfdb0579308e207
SHA512 05656fc78b08d5e9619aa6ca9cbea728097491662fc3f51f356bb41197eae95b550fc37aab6a1a2e3abdff71d4878dfc81f53faa7ed9bb2984720b708e2406ba
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:AQvGAdlCEL8c/yRNw5CCLm
TLSH
T16D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1a7abee5a03687e814b2e45831b97b2d00e4a0f47c1a9fa935fd5e1dfd681ff6
MD5 599049daaf5ab156dd4e3378b14cb6ae
SHA1 0df1c30dbe936d5eca9ad1e5dff2c173e5b41b08
SHA512 2485fdd57f5c1e705f8d59b6455feadc0dbd4fd8a0d51fb4ebbf7211b7abef0d51b7d8219363ae5a998a5e43e0fd6ebe74a5d2ea8dd2e7bc077775c7c8464cfd
SSDEEP 12288:ZAwSfxL/2Dc39DLLmt0LDQewsAjaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgO:KQewsAjanQ/tbw/2Mkjy6Fr7g0oo
TLSH
T16D75E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8133c3969a23005dd2cf2586160061bce71290486eb756f21ec836d42cc5508b
MD5 78c5be40b63e8277192eccac1f9b67e4
SHA1 9c79caa6caf07d89e26a932dfd1778b58b8bf2d1
SHA512 c356ba8d4828b56496e5100905ad1bf9f507284d69f19ad74a2e2bc37505606c91d7447f41844ee916e56563757334f219606d650ac1647396bd6748457c04a6
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNL:CUEtQevvqc2W1cpV2EI32
TLSH
T15E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 544d50dcf754e111c4772970536c29ff11dff75e25c71aa18298cf3fde2a27cf
MD5 3aacedcc33813aae1f44bfa60e6b108c
SHA1 7790e22e0ecb9a05e04fc30abd2ededc041d869d
SHA512 32966ced6fc99579ff34d0172e50e4f7fcd709eb2f8cf5028dd4e28004de50ef515d213a0f8f8a8fbe639c0e09ac15b7fdf714c24b6ef95b844ed681ca188688
SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/z6Q/lFTjN4:NoqtVjnmOLm
TLSH
T187D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 33f7f0a3bb481ecdaf6294b96c079a51496fab1f7e8073313f953513786e2ab8
MD5 83da79c100067a1fa6b87b10b32a5df8
SHA1 75c89f579432e4a830410b3571e2f302a924e26c
SHA512 f4883d40ea8956f56f3493d1337306185051137fea7f0130024d590012d1c59d376c3847f97ef617725f7c43443378d984aae025f8d9fb80126077696ddf550e
SSDEEP 24576:MAhGLJIFoiwtA5l7S535nQ/tbw/2Mkjy6Fr7g0oY:MAMyFoiq5JQ/lFTjN4
TLSH
T13535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 be713561b6f722498b6f6f6047448c7baa4a536423b78427e4df1743d4c37bf9
MD5 335664109a5f6a63168d136ff9356a6f
SHA1 dc076f849d9e337d7c8af18056f19155bd47e918
SHA512 7bf2f9499587c4e087d1069d9df34f32266b10d9150275d45d361beeb8c13309944495b0c4243f88f962f35e8dada6b10051dec04bfe3a03c10becde414f0edb
SSDEEP 12288:bmw5HEjsChN2BFgl0WDm+CdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM4:6wuHOWmnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1E965F14A36A45CFAE96742398983C136F7B3BC422A61D71F1760C65B5F373606E2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 156b11bcea9df16947914c02f4896ddcac28590435014b32b2bf818027a2c3b9
MD5 aec901846476a4531857d903154c58dd
SHA1 ede0e1d94b43e59ab43d14a8ba074020a10f2e07
SHA512 da4fa4b3a76a50ef9c758a765b3b7299475ee4fd454a695391422f9ef628ce8e02bacc3f02e1ebcf73be7b65b9943074067b882e46e48a16f64da822a7119c86
SSDEEP 12288:gXZ1IyKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:oZuDnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T11755126933A4B0FAE6674279CCE28646E7733882677183CF275402695F3B7C11E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d4ea0914ab74de9f6c4d4b079a00f45ced6491fed9dc7e795eb3d47ada25ef90
MD5 8b4fef002eda571d86af915909f8acb9
SHA1 9f53bbdabf049b60172636676c2f755c5e7cf664
SHA512 b4e2a4b86c0671eb3b4ad12828153f8217c888b70be84013af8ecb8dacd8e0837e7e413a0eba472a3f3f6260c192c20c2df93d1ba6c0a9ae121858e86f8acce5
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:4QRQyi36YOcPQLvw2gAf+PN33Lm
TLSH
T115667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7935fa8a7086861deca9aca0d0e617bd3b2e17ab1e105f77d027fd542177e084
MD5 dae71f9d72428fb1ec47008df10620b2
SHA1 cb9d84d32d7a67368994f75da261efe205c47af6
SHA512 3160246a4600fd214f7ece656ecbb6e52445e1125f4092b1af5bbb812710e8b9d1c342f2514a1a901636fa35c970cd4fa798adc8ebc962645959ffebe5002970
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:GQRQyi36YOcPQLvw2gAf+PN33Lm
TLSH
T1C6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aef161dca66f06ddd06cfd849732ff7140a9adcbb895090fa46ac95fa8863f6b
MD5 3be15be0d0f099cf2b5e89eada0b9e18
SHA1 a070b1c69456dfb338eca0b36f737d363c82f2da
SHA512 34b059a7c3b2606c4f4a0a995dfa5bebe24e52c2a8f49f1b7508a6ed6e88d48fec7a6aead30e17314913cf865562b0c00a7e662dcfaae084a0da312fe76b6842
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0TnQ/tbw/2Mkjy6d:w68Qg55nhheWu7PNU3/qQ/lFTjN4
TLSH
T18FB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 61b43f9665bc4fcfedd4c90929be41411772bd6a76c7a9846c2e945c0b8a36eb
MD5 1d3ca1668d5e2968fe31d80a0c6eb04c
SHA1 7181c9f4c8bffdc497691a2a217b02e73029f992
SHA512 60ca71b80e603ae05d0a018603a43af5a77d77edd348a9d3f34e281905134fe9b1e266d62eb91c82eb0d2245172140c58f9ad58bcc6a16b0116581a89ae313e9
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99I:Iy5112gYy5azzVvL69nLKnhZELm
TLSH
T15B167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6b345c6a90bd7e99558153bc275fdc4073712cdea018062394503a3a93d4e763
MD5 2f9ee3a60832c8fa803cf5a8fe483b58
SHA1 d4661e976e59b17992932406117c2693cafe9fa9
SHA512 200d28504b68018158b693ff46f047c7523a7f7c0cde9808a9320a314e2c8ce91f3f6fe4ae536eda30b013f7e9742af1a6e4325eb89355a057cf7ad33b0edb68
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glcQ/lFTjN4:uu6JmVxd2d/Lm
TLSH
T13AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ced4e4c387c11191dbd783c3b272816e96838ca530da3b8246ef166ac43275c5
MD5 b80961f30f832fcf59b0a3184c834475
SHA1 e8252549fb848c74a65a0fdd37b9e32eeb0083bf
SHA512 826c7c55cd9ac8bf33e5dfd153d47772dafcb140fa7e3231cb2d4faf77a0ba5def94b88dc07ca9c5e28696dfa623a298c0f2d5dc5160e120ef6c742f240108bf
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4x4Q/lFTjN4:ImifPbROLm
TLSH
T127B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 01d351656bd57c9d198aba95ebe1d8cdb81ad06f159b36ee3102b06e7a17c2e1
MD5 72175eee60a95d1c187c2dc1cad5bd70
SHA1 7255894f8c4b804195afb0fe6c42219cbad8d127
SHA512 55ddcab42606a5611718a709cb42d37c38f0c852bad3cfee8fcacec147f31dffd7020b8813157cfb3db1d3c5447b2f3a0821312ef386fec3c75ba925580c5e1e
SSDEEP 49152:hSuZQIY0Be2KRRVtOnks6NMHqDQ/lFTjN4:v5dKTi61oLm
TLSH
T159C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0e841ddf199c4a27d69ba29a3c98afcb338ad51f55429c643adf6d928f474b72
MD5 0e7f76d5dbe61a62d361002f3fbcc938
SHA1 6cded1640ce784f7811b60f5a2ff7f1701f7735b
SHA512 1ac0654a99ff9a62bc632a2820b9ed0c5ab95be33b47a20e42e09a0d865437276085997aa16cc6730c33333a5a3a9e4a4500289b000593db3f73edf0cdd78876
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wMQ/lFTjN4:YX2iyph6Lm
TLSH
T1E695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 55312a5c3895d62007b99acf7afa301dc3906315ea96f74196b24a2ce85ec631
MD5 469b4ed9353faf9d1b5384604b5c3fe2
SHA1 07658e1d0a80721aa582027a33b5d9ed1e46f771
SHA512 b4cc89f71a61638f4e6bb84c38328f8e8123a609f4d4dc3119bbb0acb288992d0908f69698d835740a806ed847915da9028ef15d574cc27c1c1312de5127ae83
SSDEEP 12288:IHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:InnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1ED5523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b895a60b15b3e6dd04c376fbacdf4ea98b73f79afc271cdab327831b70c52973
MD5 7a33c71b610f80558f1e345644159f15
SHA1 48fbe43d0aab7139aef59a793a343ce337dd7ae2
SHA512 3e1c032bfe5af049101bf72d2fedeea417427c684d6ee3ab52a1fa7cfb3786d6d5a0957a4f424938529b768bf48b4c303af3cf9a6d74f1cba18a2bb0943f75e0
SSDEEP 12288:PuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:PunQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1705523797964F98BFA1706F58C8281829B3B0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7e019a500ab81e3a296f5a71a37e02c2d542739b02c48352745a9128bc7f49ff
MD5 8e85741083bff49d589967d43609fdf3
SHA1 123af0cb957a643468261bdd8a50a98cdef39640
SHA512 a8b328a5494ef1fc8022c7cf3ff9a2e709b901db20fbbf8f72a87d1a37fee13b9a591020d0dbe3e7c2524fb34318e11778aa11b9e96b10e607e496c6a66637f1
SSDEEP 12288:rQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:rwnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1965523787964F98BFA1706F5888381829B7B0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d0ef1c074261d8f7ad7be26857527f9a389e7380ec243664289d7f52df1e9285
MD5 c1b1cd6d309d4cc591574e5505306cdb
SHA1 242d92dff8dde8ef980cc876bdc44b32b256ba4e
SHA512 07f49bdc609fd0b16aa49c710f66eccb562d692e3cbf81277e3d86840667a73982c83be031c3e833b4757717293fd19c56dfffca7c26adc0ae86a67e9bdf7673
SSDEEP 12288:kVJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:UnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1C35523693768F4C7F92782B5CC928142E7BB3DC5BBA1938F6B00111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cd49a88bb621471e4db9be5464f4ab60a1ccfd1b378d365f2d25c0899555bea2
MD5 92a05b3ab8f89c9bfab947b64343fc5e
SHA1 9fa1a8a6756d194fd33edca8df617ff6c27dcb91
SHA512 f31f0df702081c3ad3526ffdd4fc1ff61cd2b3c2f13d5e791c468205a548c95c104c00ec26df5da011a165a4eac7e52ee2daa87d6ba22a5d57be4c6220cb596d
SSDEEP 12288:eRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:ehnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1265523797924F98BFA1706F18C8381829B7B0EC6BFD1938F77482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 925aad74e2164cf395572078afa9b22d35126a410df1ca21697f828a9dcb910e
MD5 7ec01d5411df1c286f99cf2605cd8975
SHA1 609fb1fcebc3a5bd642b72e2d96f8682a86dbf5f
SHA512 bcbf3d1c7bd0aa82036d5dfefb4d3f82420a934c6a58944a8b2a77857c18ef6cc74ef15ba82f81d5db00dd957466076e5f4dba084d7a829b6d505d93617ce625
SSDEEP 12288:IyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:IynQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T15D5523797964F98BFB2706F58C828182973B0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 76d177e1cceb8f3052d548ecf428fa5829d2384d93bd3ff79ce7088aa0a22d79
MD5 d87d704bb539f8d14ce5dd22fdf6882d
SHA1 528c57aebc186a9fce8a6fedf17943eaa64382fc
SHA512 777adf08bc2f910b4aa06056623c609cb5f0f0a6a856dc6ce7cffe1c5b82c3b2eff19989afec1b6cd4f9f3cbe61a12200086250356c6887bbe72f516682791e4
SSDEEP 12288:BWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:B2nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1BC5523797924F98BFB2706F14C8280829B7B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f6b15b9de399345fa4605142e52134c188dd57a508a9b7d78a771aadc8ded64e
MD5 d3b62e99c7155cfe76042af152ee6131
SHA1 5753ee5857cbb358c61c763aaca432fa937058fe
SHA512 578c735ad671c29035d5241b8b1afa8ea779b2b53b99b1d4c587c6b044aea234a3a16c851566dd5599518780aa0b224989719ca620bbba40e89fb564354072cb
SSDEEP 12288:iiZwbDzzFEoS2cPvyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:FZM3zFVSOOnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1A07501A5735068F9EC67827ECC518906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5d785b3121757292dc36380989b4c3bf9ba0a9d2a088d5e2b514ca875b2eef34
MD5 812a491819c1da43115b780490f1a161
SHA1 47a9f144922570bc3e1592d51e34e103a2d8239d
SHA512 6229615e6537d57f7b7cda99a5ac54884f7054cc4e00f2b5fb68101ee0e1b95dc38affe25ec2fc703c9d22c1fc27742fa3ce3cc1f2076e0e21dc50b99fe0ed85
SSDEEP 12288:xDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:xznQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1345523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ce36f787e4a21775429be8f972984b088f1aa71ad7d05750366e9afd13ee7ba3
MD5 8563bb6a6484f30bd56b85512042d0f9
SHA1 67a4bfecead3ec48329a825145dcced6da4b6ee5
SHA512 736c4c41ad3bcf196db495282fec97c0e424b3f8fe7d1fd379f13e5a21b4f505b81ac3ff8b11b5742fca0b9e7f13cc3bb9a0789aed29bf32be8c75f99122a66b
SSDEEP 12288:VfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:V/nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1C85523797964F98BFA1706F5488281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9b9ebeca8349403a0eca1d29dd199f80f619e7e96c3e66a38eda6299f27af716
MD5 c5bc24c131ec17412b7e6dfdbb7134a6
SHA1 a96e136302dc687028274fc9aaf94b60e27b8508
SHA512 c146a771fe8e0bcd704b508d5fe5fac4d33e32beafdee778860c77cfe65e87814524507df751601eb8a73a121c803d09793c6e8140d2eca9708c06d67edc147f
SSDEEP 12288:WyPz5L8KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:rzyKnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T13565021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d45a9d2592c25abdca9b0774863a811645781500cedf9a768a91be5b66c68f24
MD5 d9d3af17785ae071ac7a2c9896316467
SHA1 5ef4d8231e03ec8a2c7a1f597f6b12ee053e5d85
SHA512 1bc938678b076f3ec99dad9b4a189b1125ced96c51437e2292edd2984eb87fe1cf1155b0fefa95a6698fa5e00f56bd0306fe2b5860374ae970faaee20f0368c5
SSDEEP 12288:vDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:vznQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1EA5523797964F98BFA1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a95757fc0c5e9b51f5f696fef1288aef3ad2a0015a4655f84b06a262a21a762f
MD5 30c367eea36055cd014adbecc8ab50cc
SHA1 d467572dc5c7b263dda6442be8ed299c7c89f605
SHA512 fac54b14c2f7e7310d1fc38b83a27e31ee9bd129f3d4bd88871dd839719060d761ad011d5f7d1d5d75fe1b521b175ac8372d1ce8256f09756c803cd2ba198c53
SSDEEP 12288:bDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:bznQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1CF5523797964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fa24acb40953b23f9334f32161f9848b5618cebd70b2623f41f90f95412e841e
MD5 3b15257667fbeed6b89fc35cd0314afc
SHA1 d7e2a5a4803d4890bfdb1c91ab95c98d695463e7
SHA512 7a844ac27a5f4730c74ee540fff33226a9e7ae698732a49e15e6cc3fb39d3659b072d4b07474e7cabf0b366dd4cd0b14626bdb28ac8b6965ebb785d1ea290298
SSDEEP 12288:fyPz5L8KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:SzyKnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1D965021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 24ef899949594a2e3b77ea673e39c5c62abdfb726a072ce82904e6b37359635c
MD5 f7895b447b48623d9a3a0c7406439649
SHA1 1baa2c5e37ac73bda4ddbde83c5710dcabf25e6b
SHA512 b24d7699ee266ce0e5561e05a42fca73f2bc5bb1ac8bbec96e34dc66ac4b28b8aad3b48fada0a49c2705b090d4d743bac3d5a35c72cad9b1c7ee6427b906a2f6
SSDEEP 24576:OCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAUnQ/tbw/2Mkjy6Fr7g0oi:OCUxPTY+8Wg2lIL8lrIUJLWwhQ/lFTjG
TLSH
T1B265BE1DA3EC0896D4BB813589518A06FB72782E1B32D6CF2160C33D6F27AD55E79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8ebab4b97b301106bf9446115689c2ade85664b02cfa0d52eefa6f90163fbef7
MD5 0eb9885bb06a651e714e2e4317fc1b8a
SHA1 a926c24d3151e418f56e51bb823a0423fbc69adf
SHA512 466b0da0d48dc4c5030ef27f1ce8370eb809898996a739adfbbe0342c31d4e756df7b2b3538ddbabc0a75b5ddb6b131df0936aba425a369f9ad3c541339945a0
SSDEEP 12288:ussfTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:YDnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1A765F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 21be234bcfc82dc8b53413dfb36eb68b43a9aca13e9175a66fbac49e9c246607
MD5 5b8eb59dc8734fc67c76f366f8a23558
SHA1 8a22d6eef03975e66139fbdf7adcc87adf298664
SHA512 32e6b0f05194ea6c1c932cc15b4d4d72a969c6e0a7426ac2b7246d6740f9f899ed43d165b1ba9c5e13e9bdc253b710da1be6a131db05c9299ea54c8037e9c719
SSDEEP 12288:JwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:JQnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1B45523696668F94BFA3B06B048938111673F0EC5BF91D3CFBB042269953C3D41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 da3367679e060cc0fb0bd3d9f1b61ccdeaeafa3f6a5234bc14e76a9478651cbd
MD5 688bb950ec47ad1918452e136924e865
SHA1 0dd559fd766e23a8c314b809cd709461eb3765e3
SHA512 f205c9dd217b16aa02904a32a748ecd70cda3a03650723e341ce468264226eacec13dc44a9ba04275c2cd7cd8edcc8f3cbe3dd51bbd837d11b28b5ee101ef758
SSDEEP 24576:m8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC6nQ/tbw/2Mkjy6Fr7g0oo:fRZwQCyiHiQEaaPnMLQ/lFTjN4
TLSH
T1C085B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 61348162b9479b6cd6488f623c98a99e1add047ab751793f72791353d4735a94
MD5 eebcec1ed05a30e9d94c809c8c264fbf
SHA1 01cf7877959b3787bb214de5dbf0e494725858f9
SHA512 54429fd507b526202f76091d7bcd61a5e38cdfc1467dc537968ebb27d6c1ee3979d0ede982b635d6c677ea4a1816ac9908a058462f5bcdeb3ae3447d20283db8
SSDEEP 12288:WbxA1U7KgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:WbxA1UGAnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1A655123E26AC28E6F536967D88D28106D3327C56676193DF2184823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9927398233c3ca287e87a5754ab28d86972f6079a26ddae7a0263663be626d5a
MD5 b27362f00d6b148287a370e1b95ea5cf
SHA1 0aea9cc3e4e899281324a3c521130ac93086a1d7
SHA512 c15578cc9125609b52dc8df5605f5d745a128f0bf62f28fb57f2c6ba28dafdeb5617bc3f9a31ec978770711b2071b15fd891968e7547137913e89a37b6ee083d
SSDEEP 24576:2jsmP0yHaqrVqHra44KDzMsrnJnQ/tbw/2Mkjy6Fr7g0oa:2jRP0yHfVqzlAsrnJQ/lFTjN4
TLSH
T15545AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c096163146ef96b5b60fc83a3948ed1a713a382b0ebf1a6c3515154d158face8
MD5 f79ac4b71ee95f06b24ceeef4cddda84
SHA1 baad40dac2eecced459806d16204b532edef9f64
SHA512 72a03ad7760ccc9d7548ca132de6c8175e8d0790f54e9b52e724867876a3a7a9aeaebd4a28cb45595e3ddfaee094300c3f832ce99eef6e851a3112e14fa76360
SSDEEP 12288:rSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:rSnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1E15523787654F98BFA2706F548828142673B0EC17FD1A3CF7B482229967D3D40AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 7186b438a27b69e8b6706b68e13fb7545359ccf059be63f6b8ae3991390575cc
MD5 582648af69905504f602ae71a34c1311
SHA1 0175d059228b1f354f5545e32251aa546737fd0c
SHA512 3fa8c8d9ebaff4dd7db70c15d02e5116c6e887bd1f42136fe0eb2f80d813f9357773bd33fc57fb867e813f4381398b45eaadcac43b5e22346bc9822bf8f2fea0
SSDEEP 12288:1Ob4A4LWO+vAYFTMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:ywLBUTMnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1F175F155F7A450F9E92B813CC8A28916E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 da7e9a90a8f2f4bc1817289c0716cb928309ecbc52dfe3c521c253412e86af38
MD5 eb58ccef5921f18ec352b7a63b9af378
SHA1 0e11bf4ba04040958b28db3f06703d3fed4186fb
SHA512 58eb9c5036b376d4c4d0b98df42107a9dda2bfabc82fbb82b6a7cae1316099c48dc6ea215178859a773e047a3bb2d2844dcb1a784a4090c4fb7b7e47b530ee03
SSDEEP 12288:L70VmuIYNvUyBpXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:0KYNHFnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T19465F12E62AC1CE5E53B917D8AC38209F2737896175193CF05A0827E1F27BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7d5377a28dcd7c74e85edd95bcac2b9142acc55200c4e71a0ff803417938c36f
MD5 f51c26512935093204080185d4438bb7
SHA1 81347cb6b0bd56d3a8c964f120842f25daeb8cc3
SHA512 2a6dae86dbc833f7d0860d207ddeb3fcf9790232c07a550d398986bca90d6bac3d67bdf8e804465f61e132153819766949fac848492cdf5bfad8ff14e56767e8
SSDEEP 24576:9nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKk:9nXoJJYH84VVS6AmEcJas+cHBjSSKHPM
TLSH
T1B065BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4f8035ec1581cea9dec4ea708537f44ab59d7eac7c9e571cd720f4e2048cf79e
MD5 e8c8b0f7797519ab7a7685e9093529bf
SHA1 c1843fcf140b0ec1200136c581e0e7d17de41c68
SHA512 d1de1f53f3eb93c6170a15645c4c8a7d78624ef462888f25dd8003eb236965eb24d6276624a04da9e997c16080ce544a901f08e42333db8f1858dc2cf6ae8214
SSDEEP 24576:qv7Xbxd9Tuycf8M/TYlSuxwr2PCvnQ/tbw/2Mkjy6Fr7g0of:qDLL9TuJ0M/TYW2PyQ/lFTjN4
TLSH
T157858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 0dfd3cea8540a8389cbe9e52f8d03a838379a03539adb44073f5401fa36f5234
MD5 389f452283a12d965f1f5c681ee9cc85
SHA1 635dcf2207eeba9360c1efe5a863ae86bb9eec5d
SHA512 829dbecc825e88f98cf011405f76172539a8a315d6d1cb35576a37b0b88c7f7ad76043319a3f17a9369fbde9fbc4ac82d570b2663b3fc1bb0e5702dfe8794b70
SSDEEP 24576:fegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wMnQ/tbw/2Mkjy6Fr7g0oz:fngOJOmPOHhMQ/lFTjN4
TLSH
T14155BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 bed9c3f535ed024a92bce19e10e8039093dbecbfa83baeddee1eda48019aee6f
MD5 dbe8783d0032241645d991b04e1ee756
SHA1 1679ba1c2a98ac49906a3457cbee3d71c980d5e2
SHA512 fb4043b8ca67009916d57fc44c891a3e47d66f63e49f3952f8c8220db81712dc73df22101597ae759568e9b2f8d05c188333067cd1201f880c42fc21cfa4d79e
SSDEEP 24576:nLJnJiTk3R3waE4JrOynQ/tbw/2Mkjy6Fr7g0o8:nLJnJK8R304lZQ/lFTjN4
TLSH
T15975D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FD0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0b1fc2e71b6c45ccc1a6635d017ef16e512c41ea7a27b4d94e58212e279e8891
MD5 180931e613e271367fc1d66bfa22111f
SHA1 2379c1a633e6ccec8f0a2c2db1d000bab06e6c9b
SHA512 d55f62a5e2639da7f80c8f5c4d6b7935d759f0fb1716fd0a22d75951ef16d102584b9b2614740d6729ef4fcb0eb4d7596907342ea037be57e209340d46099de1
SSDEEP 24576:xA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pEnQ/tbw/2Mkjy6Fr7g0oi:29GqCzDScAZmlvTcFg8Ph62Q/lFTjN4
TLSH
T1C9955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 bb26120c635412692975d12c2f3a75a59b721a921e9b2dcd6099bf46ed4762ee
MD5 e53e4ee32073f36a97e50130b32613a8
SHA1 85dd18ce1c833476624f19d1640362172f766c66
SHA512 602b5ab6b3e7c2d7af113a81895265ba8ace48100398276364ef004f187edd662e18beee1aa887ec4a33f2a295da00810c13d5f368e0b4aa11a1ec687e24095e
SSDEEP 24576:vlYJeXm5jUuE8nQ/tbw/2Mkjy6Fr7g0oB:vlYJeXmRUuE8Q/lFTjN4
TLSH
T15755126D366CB0E6E22F41B988928545E372B4A1274163EF52D0C27D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 e3b5393eb9f4d24cca3e33bf82dff07ee3fda34f7f5c708c3229520b22120469
MD5 3331747aab25b8f8c5fb459d5143ac69
SHA1 6a3be263821466efa3dd45b94e6ef5cd70daeda3
SHA512 030cd7f68341936503319d80ae68c3ea4159728a34e9fb805f96c81fa3431d8f5025746ffa45b02d780897f2ea594cf4208f357f01a6144a9fc83c8a49fd8b6a
SSDEEP 12288:0Fu6kyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:0UtypnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T14165121833A4B499FA7A0678CDA38181DF3A7C50AF5093DF66C0E23E5E3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 1a2c073e10539125182b5d917cedfb48b2fef0635d5f1871cb43ed2f62b721f6
MD5 e5f72d41201d19412fd28428482d3145
SHA1 cae3a0feed8227642e6f55062487c62d7934cf2d
SHA512 d1491be4dc144bb9e3de2ab8c76bc18b3422d09f4128ebe24e5c050a48eadfba7dc0765de1f956c69615dd42efb0df105f91af84c785e97124dae86b432cf3d6
SSDEEP 12288:8PMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:sMnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1B155236C2624F89BFE2706F448924542A77B1ED17F91A3EF36846139CA7D3D016F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 364ce535741f53f4dc18ce801cabc8d49a5b819dbe7bd554b581cd979b139c68
MD5 665c90a3d2af2cbc7d855439cfb2a215
SHA1 d52d48371310ae4575bf28b509d2cb38eecc52d4
SHA512 5c578f21eeac77c073e27b98eff261314a99e33237710e61d13fbff820b9ac6348f26d4a6e7d953ec8e56c391ec2d0462337ff0f12c21db8f00d4368cee92a8f
SSDEEP 24576:mC+TyQIu93VAumZr7jmjnQ/tbw/2Mkjy6Fr7g0oL:m/TfIq+YjQ/lFTjN4
TLSH
T196558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 350e31b9451d1dcae77916170e64025e4095af3deb2d690fa9ecedba68492e8e
MD5 e70b1114003244290f1101fafdf3aa77
SHA1 6e740560f2ffbb37c261f96901168f82040abf5d
SHA512 eab775945b1758b2ce9eee2f16c3f915a0e9db57437603833ecdfa32ad1f3ec5ebae6d017259721ca185e522a3c71e7e474659702d16f10a22131713cd8bb1b2
SSDEEP 12288:BcyrWOstaa3kcsoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:0LQikZonQ/tbw/2Mkjy6Fr7g0oA
TLSH
T17D65F11FB3AA10A6E567827C88824142F7B374715752A3DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7c20db470c0e0b12a560575a9f2ea0fdde88b23aaca5afd12ddb99ba7402cb6a
MD5 30331644c7a33354a15cb158de078ef2
SHA1 ffe072fce3820049401757d4f181dedbba5cb25f
SHA512 fc8c190e3413edd2248969d41998265a0ebe36c50056ab1ddb4b6d0b29282693ad46948203303e651073202a4c65a27c57e32b08793a4ac7fe8e35f44bfa6d31
SSDEEP 49152:JpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPpQ/lFTjN4:apC7b4+80GTk5Lm
TLSH
T153A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 491948c8d5ba628233920dbe435ead3d425062908465ee4b7984b03cef9ecb8a
MD5 e4a56fefb93405f641e8d73333598196
SHA1 89a6912e2e744e840fc1cf82aff615320ae232ea
SHA512 4e00885139152e3e6ec7576a2742ae92078395284146e4b6230ac69fa5c367078b29be5ab7f75532f5c92ec4510c830ec3684a3540a43edd6073c5e2a5462abd
SSDEEP 24576:XSAwJPE1IDAo+4Kt+l44135UQBnQ/tbw/2Mkjy6Fr7g0oy:XqPCIo4Kol4/QBQ/lFTjN4
TLSH
T1DB55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 2ccefd77f0345e58a930fc0c792eb3cb7ac73c383d3ca3ea04594c879c278e84
MD5 d0b19b51cef2faf4bfb5b9733073d007
SHA1 21c069fcfea446338f51b16971775f219373fc80
SHA512 32c47b0ed0b72fbaa7d6907166ce6787198b7f0ce56a83efcd499656aa6c554c75020f1d3f792c6bf0e55a4f5167e37baebf2a0e67ef21f0ae8807fe404ff178
SSDEEP 24576:ZyLXPLcf94txnQ/tbw/2Mkjy6Fr7g0os:Zy7PoetxQ/lFTjN4
TLSH
T1C675E03EE76C08E5E53AC27CC6A38506F672389D037166CB19A491791F7BFE46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 deb3d279caaac9ef9259e8b827528139dac5e691112877a43d41faaa38eb51fb
MD5 6976b4bc4fe5ac3837f0646c3b939c8b
SHA1 deb8b6e4fbe9f5b9b2a88d8bf21dd1d29e4adff6
SHA512 1727dc9a9adf73f12d40a88946aea45ad4b84b45eba90c53474c3ec50ae9ca9086870a36ffa1e56eea768578d31133fdcf74abb559231227ff72f47677522a14
SSDEEP 12288:k9lyvj3IkxjbBz4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:kWv8qjp4nQ/tbw/2Mkjy6Fr7g0on
TLSH
T19B65126E26A4B4D9F53A4274D863815692727CB227A4A7EF32C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1056-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1148-148-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1264-363-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1264-149-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1264-117-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1264-123-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1756-33-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1756-163-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1756-39-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1756-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2216-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2216-174-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2216-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2216-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2376-83-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/2476-153-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2484-147-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2484-428-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2968-82-0x0000000140000000-0x0000000140440000-memory.dmp

Download

memory/2968-6-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/2968-365-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/2968-381-0x0000000140000000-0x0000000140440000-memory.dmp

Download

memory/2968-0-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/2968-8-0x0000000140000000-0x0000000140440000-memory.dmp

Download

memory/3192-66-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3192-55-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3192-69-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3192-61-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3192-65-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3308-73-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3308-84-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3308-79-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4144-361-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4144-92-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4144-86-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4144-95-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4372-135-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4372-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4372-129-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4736-24-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4736-16-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4736-25-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4772-14-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4772-100-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4940-106-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4940-146-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4940-101-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4940-362-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4940-425-0x0000000000810000-0x0000000000817000-memory.dmp

Download

memory/5308-151-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5336-142-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5400-364-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5400-152-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5528-426-0x00000000006D0000-0x0000000000B3C000-memory.dmp

Download

memory/5528-159-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5528-427-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5532-156-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5532-366-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5608-175-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5608-196-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5608-180-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5608-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5608-214-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5608-166-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5608-430-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5628-429-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/5628-164-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/5900-422-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-432-0x00000216DBC70000-0x00000216DC0DC000-memory.dmp

Download

memory/5900-424-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-423-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-409-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-421-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-420-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-419-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-418-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-417-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-416-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-415-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-413-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-412-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-411-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-410-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-433-0x00000216DC0E0000-0x00000216DC0F2000-memory.dmp

Download

memory/5900-414-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-434-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-435-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-436-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-438-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-440-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-439-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-441-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-444-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-447-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-448-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-450-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-449-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-446-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-445-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-442-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-443-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-451-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download

memory/5900-452-0x00000216DBB40000-0x00000216DBB50000-memory.dmp

Download