91829aa51bf535cc27f0e808ba2688a41192f11287d68604b7eac3838c940367

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 6.4MB
Sample261002-tmn4razse1
SHA256 91829aa51bf535cc27f0e808ba2688a41192f11287d68604b7eac3838c940367
MD5 3e77721a9dfb577f29f410b1029904cc
SHA1 37c865f5b3b2ba8a56038a56c9d6e541f2dc6c57
SHA512 3e8b89d6d4e7d5f816d28c69320dc496612b5366c152b70c0b1cc98ab8b458154d6427e42b9b76a4be4d44e7031b666ea635d501b433d891eba3721217fb791c
SSDEEP 98304:V/6jhdlGrkgTGLnAOKIG/R2/2AtU023W:Qjro+9tG/RUZp4W
TLSH
T1C4665B027F8A59EAC19CC874C34B8B934A2270CB1A37FABF06C545253F696B55F2C359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1188	elevation_service.exe
5924	elevation_service.exe
4884	maintenanceservice.exe
1864	OSE.EXE
1744	PerceptionSimulationService.exe
3280	perfhost.exe
5752	ReFsDedupSvc.exe
5112	SensorDataService.exe
4956	ssh-agent.exe
1712	AgentService.exe
3220	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\F:\	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\445b3d6b7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3f9ca9d8852dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043b16f9d8852dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bc7c99c8852dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000988d2a9c8852dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000188bec9d8852dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd4ef4e18852dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1c5f69b8852dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ab1279d8852dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1188	elevation_service.exe
1188	elevation_service.exe
1188	elevation_service.exe
1188	elevation_service.exe
1188	elevation_service.exe
1188	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5752	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1712	AgentService.exe
Token: 33	3220	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeDebugPrivilege	3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3696	2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	1188	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 5008	3220	SearchIndexer.exe	99
PID 3220 wrote to memory of 2764	3220	SearchIndexer.exe	100
PID 3220 wrote to memory of 4628	3220	SearchIndexer.exe	101
PID 3220 wrote to memory of 2960	3220	SearchIndexer.exe	102
PID 3220 wrote to memory of 4016	3220	SearchIndexer.exe	106
PID 3220 wrote to memory of 4420	3220	SearchIndexer.exe	107
PID 3220 wrote to memory of 1300	3220	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1864

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3280

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5112

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1664 1660 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1696 1684 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1664 1660 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1696 1684 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c862742376e0c38e2dedd30d9528558a7a77e9e3c20f3f97a7952e90236fb477
MD5 cfc257405b644b241c6311421b3448ae
SHA1 432d41fb5087c5da465c62c82c401b9e7626a981
SHA512 0a04df660bc5323626ff48c9f133cfac6b5a1759ff0276234bd860e9b71d7247783eff10acd40416ae5984d7de3d10d539e8a425ea8d6afc6f867bf8bd45ac6f
SSDEEP 49152:db+632BuPkFKRrdE6ohrstBhuXjfS4LWxnce30jaNf1TWbdz:j3q60jBtU023W
TLSH
T155D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 4e448dc269056e578f532a076b104c20293d7be9b69a09122e071647b5f7d2c0
MD5 1fff7a18031d5125e7a78062a56318bd
SHA1 2b7c0956cbce081b4e473a30002ebf87d74be7c9
SHA512 0cc2ef8732858e4b1e34509827ccaa51ac63b44507a5c232f2cdde9afe80a023c109c31d1eb3a9ec1c7284076ba3c18556845c9bc804aac8abcdefb746c2a88c
SSDEEP 24576:rXYfDtczAegXe4i7ojhsP5Lgrk1TWb4AN5:utcGe30jaNf1TWbdz
TLSH
T19285F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 26905db01de2259f839ce80812ba299dcf05cbc2aa84514f599ea540dbd98c42
MD5 3641a3c062ed80b4d18f81caea5b77bc
SHA1 e4706170e447d9297e021825cb86159c715ac535
SHA512 d86fbe97bc78a3b13fb9f4ac23dcfacb74c7ddfece5d764b7fe9d843a559fc576628620fbb6d2458961bbf121a69ff8c2ab0dd549144c7cb46f24c05afd28acd
SSDEEP 24576:b0Le5ji0hmxnrMJgXe4i7ojhsP5Lgrk1TWb4AN5:bPji0Axve30jaNf1TWbdz
TLSH
T19B95AE26F6748775D073C0B9C5D2A78AED71308257308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 18cd5bfb6b2fbab300f5ccd36b86effb4d5f08a6f5d0c6213e96da2e1c6b5363
MD5 9fcb72dbda0726ed58e7a4dbc7093210
SHA1 09063669b108419878ac1b4c4f9ec7534489f632
SHA512 5a1a25cb439d7008b1f9307f5f31d200a586ffa6002a0bda9684ec45a102310feb26a0f596d745f7f3369a79f48711d2579d0c606d149030b0cc8ee26578189c
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWr6q8wyufgXe4i7ojhsP5Lgrk1TWb4AN5:F/ezSC6vUzPviHjyTe30jaNf1TWbdz
TLSH
T105756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a631f7920a63fa3afaf57abbc0f972ff2d6e941da4b87d621113f96fedb01b06
MD5 9e4807a089de1d85849f3e48490cfcc4
SHA1 9d5108a767bd0a3ea25ef72ea507ee4bcb6627bb
SHA512 26126aa5a885433db71cceb5cba88853276dc1d14b3d53757fb4b3660214bcd83d3ba44098ed86efcbb2d8c9e0ca757e59d44d1d328300e8bd52c704ae178f72
SSDEEP 24576:5VbqPb88hv/l+bagXe4i7ojhsP5Lgrk1TWb4AN5:5VO88hXl+Ze30jaNf1TWbdz
TLSH
T10F559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 e17d69b29a98b24467f06953bc58854c919ba45908f3d45663d5253c60a37b28
MD5 21e95e41ab35324d60f0070ccba22c44
SHA1 9a858fa5e01353f0b0200753d27333bcffbf5b02
SHA512 d49f4fde64978050bf7392dfcacaf95d2597215f0ce0f3280a7e0729661580bcea51ea35ef531b9d0a5202ddeb6e6488373c376af24363ce6703f6141cae9296
SSDEEP 12288:jxk0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jxlgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C06523929F5449C6E38BC3F4A0F7CB91E5E11EC071444E6B47E0FE9318BC89ADAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 53ceba3555bf7b8dd5f1bb48b0648b6cff6dcaa0d1dce9847359a81578fc2219
MD5 00d7c27d3f56fb7473f09a630c74766d
SHA1 37ead0340f48600471e779b9db0605668624f055
SHA512 578bd1b5c241f5e790efb30e575429181e147f8a5d2dd6eefc6e4f28e441f1c15c9724093a68ce81a8ac67bfa41830949f7809de5bec420b7ad74e931b34a5ee
SSDEEP 12288:HeBNUbTVO86UV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HJIUigXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15885CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 73be6cdbd502bd28f84e6553e830ccd3693a7d7b8f03f1405791d6d0f5a9fb76
MD5 d08e506b67998882cdb238afbeecf0ac
SHA1 361fb10e88c845c67517aed3f60179b55df86918
SHA512 2e20d1df92dd77b6bad241de534f023dad9a8b060776c27f96ace8a336632e4a1252408e7af21467f988f08a619563e6b74b2729e7c2e88932cf4eadcb097466
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THv:BQvGAdlCEL8c/RRNw5CmU023W
TLSH
T1D4267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 92221b84ede9b0c8ea7a8428b06f3e2132194a2b71af22d09404bde7ce387d9d
MD5 4fcebf5d0003abbe2a1f6fa891a28baf
SHA1 36cbecba1a2bda6348632d73d7c664f28d547801
SHA512 b46bf5dddbfc9a1923afde59cb404a1b94c268b15f548202e74a52679bd935feaad7d4b02f3abb5e4fa640d50b9d7f76a2122f4e5ea49f94c2735163c5c19216
SSDEEP 24576:voewsAjogXe4i7ojhsP5Lgrk1TWb4AN5:wljfe30jaNf1TWbdz
TLSH
T11285E031FE74E032C3BB0DB21B76C716546C7A604B511AC3E3E89E9E59342D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57f4e68c7b805e4be60edb8b55723c9e6ed4654ba3007b1e4ea9689b7460f4e0
MD5 5a311538f4dfe24e43fba802fef174df
SHA1 b87eb5b08993043fdd3d08968634e144ca5ba096
SHA512 368a7ba7012ea0ba2d941aff3a2bccea385b074aa23da5d522fc4c1b342c2dab59d915c3d232508d0fd163fc2b9923914b955b3641683d19e0995d5710a8d5ab
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHHp4W:pUEtQevvqc2W1cpV2RI32J4W
TLSH
T13D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 995b82df05aecece87c9c4bf945af62bb3ed967442b50831996c0ca37d4854d9
MD5 6d9799ea7f4b5d89d45f096d95ac5d16
SHA1 f436051f92e54b050a82da1a809a503b63c27c3f
SHA512 cb7ecd12151673f4e57ebc3b2077926addfa99efc83731c89dd08f89dec607273ac42de745def5dfecfa673d2820517a8ea0406877cd82e9625a1cda71d00526
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/z/e30jaNf1TWbdz:FoqtVjnmKU023W
TLSH
T195D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e1f359872aa96fbc5deb1cd33c64a30b7911a4be63e35f5d1c754dc8144a1e72
MD5 7118fbbd9cf6ef49e48a33358d05a1fb
SHA1 dd054e8e438e06b63349e3624005a32ea64c3614
SHA512 0aea650d61c9d575e294ae8436e00fffd9d6bb90ba138bf05d8e655e8b9653897098d202fc07e24fcbfcbe8e3c13691ccfa51bee4a868d823703d789dae56229
SSDEEP 24576:ZAhGL2IFoiwtA5l7S53TgXe4i7ojhsP5Lgrk1TWb4AN5:ZAM1Foiq56e30jaNf1TWbdz
TLSH
T188359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 39e4951ea8499cb77552eceac0430add98793980fbcc64d476d9eb8a4d8521a5
MD5 9466bfc8d27ed6365b1bce8cafec6384
SHA1 487578e8e05c404347e954a6a7c8425f03e3c689
SHA512 c30dd80323d6427237e8f03bdd02ca6e1dbc2f9cb03d4ebca81fe9714f71c16439343a14f7be551d2b912002163c3e3be726b5dbc8fc120bf8c6b17a1383e8cc
SSDEEP 12288:3mw5HEjsChNUBFgl0WDm+Cm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:WwulOWcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13785F14676A40CF9E5A78278C597C632F7F2BC412A21CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e34c48742c05c6e242142c325d98e9bca0f9f6aaa24f2070a3a4590eb40b3008
MD5 fa765e8f88bef02ffd74e916e268c108
SHA1 8782d4c2e66352946fa4f98a3584042011e01483
SHA512 5b4f42cd842b84de7548fe3c0ce2ca86134a3697c4080d4b01fd5a487f47dfc1d4a1936451588639ce4d0bbca36f254b8081096fd343f9777dcb5219cb4058ed
SSDEEP 12288:hJZ1Iy70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PZuxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14C75129637D420F9E2978278D4F28741E7B23882237147CF02A096A61F76ED65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 97fc5131bfd565deaf5a706daf998e445bb295a669b3a8457ce65bf69997be79
MD5 7136898f4f85b73d8e29110d0203d36c
SHA1 d77713274812ac391c599fa8d9af2a4ebf6faba2
SHA512 e5e8cc00b3b7132a96aeabf4d9bccfc8abe9e9a378fe885edc1b0bd04d94e7b6a2a0c849fe57e0832ae12d9d53fa96de74137640a4d8bcbe4afd2e38f02827e5
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UL:dQRQyi36YOcPhLvw2gAf+PN3JU023W
TLSH
T155667C03F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9e5025340df114063c2102e2475b5a7fc05a449d889d328c06bf76af6018d1ce
MD5 3f518235b7f20e5df99e471c55514af5
SHA1 103b06927e3e2a2ce8b856719fc511e0e338ec1a
SHA512 7c41e3af121035ae5bb04724f8b817f55bb665516c58abba453c32fce4b104ce7ecf99ffe51a3f4dd0801361142681d970d86446a8abf376353fb26d76fc4372
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UL:+QRQyi36YOcPhLvw2gAf+PN3JU023W
TLSH
T190667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 796c9b45e8c900d6972803c00bb87b1f79b04f0942c65d390726cdd6e806ea8a
MD5 c03f84185e9135eb9119841d944ee02c
SHA1 714f842c8b8f4b7edbe9e987b695102095ffa7ad
SHA512 89d0cc1219eb74ada09c82e89db155ff8e452f1ed3dfa54712395da5c7a6e4b1644e24dc06258248955f4420097d399e9673ce7062ef2cbfe5459955d69419c0
SSDEEP 49152:768Qg55nhceWu7PNU3/ve30jaNf1TWbdz:FthLRc/vU023W
TLSH
T1D2B54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7b4406b3333290952c85c8e5306a049fa1e4f1f28e2d4e6d7acc4d8df34b2239
MD5 320f16ac9af4ad0fd4a3a3abc1392e85
SHA1 c28f090bab8119be3fd4aa70f57eef571bf8334a
SHA512 c0aabfe8617ec79f1ef04d8ad9f7ec779c09af8352edb4531241e7a8f26f0a157fda00c3c4f4d5946beeb277f28da059aa1cb355ae4ef8abdb3f82afa794f8ef
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99p:Iy5112gYy5azzVva69nLKnhZwU023W
TLSH
T12D168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e81af8821888e7195b606110c6544e8ef4c7f928c0fb930f3f0235f6840e92e
MD5 646f484357fae3210aea7bf40e361389
SHA1 1e1d4b520fd061209584ef202dcfc0f15060d46e
SHA512 c93e205110c17d2709ebf4d9d19f797a26de38bc3b08e2c15135b8a6af3a6134b9653db63f61e5d0fa9876ab54b1cebf0fe8d8e22f186e48290015e8f2756ca9
SSDEEP 49152:sB+taZ3usBWOBr4tEG20bqx0z+n217aau1glBe30jaNf1TWbdz:mu6JmUxd2dBU023W
TLSH
T130D59D13F1DA01E8D05ED178974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b5ccc0e39b6798b00b774b42890bb3ffb9c380802dd9ca1aca50862a9b003f3f
MD5 4fabf5716f6774cbebe31e3cdaed7257
SHA1 cce9ba0347d4cc87ea52e56aaa6a6c4a8a165ba9
SHA512 e4f22e3a8f7928d53ff1ae4a01b605e03d3a2d04c503d6a24cc95c7372b7826bdc5b9b2b5cf0cb85445fb6eadbfe1adb00a467879c5e3a1e9a18131a87188835
SSDEEP 49152:F1hpsNoJpF1A6BU44CwH7R4xVe30jaNf1TWbdz:FmifPkRKU023W
TLSH
T1E7B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d767eacbe7033315daaaa79145e4967a55d7d7e16359bfd81b50b2a763d6bcdb
MD5 31f53345fb2ebc63ed6c2c9deaa79c54
SHA1 e65dfa9464d55bca755b8f034c16dae13754047e
SHA512 172740d350eec352ca05bc347a9c670afcb4fef43d9b2346e841af304e3ee6abd0a92575d1afa8c09ec09eb52240d76a125ef572a3de6be6c1b6ba58fe6df28d
SSDEEP 49152:kSuZQIY0Be2KNRVtOnks6NMHqMe30jaNf1TWbdz:25dKvi61MU023W
TLSH
T178C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 74603f8fb94f54a0ab6d9fee456fca6a09f9abf65643d9ff0e0fee53932ab18a
MD5 d2eb3bae73d91e8d54ce51f59310b43c
SHA1 5a1f3c87ecb9d62078653ec2cb3d89677aeaee62
SHA512 4e4832d1f9351e62f492e1a0473e3d3ad5d1d807bf63ac72a4d9c5e963b84128ca416b936db297b440c560660404b0c4c61c21cde09c139e06fab0203af5d501
SSDEEP 49152:ZhtSn8EApI0figXgiDn0AP5wxe30jaNf1TWbdz:oX2iyphuU023W
TLSH
T12195BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2d8519387fb7d89ddda0208b62ee54b745a690f8a1b7f8ebd5ee0e421ca1909d
MD5 6818dc12015f08326155e3f4867ef6de
SHA1 7871f45e36ac3bc5ec496ed97743944e125252dd
SHA512 0c2de28cf7e8f422cd39c1a8654b3fe8d9fb59f96a3e12c65002abac0183cdad364bb28ac97742e9a37c9321fd4d86c82c16e15f7f5f4d1b378060d659b836e5
SSDEEP 12288:3s0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3NgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T153652392AE5549C7E34BC3F0D0F787C1E5E11FC272444E6B53E0B95319BCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ee6e0e542a7b66f35285fea20f5c2426488733a850538594832c01378412c1fb
MD5 e06fc98af24d58517c5cfd5d468603fd
SHA1 724cff67ddc098d93ffe7708583a35733fc5074e
SHA512 39b229e4c693b19e8fbfbadd0039992390aac69b02e772d1f19140ee1862037a4c164bb586788b39ef4f9ac3f9fd2192d1a22f5ea47e28efb913fa4b6f85ba2a
SSDEEP 12288:Jn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:J0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AB6523A2AE5549C6E34BC3F0D0F7C7C1E5A11FC272444E6B57E0F95319BCCAA6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 6274b440d2ac0d50aba7663359353ea8e28a1fa7990333c2078f653bf5a112dd
MD5 7f3a0cf9b0d835a68c9d42343d800cfc
SHA1 ef0857838f5c06f8b4b6ee2f850b049dd3eab086
SHA512 c35020bece559bdf2a37fb4b225221e58111051731a02c9a549aa2520dffa02fedd3c34f987276ab1ed027e0b6221be25b7742972aa0b0a81f85f6d0d45fdf75
SSDEEP 12288:rd0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rKgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T118652392AE5549C6E34BC3F0D0F787C1E9E11FC272444E6B57E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 61fbacf4180e01d04e3f43f935639ba80ebd937f954a6089b13807c136a61853
MD5 c78bd55d20925f26652d350c80092e22
SHA1 8c40022c173b63f40fb4ac6b1cfa1af123190002
SHA512 22746d44768a646d9a2038bb623416d1956b719ef223fb6cb52ffb46626fd072b3f1167b50394dfa6504bbb170ecc292e182e39640c8e5c6a91522079cc6cadc
SSDEEP 12288:tVa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1386523926F9505C6E287C3F4C0F38791E6F13EC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9cca6eda55069861107599a58a1f4345fe93a57d3dc7f0fb3eaaf2a8a1887e04
MD5 5a4f74ac155f454658af82326d25f3bf
SHA1 b8dc87ce8a292a4ffb754cd66c1db1d481046bc9
SHA512 1ed8ffdb2368f278412641615fa909ccabfd711873dd2832fbfd42b3154cf24d7661bc8fb44b24662b087e71751fe2a3a3962ae3b7bbd37af967cd41fdec5c88
SSDEEP 12288:hS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B2652392AE5549C6E34BC3F0D0F787C1E9E11FC272444E6B57E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 eec545eb8f7c8347f7a915b6cffd13e2ac188c013cf64f8b27c6f28f2f2f98f4
MD5 e36ddcbe8425c2deb0c2858555eb66d5
SHA1 5fcacf32a6be4c3c3f6f6f5c31ad089a30ac430d
SHA512 f0681ca3e973e2dba7b3aaca1292d89230d7713d9531609722faf02543007f02e911fb6592431543052d545847a113df8c360c4c518df8854d00bbb043811df0
SSDEEP 12288:mT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T112652392AE5549C6E34BC3F0D0F7C7C1E5A11FC272444E6B57E0F95319BCCAA6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d6650eb755470e2b1a9656a637a7b8b8a2362a96e1b022fd6b7222da2f2ab166
MD5 680b18608637c2530eacc2140f1c05ca
SHA1 7e9e9a1f367eda3f38544bc9de514140b4863bc4
SHA512 3a1927d2982b95408ea00c48724604cd60335f7ef6a5f117237e7a0d35582e4fa88a0315a4b6d34c8445c7640c668d3ffbc301d1482025eb6c432fe44bbb6b13
SSDEEP 12288:Df0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1306523A2AE5549C6E34BC3F0D0E7C7D0E5E11FC272444E6B57E0F95329FCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 b9bfbcddbb358cee49318e72d2c76f957994ebcb3c6015d67f9e11cfba8ef432
MD5 f43bd894daa4bb6956398da62324abd2
SHA1 dc9dad30aed290eecbd1acf0a4ef2db760ba0012
SHA512 3f5c269b917bad859fc493ec15a8b128342ee61fbea724a2ab080aebd9ad059af359c6bba22140a706d50aa413811c51caa31cb9d3ce9056b67680d42979e3ae
SSDEEP 24576:QZMGzFVSOUgXe4i7ojhsP5Lgrk1TWb4AN5:QZMGzfne30jaNf1TWbdz
TLSH
T11E850195B3900CF8ED67827DC8A68A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 160fa92fe0a12d9f6887a3873f0714843a39cfa5e3c76f141ac6a8091ee637ce
MD5 99f2b17716e7221f5d6c59cde786acb1
SHA1 96df743c343f0ec5a38799e35a106375b4f997b0
SHA512 1f3e7a2ce1e685fe59557dbe06512d4c33014827e9de3aa49324b8d4f80452a007018cb9d4c1010a47428a66fd46d59c11560912372fe71321dc2aa7cb3cfd9c
SSDEEP 12288:8A0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8BgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15A652392AE5549C6E34BC3F4D0E7C7C1E9E11FC272404E6B47E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6ee40e653a12680f5092c18a4d4410ffc5dc7b8c353effbd35f7e7c9d763f485
MD5 d8382961ad644a531b4f03367ba65ead
SHA1 22a27c9776ef5bb1796ccf5aecce200071666337
SHA512 1c7a6013cd0ea27cc63df525ca5a2193620aaafda748b72c9e47ec5255321f6a1954d2da73dfcf70437dacb6ce072032cf77a82d815404dfa2aa8f752017d50e
SSDEEP 12288:/U0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10E652392AE5549C6E34BC3F0D0E7C7C1E9E11FC272404E6B57E0F95329BCC9A6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 90c65fa61fa6d46f82083c9fd563d0085157ca800d01b0106c1f247cfb0515b6
MD5 8d889c3467bbfc7daa6095fc1aa405a0
SHA1 abd64b895f4f29096b84434a78b2640b2400309c
SHA512 8f9b8f5e00feecd9b21de7343d00e441a9c3033ef5c7e518c1860cbb056093fbf1ff1d83cb0e2958488a2b78d5e7a2e58a30f594e91f92c1e25fb5fbaf944183
SSDEEP 12288:IyPz5L870DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Jzy4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14275025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 9c45a563808c8754c2f2feb6e77cf35ee8cba88dc50df5951c658573c9f81639
MD5 26b530204245b3040b4b65205dc59b9b
SHA1 ba14aa331933e5fde7ef180242e8cb34fe4114aa
SHA512 dc9e44cb8c6b1dc5f737209acea6abd0d13b6f4e817ce43e173ec5f9b2ce7ac85aa972eedbaa1f00d58753a92674ce7d2abcd4b33fbb1d5a2781cdace33074be
SSDEEP 12288:vA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T197652392AE5549C6E34BC3F0D0E7C7D1E9E11FC272444E6B47E0B95319BCC9E6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 2313f6a686f8eb02f446c0b32843703158ecf205e4c38f9726254a07c84c7cc0
MD5 bbbc8739c4d094dab5efb3cdf4d9fb19
SHA1 b58f70ada01cb7cbee549925cb6d3fd9e19c34da
SHA512 97b904a2c6a801d368a24e9fa30dc22909fa6b89bf2c88e81fb8fdc78172c296b896677ec26389e9d32fdd2dd0b75ce2b9e9ef4f95b8b29934c999703e76b293
SSDEEP 12288:kA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19F652392AE5549C6E34BC3F0D0E7C7C1E9E11FC272404E6B47E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 6732c3a26aae6a798d1f192347b845e27cdf3c46b55db04c4d3a0386b8b03980
MD5 6a8faf9332c42b56201991cc6e477ad7
SHA1 7294158d5bfe612f6b135bb431e00383375a8409
SHA512 4f87ebfcdcb3d5a23727de806f451b490c775d73e92f66537c75b186130953acfc9dd03cc6822a96d3b5bf45a8617cff94ee58b42f3a32a69605dbf27527404d
SSDEEP 12288:AyPz5L870DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xzy4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12075025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 ee0e263210fcb076115b170489783e58b791f188951d4191b24bed5401a85afc
MD5 b777f051f47136f696ffd6f76b1b6867
SHA1 f1b2679df579151b5555ddf8b1c4c0c8d26431ee
SHA512 469d6d0e26299d331f0b96b53a900c405742fc3693b3a9006905cc833d3080f162888d45ffc178de930c0b3236d7b6d9b4a35a980c3c645a9b0f4922d58edaaf
SSDEEP 24576:qT3aLl3z0zD6gXe4i7ojhsP5Lgrk1TWb4AN5:qTKLlj2e30jaNf1TWbdz
TLSH
T1B88502A5B3500CF8ED67827EC8A68A06D6F27C560760CA1F03E436675F333A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 d43258aef481ec36dca4270e92afca47cbed9e45b1caff42779b6508ebbef090
MD5 197a1bb8dba487732d6ccebb8764dc50
SHA1 9bbde7415ed1e65c3c283b416b4caee06fec953b
SHA512 93268798b5a9f717674bc5cb331c4aabe3b2e37d27b3e08f78d05f541a345d75fa987ebb6880f947539a169bc9f75a39bfae209196fe57b3d287a7d80b418005
SSDEEP 24576:S37d9CHKy7GZmgXe4i7ojhsP5Lgrk1TWb4AN5:07d9CHKyane30jaNf1TWbdz
TLSH
T10795CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 57572becb48a987df745ec496e9fb9c0098c8b5932886258b20e5a9cb633cb7e
MD5 1caef2df6c1b8f709d8bf9f5e3d9e2bd
SHA1 e5cc5fb6fafdec2e8b6e26df28078ef04274a6ca
SHA512 a8e21acc0e6eb1edf07382b85c13349c4932715d3ade14c7f9ff3283040a537a22ee8ecef2ec17cecae74bcb8e010a576bb75c0be8cfcb60ddfb0ebccfb8769b
SSDEEP 12288:T90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T179652392AE5549C6E34BC3F0D0E7C7C1E9E11FC272444E6B57E0B95319BCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 5baa6a32761d226010742bf5a3fafc16c62dbd7afc27c79914b68dcc6d0f9fa0
MD5 ac0b0d5c3f8ce03b9effc4f3305095c2
SHA1 7c9f7e47fd614fdac878073b473f8f5d39d59afd
SHA512 3d0245da4b9421ab9124eab34ff071ddaa31a6ea7538758652f9b124b65307a3004032a46fce67b363d706b3b05f87b34fc363f44655a98e41db5b62f7e313fb
SSDEEP 12288:Pb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EC6523A2AE5549C6E34BC3F0E0F7C7C1E9E11FC172414E6B57E0B95319BCC9A6E88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 07edf8769124cb3e3cb7d330b0f638efa641423e64b187d0885a9ffd5620b7eb
MD5 e1cc4df1840a48b727416f9b6a479908
SHA1 fb8b9981b5fe1808fa6e6e3aa4a600dfc379bb09
SHA512 c91ac86458f387677ad689373ef44b7592684ebaf72c2d89e2068897aca8cf813a8e006b8556cba828db6541060c244788e4cecf7c75a8a11f5471ecccd27f30
SSDEEP 12288:Ve0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D56523A2AE5549C6E34BC3F0D0E7C7D1E9E11FC272414E6B47E0B9531DBCC9A6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 fc4bfeafdf11c10daf26af31c378be9523008e3fa955fbe0cac6939b34f3aae8
MD5 6378aaf37e156fa557a5d8d0c3f8112f
SHA1 7b961b6d22fde41bdafe506b2b6f4386e331bf2f
SHA512 eb587d75f61215a00eba6599c6dfe82cc49999319557aff7f4f52e179ece71504df44f63ce4f07566297252520bea7568e536fab94521b751985fbdd6d252f7f
SSDEEP 12288:6A0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6BgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10D652392AE5549C6E34BC3F4D0E7C7C1E9E11FC272404E6B47E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 422569002a4a16240d8dab949be24d16086c625d6a8cdbe171f79f0ae433b971
MD5 84606a6836631ff3472b54bac16a3e9d
SHA1 702654d5217ab221a89ba9d65500e2f1a4554edb
SHA512 408059d27d98d1cbc9bc9cb3fb2d25fcb32a581a4204494a5d752e44e3123db94f828afadcbb1c4e35015a1aadae65f1ad95e8fbc9cb0a0db05ccc19592eec23
SSDEEP 12288:O90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17B652392AE5549C6E34BC3F0D0F787C1E5E11FC272444D6B57E0B9531DBCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 50b813cdd127a8a5da1f2e8cd8e95f471d83c2df3b42e087346cb5573efd6fa8
MD5 a23f9d8b80b7b36852c3e14e5949138c
SHA1 0acd57c2d475176fdc55f43c4b0aec94dbd50223
SHA512 4ed45ca34d9a4c0204bf1d66c08e87496754efc7d27bb943efb8eb11e91227841ab5f03271772a706c665e5e5e2406f811283e9b6f1550bfc1ceb83e479de752
SSDEEP 12288:A40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:A5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10D6523A2AE5509C6E34BC3F0D0E7C7D1E9E11FC272454E6B47E0BA531DBCC9A5A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 33634afeb8b85d35aad714cb45430f93481905cae7ce46c2a48a89ac110ae482
MD5 b78c21192584e3b5dbfa5c14c7b3d745
SHA1 73232cfd6b3404761f531f11056d2582a2434a5c
SHA512 02eadccba00072cd29c9aa6bc220376dd9d47cf5ef7fb2dc25d2ee9e1e9b9689e0449345c0011a10cab4fd83f74e2a4f6e1d7b7277998cc73b8a8edd53c40778
SSDEEP 12288:kS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T190652392AE5549C6E34BC3F0D0E787D1E9E11FC272444D6B47E0B9531DBCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 c31563b32a29e59f6314e38c76ba3cbf862623eeeb8711c8ddfa8e360d664061
MD5 e08e1534d0f4248007ae8e57de4172c0
SHA1 e8af63760379bf731e30a23e3aadbc2dd791af46
SHA512 bd6805861412169b00fb075a63573e49a896d7ebdf3ce48402ba098e9fe87942407303fac6898f3fa51a6195b68f73faa5e58b91c239532f27b7d62076f62d2d
SSDEEP 24576:qfwvyk9RX6wkyAIFgXe4i7ojhsP5Lgrk1TWb4AN5:EMnYIQe30jaNf1TWbdz
TLSH
T1DB95D029EBD804D5E1B7923C99F3460AF6B178591B31C6CF029953AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eb6b233afc4b78d1d32b11c0bd4f50c0f935730d943f6738468b590a48b172c9
MD5 007e5abe22ffa9d8bb80845d3981532c
SHA1 d59b08b7fb13f2103978d08fa152d7e586b0ddf1
SHA512 cf42ef54068424fb4f00fc2f70795b123209401324bad6785fff3c837be49f83da9e9d7c5e9b49eba291ce117c66b5d187da34c10e3ffdb4d0a36e9eca5a32c7
SSDEEP 49152:nYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Re30jaNf1TWbp:xySzPpU023W
TLSH
T1E4067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ccd066cecf9ec90f1cc98a55460d17d286244232998698834d62797cbbe59cef
MD5 76e9a1534a2551e51da7b1e7d696d899
SHA1 37a6c5420c0daaaec7c701c7c57ab4044b126b5f
SHA512 14c5eb1a0bd5fd5cb3debc1698fc499728dc59c109a4cd8fabc913e1f4e7eb9e7d47a3e52c5bb5de42434f00588dab4080d16353719e3cfce927b94c8509ea35
SSDEEP 24576:R47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYkgXe4i7ojhsP5Lgrk1TWb4AN5:R47JUQj4irIhCnDHUPfF/Be30jaNf1Te
TLSH
T16B65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 71bba73fa08996c8f239d2698bd4dac311ce97366bfdf03fbef80bbdb62d9fc6
MD5 dae9bfbf76b73b6d35e3c008fb06e88e
SHA1 59e7eed1b6d3a8e36755285f0e927dc23e269a56
SHA512 0d4cc677197a761b5e9dc98a157c5fda343665b85199fbbff0ef1fb1dbc20030260b51a90110fbd41a428ccc5daf6c39d344a3278c1c8be046a3be84c88d47f0
SSDEEP 12288:wAsfQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D275F05AD29802D8C15E92B4C3968A41F3733C9193E1C7CB53D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3825ef51a525949f677a937e0ebd0ec16bd3cbb7945af7f35b7754e4b3fbb4a5
MD5 00c95ae2418f922a019ead07442992d3
SHA1 79ab455c6c38fef2e9170bcb78a832e366d11ab2
SHA512 c3f865f241c5638017f8aaac90b8d093e7f39888e97f967c6f52153644a7603029657df27c602d7106f153d7e2d479c9844b2b5f22962074056ee52e1c6c2a25
SSDEEP 12288:NsDErXRU3fvLYFe3bnKSEeYUZWpEks8vAQf8MOezKoKK:NsDkhUPz24BjBqdIQf8MDzpKK
TLSH
T14D3538417626DB4FC66940326E33C2CCAB707D01EE05AB0772C9873FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 3019253405a2b4a5d681a077ea5a24af1b9560b3c8b94e93d1b9b166193dbdc6
MD5 6acb08808e28e1fc32eeec2a4d8388bc
SHA1 34650e302e124bc02e7d37ba2797f691297d7103
SHA512 eab5f067a9c8f9e0d13f34ea0f871c2d6a35b9ef24543258242a32ed13842c55712d31f812d764f5f8e627adcc90bf5bf0d2b6c5b9e64dec62038f21c84bd497
SSDEEP 6144:Y33FMFG0CbpNPs7ILc3F5D9R7xbm9KhMVnQytMx8QytMxlXdU31l:Y33FMFupLc155R7ZVhMVV
TLSH
T10B45B4819536A7CFD1B72132072A5F4CB7A4EC0677096F27B3C9453AD82AB51A0B83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 3b3b98afe7373d107e6de579a89796dec587ee4629b9d31af449b2554e717b21
MD5 64e805cb912168dfa83ac7d22ea5dc74
SHA1 568cb38af6fa22aa7fa7369fdc1240c20675b8eb
SHA512 a14dbbb0eb9a8cb4acaa6e47691e36098b046cdf811f04f7bb63d55c85eb61db89bbddf856ac9717a9e27bdbf67c87ae0fbf5c1ede69fc7f787b3c78ade3388b
SSDEEP 12288:c+7I0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:bpgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11C6523629F584DC6F29BC3F090FBC760E5663EC0270089EB56D0BA9319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b58da8977ab6d6173dbcb53badf86d58a58a749fa2598a47837d7ecac15b3806
MD5 659c1eb6cabd417a926c815db08c2ab3
SHA1 abba6beb07e4f5f6e1158c615d5918c66684a039
SHA512 138c02a91f932e2a83fe62c2d526e97f2e00040c39f457942cf9cbcfb0e25f8fe877f8f72c8847efbf9626a2b061b62cb2559a00f7ca3c9e02726ccfcdbc2540
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYfgXe4i7ojhsP5Lgrk1TWb4AN5:Tgb4mBIBhGFLe30jaNf1TWbdz
TLSH
T12E65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 44ac4d0b12f440cca73836e139bf016031a475d15aa8ead4748a2b1b4bfadb47
MD5 29d490e851aa77e74259f5b97e59f11c
SHA1 52e251c51e060b78d1eba2eb7b7e22dfdf85b649
SHA512 1b1da21deed4964ee4e8b20a9c74c3df68b3b493fa5fb0a65569dfe9496f8723bbc6348d34f02242983dc5ea00b36a4d8cd10357630c46e1e5ddfc5109f10544
SSDEEP 24576:aG88u8FpJqH1Mzria7/mUgXe4i7ojhsP5Lgrk1TWb4AN5:h7ZFPqVra7/+e30jaNf1TWbdz
TLSH
T18095F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 63037eff6dcfccde4cd75fbce4852ef6371e690e7a40f8186728a564966fc516
MD5 49677330a6ce72d47c20b258d20129a8
SHA1 9a3518adf406f217157457a714406ee6f6765cd1
SHA512 97f178027e389b210435c71f196b0f158cd3a45b354b9b52892e2eca65a3d9446efe934b16d4353079d927900f48fda38bda1c8def505f691dd00f92eee15fa9
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3e30jaNf1TWbdz:eG05lO43b4U023W
TLSH
T13ED5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0e53f275da50806b193c21b55986427ead819012c7de8a4388e6a09ed9e6a5dc
MD5 77e117250905e8c0f1d60c5d2667e504
SHA1 0b58126d8797a806f131871ae13554270445f5bd
SHA512 f0e3def758d988875617f8fca2ef0704e9529722e7f843f1c9f39e9b2eff17f42754159c36a66e70a1a94cb0b8c217c1fa2f139bb904948b0110767714b122db
SSDEEP 24576:3fa5POZ3dpqWVM50JicR2hG0lasx2+47eidn+gXe4i7ojhsP5Lgrk1TWb4AN5:Pa5POZ39Jt2pasx2+mve30jaNf1TWbdz
TLSH
T12465AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6c4391e21013bbb940bb50074195fe620138a1630628496d92f26fd78d9d7aa3
MD5 4ec997be20904e1a580e0545114cd289
SHA1 6531fcd694d9684213c60338d8e25b3d3da3392a
SHA512 aa34f87289c4cfdb2f14cbcc1f21221c6b72b50802321033e0497d0bf3702bcdddb5f45b3f5d11f2d198202f7732138ecf8569d1de450bb26863bb6780bf4b10
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fk8gXe4i7ojhsP5Lgrk1TWb4AN5:HNc/zEOVHFee30jaNf1TWbdz
TLSH
T124858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0b8edb1bd6afa66c8e5044051797942edcb1ae045ea58e6214f70e0401c0931a
MD5 f3de3a47b53f2bdad2c816d1ed91d117
SHA1 e9b1cd96eee5c5a327ed9da817f4161257d351e7
SHA512 400af0cb53d232ed4587c68cebdaf6c9a0262a10157efd60fc1a7434c07aac1e5a0b84da7bbc92b3df2a27b7045d662c879e51ddf9e5e33ab5806199e7160d3d
SSDEEP 24576:LtkNvNnaFeYhJNtmZBmygXe4i7ojhsP5Lgrk1TWb4AN5:LtMwBtOmle30jaNf1TWbdz
TLSH
T15555AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 53833fd976ad7927e3bf00600ff14d2cf4669510a6238ebed08189a1b0f24602
MD5 6abb5ad2b84ac827abe119f43459d72e
SHA1 6fe1a0aa19a2816e0aec78085d7c80990b1462ea
SHA512 1adf8e0e4f5040310d649711ed1dedfbacff7a64e0168a6f961fd2f8f4b31b7d675bd9a5edc2b0d29e9313883532ca1735062080b274a7051e4a5d2d8ec80711
SSDEEP 24576:WPUr+NQggXe4i7ojhsP5Lgrk1TWb4AN5:WJQne30jaNf1TWbdz
TLSH
T17385E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 cd402c496535f7b43f8e29411c6ccce4ccd6c4e817e5778acb58dd46e4a74b5c
MD5 111e326b6cec9bedf5f34cbaf8565e6e
SHA1 10cd2713cfcd6821f536b421572d8915afbb8ab4
SHA512 5197623370e79ac628415279018731de4f4b43162b9d46c1cd59c2170b9c095466d130fe7434694791d8ed0dc6b87ee29bc0d97c761af54c4cd32d44b42d4c32
SSDEEP 24576:mD3FHshBIYQgAtgXe4i7ojhsP5Lgrk1TWb4AN5:mDVHeBIAAoe30jaNf1TWbdz
TLSH
T16E95E17EEA5C04E4E57BC1BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1188-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1188-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1188-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1188-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1712-134-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1712-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1712-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1712-126-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1712-132-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1744-67-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1744-65-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1744-308-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1744-73-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1864-293-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1864-54-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1864-55-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1864-61-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/3220-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3220-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3220-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3220-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3280-84-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/3280-79-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/3280-78-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3280-309-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3696-7-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3696-77-0x0000000140000000-0x0000000140666000-memory.dmp

Download

memory/3696-9-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3696-0-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3696-6-0x0000000140000000-0x0000000140666000-memory.dmp

Download

memory/4884-52-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4884-39-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4884-50-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/4884-40-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/4884-46-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/4956-120-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4956-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4956-312-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4956-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5112-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5112-101-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5112-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5112-313-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5112-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5112-107-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5752-95-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5752-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5752-89-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5752-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5752-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5752-328-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5924-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5924-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5924-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5924-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5924-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download