c02090140cd8e23a517e7c89b4e19b75f32ecd055b3a3976ee821f52fab8c1b6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
Size 4.2MB
Sample261024-dgg59aeb35
SHA256 c02090140cd8e23a517e7c89b4e19b75f32ecd055b3a3976ee821f52fab8c1b6
MD5 9d7d09a52764d22a6bc832437c3f5232
SHA1 df8992cc38f6a3ad4b7538b42dc5c441ed3db45f
SHA512 c8daa0c2562830934cdc606d632306b6ef3eb629b2ef9a1b0085b640fec350e2b406f9a911cac906ebfe0906af2ba4619581d72b62f206438da4c2b8066972d0
SSDEEP 49152:4ONdAkFilpQLqeaurUOFEXyZTSmrUasd4kqTFYyldY3Iw6GKWRQ+YY8uhmojawG/:gUB6rjIwLvY7uhmo+wRLm
TLSH
T167164A06F76111D9C829C070A3265323B772FD5D033276EB5EA04731AEA8FE45E78B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5096	alg.exe
1720	DiagnosticsHub.StandardCollector.Service.exe
4824	fxssvc.exe
4064	elevation_service.exe
5388	elevation_service.exe
5300	maintenanceservice.exe
5312	msdtc.exe
5064	OSE.EXE
1716	PerceptionSimulationService.exe
3976	perfhost.exe
3016	locator.exe
5672	SensorDataService.exe
5224	snmptrap.exe
5936	spectrum.exe
1836	ssh-agent.exe
3148	TieringEngineService.exe
5092	AgentService.exe
3436	vds.exe
2712	vssvc.exe
5928	wbengine.exe
5196	WmiApSrv.exe
4112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\858d827a4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\FontSmoothing = "2"	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\FontSmoothingType = "2"	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c2a629a6363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dac17a06363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005742189a6363dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7f0479a6363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036a6fb996363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009127d09f6363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1720	DiagnosticsHub.StandardCollector.Service.exe
1720	DiagnosticsHub.StandardCollector.Service.exe
1720	DiagnosticsHub.StandardCollector.Service.exe
1720	DiagnosticsHub.StandardCollector.Service.exe
1720	DiagnosticsHub.StandardCollector.Service.exe
1720	DiagnosticsHub.StandardCollector.Service.exe
1720	DiagnosticsHub.StandardCollector.Service.exe
4064	elevation_service.exe
4064	elevation_service.exe
4064	elevation_service.exe
4064	elevation_service.exe
4064	elevation_service.exe
4064	elevation_service.exe
4064	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2408	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
Token: SeAuditPrivilege	4824	fxssvc.exe
Token: SeRestorePrivilege	3148	TieringEngineService.exe
Token: SeManageVolumePrivilege	3148	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5092	AgentService.exe
Token: SeBackupPrivilege	2712	vssvc.exe
Token: SeRestorePrivilege	2712	vssvc.exe
Token: SeAuditPrivilege	2712	vssvc.exe
Token: SeBackupPrivilege	5928	wbengine.exe
Token: SeRestorePrivilege	5928	wbengine.exe
Token: SeSecurityPrivilege	5928	wbengine.exe
Token: 33	4112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeDebugPrivilege	1720	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4064	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 5220	4112	SearchIndexer.exe	111
PID 4112 wrote to memory of 3300	4112	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5456

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5300

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5312

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5064

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1716

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5672

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5224

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1836

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5196

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5220
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 750445bd76274a8e73dbd99bef29572dbff5b9cad6756835d63c6b3ed42e8fdf
MD5 5f2ae4f2a8457e282d963ee4c7e09a91
SHA1 4cd541f0814257a2fe866dd6ae18c6695cd4e4b5
SHA512 dceec0e810e6bc8fc229f6f6523676e910d4726968538950c9da46cb57fcbc707f1b5e8984beac36fc2e5733ca8c3e1e444c77f6c6d784272042647fb581b510
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8Q/lFTjN4:X3q6HjBMLm
TLSH
T163D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7b1f41e8d4ee2f0eea474908465e56a6a2bcd23a6979ca6e8c9a18b2bebe5ba3
MD5 8af98f80ac143f1996fd778a69fe0d2c
SHA1 7e33a998057b1143982521edd0fddcdfee3fa501
SHA512 9930868f7e6c277a5bd7d4a48abffdeec7432921565fee35b87accb2ac370cc176edfcd76d8fb0dd60d396fdbc8fd089cb075fbcfdee8633f4d32d1ced970bbf
SSDEEP 12288:W1XLsswWkxy2lRq2czATGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:UXYfDtczADnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T18865F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9fee160425f47b46f2a3047f70835b9fc7a9696b87e2ec6e7be73da50e3bfe69
MD5 91ba5974941f75b0c6a5f5d3b2e5cc1c
SHA1 4475d6651fa0c60c10e872462e7b45b4166f7ed2
SHA512 67513971c06aabdf7cfc5bcf2512ac21953f2efb1007f49272eb99c3a822e5d66b31f196b3b58583bfedb8307f40727d98575fe1a4c193a4beea2bb91f101c44
SSDEEP 24576:p0Le5ji0hmxLrMknQ/tbw/2Mkjy6Fr7g0o4:pPji0Al5Q/lFTjN4
TLSH
T1A2859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9cd1782671537b858fd2aefebaefba349d92b23703519e5ba631a3b5b50434df
MD5 d6235f62b77c8dc7b21b6b5e80df4083
SHA1 bb4c775f9d218d28dcd22550a12f74b2801a31e6
SHA512 b23f8b0f45fb27dba9f4f4ddaea1d255c65af2592bc862a91d291e1c358c13c355eb177dd0ec1912ffa0f9a269f55e18c4919e53f3d945e134118a789b59a411
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyuunQ/tbw/2Mkjy6Fr7g0oN:x/ezSC6vUzPvxHjylQ/lFTjN4
TLSH
T1BB755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 80eba4490cb56901b186c35fcefe7f00c18e8ebdcc01fe6f07908c9e3b931b7a
MD5 69c640a34fcdaf843e28cf244f7a0809
SHA1 eb085af5fc80218fc042e0ac10ce7d3f94ef399a
SHA512 215f2b3d2d17019026be5e07fca04cc26c777bfd7fc97cc71d34c635b768ec7e416df59bd99f21744294f3c7087ff4f72dabd281d6e02384240fcb601282e299
SSDEEP 24576:jVbqPb88hv/l+63nQ/tbw/2Mkjy6Fr7g0oC:jVO88hXl+AQ/lFTjN4
TLSH
T194559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9c1dfc49fdb25fed5b1faf217a8c7269a8be0640f8a7056722b46cfc7218b1f6
MD5 f0486b3f758807f6dbdd6d3c201491f6
SHA1 7442deb160fa0b980841f00273ef2a1091ecf381
SHA512 2fcf53c58896ef51410fa3fb4f0267c2b9bd941c494b99256327a5841c0633425eb4c04d72cb4c35f50ea234ee1660753cdc421f256a3188201df6658b752967
SSDEEP 12288:DzYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:DzYnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1735523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 924d92e43d22713db562dd201f92e943ac4ae327937576a803221d2bacb268c6
MD5 c2d2d8929c1e11e37ff10183cbced430
SHA1 448d9087ae9e95c31ac71a18427588ecb741a0ad
SHA512 88bd237ab16bcf7f72316f1269e45a7c035abb7d633ae88bb991155d3259c38cf32b026f3c559c0cdcab99ccdba0e473a6ccc0f4378c6973597cf71286c29ca8
SSDEEP 12288:OeBNUbTVO86U/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:OJIUfnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1AE75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fb71352ac24fe0245a4cd877ced12fcfb5b40e4bf0816484b023cd22291eb520
MD5 f234047118822203202a0e1902087044
SHA1 9d892c0a9ad23abe00dd05af84c6508bbb224b15
SHA512 92fe3d82b2ba40e73e7d632ee77c9b4efe345f8ca5a07b5d6c43af227f7b9c1a5ff9d89979a0d2c0f7669526ab4a109959b86f9671256bf9e265daffc85a6ea4
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THf:dQvGAdlCEL8c/yRNw5CZLm
TLSH
T195267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b56a96076f92b3bc7b88c103f56737a037f93e06ad04ec27d50e55cf8ebc4041
MD5 98325ad522b661d622796b5f38957ef2
SHA1 6d8048d00beeb14c403d2538408465652a2e237e
SHA512 cc5d02e8c4030443956dc59ed87317ca26cbed88ef1d533598a7bcdec1b096564fc9da8084e65dc0dd0dc2f029bdc1e1f0c109a0223933ef39b780d3af66d4f6
SSDEEP 12288:IAwSfxL/2Dc39DLLmt0LDQewsAj5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgY:tQewsAjJnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T14775E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8bffefcf17362090bbbb410f7e01971c1c9d4d03e9f9b99f5e00c24d008be9df
MD5 fb9c7debedcfcbff714b5c97e6e19d7a
SHA1 41d6af93fb2d0ac3665308156c5c2aefa8b00929
SHA512 8588f7e798397f653d364ab56e04db7bd010bdbb4ba67cfd70c50217098caad055e7bfe03d21b8582e46eb00a4dd4809da35471597197dcde7bc0ca127215ca3
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmL:CUEtQevvqc2W1cpV2EI32
TLSH
T13D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2966b1e2c4d20f7ae47a1458ce12c12426ccfe0ca1632f97675a3d1bc66c24ac
MD5 5b6593abf788ef04ae11aa39790a45c0
SHA1 150d9697076c2cef0ef72610079d6fac6a07d175
SHA512 42d0fcc5aaef4a7db5d574d3abafb0cbe8612ea19a8b0bb847775e137e7522c29ab2ad028c7f73fa19dc79bfa0707271d734dd996c4a7b8573f14fb8fbed1917
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zpQ/lFTjN4:LoqtVjnmlLm
TLSH
T145D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5fbcde4026dc18826adda2ba00b237aae2c534ba3456aa9c716458befd3e87ca
MD5 9cae0209e0043ba7f0a0265d6180f75d
SHA1 1716b20b86a9dd65dc5321092c053e4d50b5746e
SHA512 bf774372f597d818cdd0076c1fb7b27f4bd5e5caf3614d57add13318ab891a55f5d05d442303d930c62c3bda2b44afb1e1900fb362b50496fe43b819d09d2b53
SSDEEP 24576:lAhGLJIFoiwtA5l7S53KnQ/tbw/2Mkjy6Fr7g0oL:lAMyFoiq56Q/lFTjN4
TLSH
T16735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a951d277468fb80f1012dc0b9970bab6fc25108eb1957311670852042f473f33
MD5 4af7dc76ca132ead22c7214cd60464c8
SHA1 06a9804360dcf62d4cb3ee12cd80ee23867b0fee
SHA512 d27c5854c65c24584cc928243d7db7b0299d8860a9070ed9430609d95e1b1404b4397607f000d48ee37e2fe04cf6a1314f959c1d44687a6f985accf5c81c90f4
SSDEEP 12288:8mw5HEjsChN2BFgl0WDm+COGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM/:5wuHOWFnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1CE65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a5684bf3a8b8f75c925d1ded8a08d960a6672a571afd241e54e885a3f876c3cf
MD5 b4d1eb08095296249fc27fe73585d60b
SHA1 47a313445fd7447d2c205c6e9f741dac8daa094c
SHA512 5d396180b4ed8067942307ad321766b1fbcd842bb01df7f463c5a73bb0a9c6e67fa5c9f26b82c63d7c43884ed96d0290c61958b5a267fb3c75705d1162d6d886
SSDEEP 12288:QXZ1IyJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:YZuMnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T16255126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ea3acc8ad414b79bbc2fc53339706dc9ba1affea3bf33d6794e77f3d741422d0
MD5 511f0ac5deee2db50cb8c42764a1d792
SHA1 a3da74e462f30b7fccc4abb51817850d3698fd3d
SHA512 45e6917d36e4b8de14e49c31e73aec8631eb1a1994733c5ad209ec40dcfa40e8037d55a486c93f2e49f41d204b378373171187799ed47345af5952ba0194a6f3
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:jQRQyi36YOcPQLvw2gAf+PN3gLm
TLSH
T10C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6fd0062da0a3dfcd960ddf3c288fd2e8598a6cf1b6c45ac4be2487054223716b
MD5 119fc0027f76d54bcf1eedb60e1229bc
SHA1 11cc2250ccdaae18e0071c3325db66ebe3237116
SHA512 676d5c7fcef4e2d7da708fff6997a668d94b1b4c2d60d3a7cbb42cd42d8011c429194965e0a621f21dc0080c19f33d42beb0766c1316059fd3b4765d3ccb1232
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:KQRQyi36YOcPQLvw2gAf+PN3gLm
TLSH
T1A6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 deeb28c997faf3db876adb3d2222e8c7b27fe3b5d854bdf153927a22c8b7af2c
MD5 454582c23e5c97f9a809199e6b72a787
SHA1 f3aeebfae6d0f8117de287fc679e88f39f98f1ee
SHA512 d5c1baedabfbd41189fb791d1943a6f9559df5639dd904222f6bffa470a91f7b2335a29efc2d66bfcf6982b4623db25afd8654d5cc2934b6808a4b2601ba6136
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL08nQ/tbw/2Mkjy6:h68Qg55nhheWu7PNU3/5Q/lFTjN4
TLSH
T162B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 baa87102a918ca0944a3f61bbec56878f798506f3aa24dde5894648fa83a6ace
MD5 95a72f3d1faa9b198fd5b4fe7ae8ab08
SHA1 4b789eafe2315558f0097570870d19e83b88165c
SHA512 aee98f26515bb6f20aaf10f9b1ed51d8cee82b415389de75fc5e50f04263ff954dbf703db5ae7ccb6c1cc6369b53e8821df12d713d909ad7a839778f8bed8ea2
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99J:py5112gYy5azzVvL69nLKnhZ7Lm
TLSH
T104167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 84404740292a2a6b8b98bc29668d4a4b6863b5a612cf8e44c1426d147536c14f
MD5 53d5ea5ca4b1bb32e27bd034d45e1c86
SHA1 2f206e2a0574c09b44f358a9322af037efc13614
SHA512 4c157af232164da4185099473b53392b592dc92973119540f34ec6d7781f60493abcbd0ce64060808ba2b4411b8df58217f8d0ec7a030278a321886c2a942368
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzQ/lFTjN4:zu6JmVxd2dYLm
TLSH
T18AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 83e504c21084e912cb6782e7b18f7a7d362f4aa643adf24e7350d5f34b011590
MD5 f27d6ff59c66fbab10089fdf780aa610
SHA1 e5125e6af89342fd990daf086bad1c8be3bf7d2d
SHA512 881b603bc3f5be32b9de5847a5813b4686ce497da92a8ffa856cd076c338a7218e1aa305bfdca234518d218187f71dbbc88c53b5b1f62a50f6e3ce61a358ccbb
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4x/Q/lFTjN4:3mifPbRlLm
TLSH
T1B0B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 51ef719a4aac03cf53b04c8826da3797c1faf3a033a8382fc4a0f3958b55503b
MD5 60bd98b296cd495ce02c63b35e32403b
SHA1 aa719f677cbb158b2c955f0375b951a837381c3f
SHA512 5877e984792c803ad99ffe2eee3e228415b2f6b46b5f94d69dec35e219eb63b099c99affa7271547771963c67a7eaacd932b719ad987a896a9b914fc97f1b85a
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHqMQ/lFTjN4:s5dKTi61vLm
TLSH
T148C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2c6730edccc36b2f9d7bed7780f4a69c34763415bcf677ac8101270d88393d83
MD5 cb7509b4e80f89666d1641af763b2a97
SHA1 409229091d04231115754abbe71c68f2c6a2bba3
SHA512 94ea8f09c096931c99e1962168e643109828eff70ae9e5313a9fcdca199563bf73b7bcf1a5f8e92ad5b533e0fd77608623aff69b5a42f2254fb178b82119ecee
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wDQ/lFTjN4:RX2iyphhLm
TLSH
T16595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3c673b564945827c66bccd085357bc84fea87833769640096b8b678f22290112
MD5 9ac39b2620147afec03c62ce3cce11d9
SHA1 1a5eea3ed0e4914bca45ccf5ec8bd3f91c669719
SHA512 2e2a4f30f1353107c8fa05ac4321fe95bb7249898d1943b446c5726ae0e4b6736fa11f4c6f14a07d0a7c8152ea85149c90dca581fc4c52803172cb5f34a4f338
SSDEEP 12288:9gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:9AnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1975523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 24473697109694cfd6b3a827bf80cab89fd420abad3b62f517558663b4345b11
MD5 8fe62ea179132afdf73428bee55e366a
SHA1 f913d712eda8e7a012bf4a3b0ee2a941f5059ef5
SHA512 4669541f939b695b768a6202029297fae9c886f6d94bef1f7cd2768a40476034b3894bcb487c50db19c7df7f87f830c013bc5e4f903c05c21a3a26973a985067
SSDEEP 12288:cdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:c9nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1CC5523697964F98BFA1706F14C828182973F0EC6BFD1938F7B482129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0b2eb92d4c4ceb84bb6ffb1861a13ecdb52f2627bf18c7cf70427024bc6ec870
MD5 04eccaf7f0ed97044a3970fc1fbe5066
SHA1 347d54c3768fe43b813ab3b497dfba18f67b54da
SHA512 b908462dd9ba3f1c3e8f9a49fc83f2ac41b1ccd888ab2a07de8b4f9dcd1f5f57c59cc363d59384820abb10b25cab69189efe1aa72dd9704fa2683f4be4cc9c51
SSDEEP 12288:+HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:+nnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1325523697965F98BFA1706F14C8281829B7B0EC6BFD1938F7B4C2128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5dbd7eecd3598714f1a69a24d25dc2b68cab8d031ba9b6ef1a01c7d3931dbd52
MD5 ec1f566b217ee364ffbad01c39442ebe
SHA1 67f56e08d54476862f0780a3e812115de40f03eb
SHA512 1e12a4df21571e0ed340eaf562a0d72d452bd62d56c0893d2b9f13305a13f4f2f0a2dfb6c9f0d9843c225aeefdf17c29c94bbde6910f101672e5cac6c10660c0
SSDEEP 12288:aVqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:dnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1205523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a5f2f0c53ab5a501913bda6e91c3c628282324c637e7ce629a7f980048bdbd6b
MD5 d8ca3dfa531c5e28bcc65fb4719fd090
SHA1 67e95e14837960459d5dd811fc39aa2cf1ca4f14
SHA512 d9a1f8c95716a365d2d9e48f78db6993cc84f8f5da030d69bc75e3f9ed75ede5a8e0db18229737b7b49d631c1775ccf5fadd0d03a17851abfaa6eaf0b807903f
SSDEEP 12288:cCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:cCnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T12D5523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9f55db6df8fe1756bae60a39b92390ebdf9cfa75a626683799802accf7dd956b
MD5 14a070ef5a6d753432824e968bc9adca
SHA1 6ca910e9cd24614c93ca557e07cf5cdf40c7479d
SHA512 b077460844d30d51e80fd18dcfa843a2a0c7579e04db2d77da3b18530be7551c8b64c33b25f2241c5640a3c5b1a2e0e9a7ee379db66d9d03ab668c9f8453324c
SSDEEP 12288:bBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:bRnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1DD5523697964F98BFB1706F14C828182973F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 eb9c5c62bec6b1fb6ea92b01f48b1fbd1a81eab96f1038de28a1c3fcb179128d
MD5 1e9f6cb110bafea947341098765b87e8
SHA1 0836f2a5a692e2324b4b52b6bf64de7e4408c8b7
SHA512 e485725cf5e1602375e1335133f573297858159668085592a45a8b2cda026d8ebaa6551a40f17f9372445879a0517600ec82c071fcc054aa4654837bbd7ea849
SSDEEP 12288:6VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:61nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T13A5523797964F98BFB2B06F148828182973F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ac71fe7a25011fde63726575dccfe6868a61454cd6af65dbc008dd942faf40d4
MD5 9247a17a3568788a34d7db0441e510f3
SHA1 3e4bdf28e3776b57d4e4293944d76c487f563fee
SHA512 7256f0c90867443a38975180be926af343be5436c406541a43928e520a978b6f0c4ac65e9c40122770096c5d271b8982fa22ba4dbdf91de0584b4b453e049fb6
SSDEEP 12288:eiZwbDzzFEoS2cPvy9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:BZM3zFVSOdnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T15F7501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2bc420415aa64e229f82cabe1b9a7bb04b3dc4b0c048d58cb263acee31afe455
MD5 9fe193d1a548c5a3a3d1a51d135d72c9
SHA1 6ad226f8d8f423ebceb7ebc077b24a8edbd6ce00
SHA512 26fb3e14106dad0db36301ff7d92071491d13d35d0d69881061ef6a2f639760cc2afe8da273fa2b6c9f958209df0e8c2f18541928dedcaa0e364837343fd67d5
SSDEEP 12288:kcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:kcnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1395523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a9b156a073458de3ac8bb979db3814c710ab0e03829fe2abc5486300403b07e5
MD5 82cea7d13a44e0c16310781746a9adca
SHA1 62b7f477d957b4d17667f47f53407f5cea2dbb29
SHA512 1b7c499133e4c3de4828a0eb7208b9c3eb1a46dddff3edd9e6293bc15d9221c75dd771b2eea2317ee90c569773dd7804120f8da77a4fa990e31872228ee92064
SSDEEP 12288:MoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:MonQ/tbw/2Mkjy6Fr7g0oX
TLSH
T11E5523697964F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c54e586bd971bd8f34df267208eed81a7c9a667359f2c11625d343b8eb6e51b5
MD5 9cbe2e8440ca5130f7039e42e71e8948
SHA1 9faf2cdf7d6aae53d333d2f54a36e8dd96f1fdc3
SHA512 418280020f168a8782d4590b1b49062c15c5c31e6ee55081bbaf8a7473dce98c2b36b83b3ed9c99859671e113503365acdc45e7c77f948fd0999a70e03d69ebc
SSDEEP 12288:HyPz5L8JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:qzyZnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1A065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 20c93f188ee49c6f630a96523b5c06529009477a20d1c8d3a2b75c8c1fff1a47
MD5 72bbb0420aaf83bef54029ef6de8e520
SHA1 92bbeac9ab2e16eaaeede1533d0b0c2b909c89db
SHA512 104b9e3e976efb52fd42fa93b3a6973f5b305591c9fc0d791f013c70df7835805f9ab9aba9d142663122368088cddc790e1701b57cd39f3ea0cdf421a27e6e93
SSDEEP 12288:mcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:mcnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1725523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9892aa429b7622f68a220b122e6b7084b5605bac1f223177e1fa55aa75644586
MD5 e153c45b1349c65ecf35ee398e10590b
SHA1 123c70cdea34682b44df398c5cf708550043d3c2
SHA512 82814315ca7b8670b6177b5a039a519e4072ef17d7e0ec3262f58b9073b4173295eb10e4db9a7299053901ec75541f65017739fbe21d73944f4d89f988cdea60
SSDEEP 12288:fcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:fcnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1155523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 dba57d8447e123067c92d5e1c2b594a6ec761503bb5ab52c1ffd79dcdf670031
MD5 7f583421f0d4fb2cad60ccf4ea455335
SHA1 9fe4658702c39cdf61ded7e5d528f1a8338f649f
SHA512 f8f1e1652c51fa97c9ac77452ae70048bb5d8ab5ee029e8812f40dbd896e63a433dc2cd6246d51e8f90d307b8a62a12cfdbd30de8ec3afa7b67c0b61c837f38c
SSDEEP 12288:tyPz5L8JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:EzyZnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1E065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c17b8b7674b7145e390ff997be4529beabe26d1b53c3a1cf468526d251e0e5d5
MD5 e7c8f66a2e8f98ba678b8794ef324b5b
SHA1 cdc1087726fae9eb6c1e38d2b483c87c61d2a448
SHA512 8301b6e30554b5a1f2c0bf424d9f855acebfd2f8e1302f3b6189ced3d588cde92f5af47d6dcac482282539bd9073a61f7e9ca7d3e9f97c9abf4e985bb6c0bd08
SSDEEP 24576:xcP4mcvIjkGOxhKP2l71nNKbrh/8KBUnQ/tbw/2Mkjy6Fr7g0of:mP4m4IpOO67W8K+Q/lFTjN4
TLSH
T16965AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c0f0ac7e00d88dc2edbcc97aa04a8e77f42025a5355dbe3f6c0ab6b45fd9199e
MD5 df3f11055c13242309f15128d9e1e034
SHA1 e785e70fc09f6b45a156837b2ff5632fbde3dfa7
SHA512 ad8fd9c1fc5a9e68045cdfb817aba201e9783480bfd18fb7b955c8c66d07bd7974012fe9617dce0fd2a7a1974fe38bccebb7c3278b65554230708b22d7f37a8a
SSDEEP 12288:VssfMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:1MnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T13265F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d5390b60ae0baa54a2d8c6d726271133fbbfd9cd2dbac86003a1b157f7557a3f
MD5 84a316c2e573e5183bcc0895479c3ace
SHA1 a9671cf5095acbeb94ae50673e4b1118dffc8782
SHA512 3985e8a6b887bf313d1b3abb05631120746f902895657a3e3bfb5407f0600c0c19c5f89b5ff1a3100452efbae16d484e29998e0c4e6dabd7afca73632fdc65c8
SSDEEP 12288:FsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:FsnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1265523396668F94BFA3B06B04892C151673F0EC5BF91D38FBB08222D967C3D41EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f3d9c7ed8a7beb77134f31944b3a7246dcb09911232574de20ede35d72e49749
MD5 3067e616867961d5ac7d017ff8468c45
SHA1 f34730d4a02499ec3a40394cbb638d400f5d96d8
SHA512 da26fc3e7de1883c21d9f28755c2ac890a19f37d2326c5c5dc255e2d9c678f8342e064aa98bcb3ab945d07c16cff1efbbb8b9f8343de021c0483357ef6e95b2f
SSDEEP 49152:4a0h2GEkuAe73q3pp46zwwQCQ/lFTjN4:4a0hNYG4JwmLm
TLSH
T127859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 38602125c35a06b397adcc8f77e76b08c2c1313b76b7af520b893439f5133499
MD5 f71059dd9445ac85b01c28aa75725e8d
SHA1 fc9ce4b3c467c9f54ad1d91d833339ccff82b382
SHA512 7b934ae150d93caa3f6f9be237cad406f421e8a99de59f3a8530778fe2fce953cd73f80ed577fc92dc7399877c4888297d2ade814c60e01fa56264929c90e451
SSDEEP 12288:qhbHjfXNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:qhbHjPtnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1E955027E26AC20DAF63692BD88928546D7327C552B11A3DF2384423D4F3BBE41D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 98a463ab834c5b5eb2f4f5ede09c83c788c3a1ead86d43bb418ccb7c2ed312ab
MD5 4c26cf751fc06fa3d5e4e32cc686c497
SHA1 bc047f746b801f73acf5a5fc7e1ceaa9b98e3689
SHA512 f4e0b1200fc7089ad9eaa3b6e7bcc40cd7f1ecee4826200d6424ed2101d50a33fdc494d152c1f75e777a3e48c08de97ec35a053fe81dd4a64c43c6d5c09857f7
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/FnQ/tbw/2Mkjy6Fr7g0o9:JIgnaTk46pBR/FQ/lFTjN4
TLSH
T16845BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 79ce6ab620382fae6725ed5129a7c4d49d3d220c0795b7401a2aa80bb59ee0bc
MD5 96be5070620b1c4475deb3df5fb31848
SHA1 dad05cd72722f8545fedfbe4942e7b084a7cf78e
SHA512 62b151b13224ede0ff2c257eeee381b0062751ff0c1294ddb6faa2f8acc8783eec903c716b1ba2cb63d41c505f50c7a91a2dba727bf501046e664dd7c8d73e0a
SSDEEP 12288:v4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:v4nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1125523697614F98BFA2B06F54C838146673B0EC17F91A3CF7B482129967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 f3c750866b6581712a65a0ab53e41afc241fd352e7c8dffe436658c4a6969e72
MD5 73833d293ecf1aa36d330a1405e2fe04
SHA1 7f13dbb32d78d63ae72e7d45aadac458063b40ea
SHA512 bc2949a222d8a3464b5cc0e4e96ca5984570ffb46166c8abd8c55be45937bc5c8e849a5221a725bdfa1fff07fc19049bab1141348c337b3ce3300a439817d6db
SSDEEP 12288:lOb4A4LWOsvAYFTTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:iwL3UTDnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T17375F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 7fda8b154fcb14e486df9f26bc2aaf452980ee4e723fb894b88c64401f1543be
MD5 9da2dd3f54de4969c8bbc34d2d844ed1
SHA1 8dc32058146d9c71163a2fbfb4f3bb4565fbbef6
SHA512 be78da36cbd80c138a678facfc6e81bdb7bea703f7123d971dd9941228f52f87b256ec853c404d6e8f0d0dd14713d0709ce8e2f50f07d12183f9693f6ec88a66
SSDEEP 12288:VpFtCOfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:+O/nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1DB55022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF81C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 216d4d3e6f8db2ea288ae27a50519c7480daf20e3e4ea2e669dc15afbd6b0878
MD5 a4b19b047348d805870707afe04833f7
SHA1 c8b684bc2cbd8090440c57c90f3b2ac33d9c3c58
SHA512 f11c7135ac0d15dbed3ae0830fee6411cd2b746ce91a00fe2526efc1dc2da6c7825d0d7f1247e1e33ddf5cf24869bd9811e391fc38d19cdfda18e48c89f66bb8
SSDEEP 24576:P7NM9YqZqmWMUkPjZM48Mv6bEhscnQ/tbw/2Mkjy6Fr7g0os:P7cBWMpPjN8DbEhNQ/lFTjN4
TLSH
T135659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a803f65c18bc02116d3e7292b6346f8b42d5261ea3aefbbaecfde6da5c82dc3d
MD5 48955c5f4e1a27d319e606272d3420aa
SHA1 71f25ae834462599128213e3b151f8731506bf3d
SHA512 8b375a87f1accc5e170aa79cc85aa518f154e4bd672186c6a5f8e6ca2787cf59a31cff1cf186f00d492419b4fd371e460f3fe63f9e96eeb6d61b1bbcca9c4e9d
SSDEEP 24576:XW6BApg2YuyuNDYTabvcdvNYf8km1GnQ/tbw/2Mkjy6Fr7g0oq:XF2YuHNETovAvNYf8km8Q/lFTjN4
TLSH
T10C857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a423d1df8f495ea6d38311795d414cdbd6f59a250200af3ec94fb6ddb2575425
MD5 41bb0d8190f32ab9c5db0ca900966c71
SHA1 530c6a943ad1f1bc7e3236f5c59d78e12ff3b2fa
SHA512 c929775b337430ccfe4f2000b046666b9e6f14a6c31e4510b30a9bcf2fcd17a26526ba9a9f31c806a939def742c10a8641dfe2f47afe678c55a4f598465188cd
SSDEEP 24576:yAFs06+Omlf3NXEbToLnQ/tbw/2Mkjy6Fr7g0oG:rFs060lVXuiQ/lFTjN4
TLSH
T17565AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 d4cd8629a0f0c63a7401362251054706b3fc1f406e08e64309161728953d2a29
MD5 2a958f426d67b6542c0484f7089f292a
SHA1 48999247b451e0955998545e8704e8f5a84df8b6
SHA512 03903a9b37e1e8020a91f2aab61753c8c0af79b046454b88fa79819cf868b99723ffc07e532b5af1da76246aaf6c6acbf58ee7628579e4d5760659c96efeecfa
SSDEEP 12288:RCJnJ5D3Vkrqzx8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:oJnJ5D3WainQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1E675D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 86ac4751494629708d2d85fb94e4f58ad8b5fa1da215b564b2c63f17a2a65cf1
MD5 39ce5c5ab2aeede266f1ab24797f827f
SHA1 79f98088cbfa2703f6a88d207398dd13b482cd0e
SHA512 f2b9ae67faa33a1da547c560ca3ec4be8efb52ec2a040d63b43379274c62f11fdb737a46406da9f04a5bc9a3b3612d155820a44293e27ab40d409598eb92e32e
SSDEEP 24576:UEPghm6/7IIXdwcXrif7qQncjlP65i3VuFnQ/tbw/2Mkjy6Fr7g0oW:7g06DIKdwc+eQnSt65aVAQ/lFTjN4
TLSH
T19E955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c925cb31eb82d7e89b63d8482448124ba2b7989f5bf6ca24312711301ca25838
MD5 d3e7c55709d91a625e7629f547007242
SHA1 3f90908af8c6cfea448a57ad25895ff27271af89
SHA512 df35def5641e86af012ff2b188cf05e7c2a1b5c2504e2a36b4ae3eabf3254dc20656928c14c82990c43ee6ae3338eb6bbc5ce6cc31e1ec2ffcb12e6c0ff7f8d4
SSDEEP 12288:aEP3RSOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:5SOnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T18155126D37ACB0DAE52A517D88918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b64d61c3a7c0b5150f08602e490a7a10bc7cb16649adb04053817a45770a28ad
MD5 a729ffc009f33bedc2770d2799457d8b
SHA1 9c18e7c050956f8306d4ba5877bb3c9356f91b22
SHA512 53f6447fccafcd066c69a33a7ea2b1caf42b574ee093007485463fcc83551ed4678530458067a882c6aff57e608a98c347a09715568734f8578199699869d210
SSDEEP 12288:ujkydGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:uIy9nQ/tbw/2Mkjy6Fr7g0og
TLSH
T1C56512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a358e9f39812d91e63ca21dc6dd73273fa774b9a4d38c35227c3454e924a1ddf
MD5 01e65b6c2800c6e933040cb5c9a5d80d
SHA1 8560206d7a3d5465bc592ab8e800dfeae9ed584c
SHA512 6f332558426cc86f6d0667641b11f0f3f7dff51eb214d46c6d03d478ec35f3464493bef41eb6c1de6430daf07504864f22d023e5b9651ea700746886b7e02029
SSDEEP 12288:v0vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:MPnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1DD55236C2665F89BFE2706F448928542973B09C17F9163EF36C86239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 006f8cbf97008e437b78617bd3c1a3e7a21b25897a3905c321f7820eb3b1ca79
MD5 9c6da0bb90e5b0edd8f90f1ac5c14189
SHA1 8d68639b60c9e659755ba20c39da6c7336f16edd
SHA512 c699090d5e848321715dafd2fa021105e6111a8fc366a0e48c6a62c374b83332575941a3a78978c5e51785091f48362ce0ac8f8172cf23b11ce398030da5b7f3
SSDEEP 24576:AQ9MxZKdcz9dw3EnQ/tbw/2Mkjy6Fr7g0o3:AVKZEQ/lFTjN4
TLSH
T12D558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a26d3f0af8ddb2fd8aaad14e83dd8b2787c80317adcf0d299bf1055b9eadf24f
MD5 af8ff170cda087613e1d5fa1ca8f60a9
SHA1 7afffc95b7694619c53108a622827f1f1c548bf2
SHA512 3b809f6f7fe687b2779ab2ca4897d04a7c059d55294421e14512b7968e7ea158cb294c0e7e0a665bd3fe1dac638c3c9c1b7e101078e8239e0899ab1589b76a6a
SSDEEP 12288:dyoKo20Rple9p5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:dyocSApJnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T14E65E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f212e99b18094fd4d97f6e53b384075fab46a1d91422b76a71ec42ed2881b6bb
MD5 46d7abab0c3d08540e4846075f5209c7
SHA1 ec1bd99cb2256e77b03a3ce7055075f333989c6e
SHA512 3627a0aba02d9325c8a8d1f60677ebfd1cf17075a9ef91ce982785cb9627556c135a0a553f34a0836a3b49abb6d621749cc1367c47719fd5d8151b255cb114b2
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKJQ/lFTjN4:s0zuNIoLm
TLSH
T1E7A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 efee664c5fc4689a3c25611f3ce9a688adb1e35c67912655f82560caba28383c
MD5 ad937363b2df935412c44f4b69e88962
SHA1 8780cb4946de196233d6cfe5100ecf2c807316a9
SHA512 d96eee8caeeeba0ef5712364860ff6a131e2ad91cb6231625594586c8a2f897c5a686957c4dac46532ddbfaa28c12011ae5415d72ffa92ee7fdce20aa2f3850b
SSDEEP 24576:O1QT7EcpfxR+N5AWAz3ooiYtjMqbOnQ/tbw/2Mkjy6Fr7g0oU:DTDxR+N5YzTfjMfQ/lFTjN4
TLSH
T12C55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 0a77ddaf367e28b2dd93acc31abd5b1a4d2d66a9d4b66de1a58598d8e217ee3d
MD5 7848958a09a40ec9575cd64de10d435c
SHA1 53a7fe89457c60b93bf10207d4a6d865b7c79347
SHA512 386f76767d8b46af9af2b12a45c69056907fb1ad7dee4aa82772937a767e41eb48210419234d5a0a07854576c2548790891da7eb455b4ada0cebbaaaadc0edf3
SSDEEP 24576:3TMdOz0FFS+1mSLqnQ/tbw/2Mkjy6Fr7g0oK:F0K+1mSLqQ/lFTjN4
TLSH
T14075E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C1792F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 6a832ab98f7c0f026c1c7a0865d9348e9700575028e7181a0e4ac1cc36628b16
MD5 3ececf0571bab0e01d113a4297cd1721
SHA1 5fd6013ccf87e0071750b16d371f82f5a46c489e
SHA512 91bd1ea56ed52973f40d3bebdc6227c9c7917398b97c0ba895ac17b340eb1e6e4af10bf93ebb48df50e529ca520f07bcc8479742b0e51cd9e6d281fd2a03b557
SSDEEP 12288:j4TTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:+DnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T18155122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-82-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1716-88-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1716-163-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1720-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1720-25-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1720-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1836-171-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1836-122-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1836-128-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2408-8-0x0000000140000000-0x0000000140435000-memory.dmp

Download

memory/2408-0-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2408-354-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2408-178-0x0000000140000000-0x0000000140435000-memory.dmp

Download

memory/2408-9-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2408-411-0x0000000140000000-0x0000000140435000-memory.dmp

Download

memory/2712-550-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2712-174-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3016-167-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3148-172-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3300-382-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-385-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-380-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-379-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-378-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-377-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-376-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-375-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-374-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-373-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-372-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-371-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-370-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-369-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-368-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-367-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-366-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-365-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-364-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-363-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-362-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-361-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-360-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-359-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-358-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-357-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-356-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-355-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-386-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-389-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-395-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-394-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-393-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-392-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-391-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-390-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-388-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-383-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-384-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3300-381-0x0000023119BD0000-0x0000023119BE0000-memory.dmp

Download

memory/3436-173-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3976-166-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3976-95-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/3976-100-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/4064-33-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4064-39-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4064-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4064-447-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4112-181-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4112-197-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4112-352-0x000000000C920000-0x000000000C928000-memory.dmp

Download

memory/4112-177-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4112-228-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4112-552-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4824-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4824-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5064-180-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5064-72-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5064-78-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5092-135-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5096-344-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5096-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5196-176-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/5196-551-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/5224-169-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5300-162-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5300-61-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5300-55-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5300-65-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5312-179-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/5388-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5388-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5388-542-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5388-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5672-387-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5672-168-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5928-175-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5936-117-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5936-170-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5936-111-0x00000000004E0000-0x0000000000540000-memory.dmp

Download