c02090140cd8e23a517e7c89b4e19b75f32ecd055b3a3976ee821f52fab8c1b6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
Size 4.2MB
Sample261024-dgg59aeb35
SHA256 c02090140cd8e23a517e7c89b4e19b75f32ecd055b3a3976ee821f52fab8c1b6
MD5 9d7d09a52764d22a6bc832437c3f5232
SHA1 df8992cc38f6a3ad4b7538b42dc5c441ed3db45f
SHA512 c8daa0c2562830934cdc606d632306b6ef3eb629b2ef9a1b0085b640fec350e2b406f9a911cac906ebfe0906af2ba4619581d72b62f206438da4c2b8066972d0
SSDEEP 49152:4ONdAkFilpQLqeaurUOFEXyZTSmrUasd4kqTFYyldY3Iw6GKWRQ+YY8uhmojawG/:gUB6rjIwLvY7uhmo+wRLm
TLSH
T167164A06F76111D9C829C070A3265323B772FD5D033276EB5EA04731AEA8FE45E78B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3388	elevation_service.exe
5268	elevation_service.exe
3560	maintenanceservice.exe
5604	OSE.EXE
5752	PerceptionSimulationService.exe
204	perfhost.exe
3232	ReFsDedupSvc.exe
1232	SensorDataService.exe
3624	ssh-agent.exe
4228	AgentService.exe
5252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1ac5b391f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\FontSmoothing = "2"	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\FontSmoothingType = "2"	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063e6f8e06363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a454909f6363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000637d72a26363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000522a36a36363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
3388	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4556	2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	4228	AgentService.exe
Token: 33	5252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3388	elevation_service.exe
Token: SeDebugPrivilege	5268	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5252 wrote to memory of 5756	5252	SearchIndexer.exe	100
PID 5252 wrote to memory of 2704	5252	SearchIndexer.exe	101
PID 5252 wrote to memory of 4964	5252	SearchIndexer.exe	102
PID 5252 wrote to memory of 2260	5252	SearchIndexer.exe	103
PID 5252 wrote to memory of 2484	5252	SearchIndexer.exe	105
PID 5252 wrote to memory of 6044	5252	SearchIndexer.exe	106
PID 5252 wrote to memory of 2300	5252	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9d7d09a52764d22a6bc832437c3f5232_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5268

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:204

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1232

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3624

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 804f9c805d31192c6c0b74afa58374e57ec33f4fa07ac43433918724ebcedd1f
MD5 c51171253a619e47f18876533ca74892
SHA1 b30ab6bfd27101144d64dc88c6bfc4eaff31b343
SHA512 c976058f15f7c96a1efbdd838fd52a49cb9200ed60482fcafee8bea55961a520ab15485a48d9d02bc55a73c38105bb2fb64773fa34e87e840a04d303f039c40a
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5Q/lFTjN4:A3q6HjBZLm
TLSH
T130D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e88e7f2f83abcb71776a93337bd6807d319efdd6cadefbd31fc38d620358af85
MD5 d1dfb64ca0ff8afe358567635b5a7c8e
SHA1 d8cc77835c29fc5c5b52c98b54171acccc99c6b1
SHA512 30f1158d91d2cf4e3df6e00eb6c930b851448449d0d5d97e152203957e210c0ccbacb4294d46f9bcca22867d4cb3ac5b456998b2bfb88945955366e5b4b04fb1
SSDEEP 12288:O1XLsswWkxy2lRq2czA6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:8XYfDtczA6nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1C665F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 bbf3c4b3fa294c1a62bbe5cb7dd9834ed6a77c31068dad415659e4cbc1739206
MD5 ccc69a59246d38be93075a5389f1eaf6
SHA1 de7d5b9ad0b54614b6180b4e7da1a54f4a693dfc
SHA512 f3a6f6c38f653408dad5e798b74e3e975dce6925b550bd7303bff73ad75953638baa8c4c7bec5c532d5317e36339e063a303abab96bc8fd0b109588c8b474925
SSDEEP 24576:K0Le5ji0hmxLrMBnQ/tbw/2Mkjy6Fr7g0o3:KPji0Al8Q/lFTjN4
TLSH
T177859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c6a213e9863881e2cbaf0a395a16cb441431bf965cd44ca8307c18c1365d99a1
MD5 31ac8d62c271b550d490de37407a6756
SHA1 3a605c68c1a826973a576fb564e5f6e2b4922d78
SHA512 e516476b9c78a4510958801d4fbd3106be45cb3180f14ab0cf7a6d9b383044a40f1f9bc8710f2b7e7d7dcf75ceaa6e915c4e823970f2da4444b2dcc84b734e0e
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyuvnQ/tbw/2Mkjy6Fr7g0o5:B/ezSC6vUzPvxHjy4Q/lFTjN4
TLSH
T1DE755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c2d9da49c9cad112ad9c8d6eba1c6354af4e16feb2bbcc912f6da06bb859ce28
MD5 b9ee06f63ec300c7df01dadd6546fc18
SHA1 8400c7c96caa1a5104c00c18c2bf5ebd4e198255
SHA512 100e34368c2036f8a4f2e4d20260e4b3af3f66aba6015e1eddbcdec23858ebed0cf02419cce36fdd2716af333b16b9c13e8de6746a5f774d3e03f62888685e4c
SSDEEP 24576:pVbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0o0:pVO88hXl+tQ/lFTjN4
TLSH
T1BE559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b121c9ede34ede624cd65c387b7eba8625330a4cb75079e0985cd17f5470785d
MD5 a97731f62f0ce03ad814545a7c3a8e26
SHA1 f0dbfcc67d5715480fff9a0e6aa464cd058d14e9
SHA512 6aa9346edef40f9983efb3e2b8674658bcb84e6970072a5a1d55edca3ace7702dd2f2bea03104fc2423d7c9981c2f3de21e64d5ac008644db996be409874fef9
SSDEEP 12288:HzFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:HzlnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1C35523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8406e96777a26286fd38005c70a6eacc6e6c75ccce8d6e96753467893af91b5d
MD5 0a7c8db599458be6d844e208fe28ac78
SHA1 4f11328bdedc274d88759cbc2254c4a62a7f0982
SHA512 8332d59d6671aaf5ba8f950752552bab010b2694a02ae9673346010c11aa0dfe263f3e53b42345cae880e535540cd7254869605aa2e0170b2ee38ad50338fd11
SSDEEP 12288:HeBNUbTVO86U2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:HJIUWnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T17C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8bc5ebdd85babd1293424f70e992f5b31ce14ff56da58d3b43dbcd4f6a0e8d03
MD5 b0439fa5e6071010a5842c7915f3c8d5
SHA1 3c0d70219141c96a057145c510977e838dfb64b0
SHA512 c6d65f8ae2f5c6307d5d1ddd46e72821d816b9837bcf51b753740a48746c537570911930001f6aedec64159165ebf00f3b550cd036c251720380b4533d9c9842
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:IQvGAdlCEL8c/yRNw5CULm
TLSH
T192267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 491fed45c849a237c789be2c1fb5d135b80a93a0c77adcc18bb146ca2fc3c451
MD5 ba6dfdda9159e17f8a89ed7f03e2cf04
SHA1 5e9492a67552cc0a350e3fb049e7f359afe10c37
SHA512 a967b24e6388ddec8a4329089a4c381c8d9e8350ea85e838b7ad100b6c0df5c6fab3e745f55f15a9b3cd251576f430644a4b703b2d76322651554c55f4f594df
SSDEEP 12288:TAwSfxL/2Dc39DLLmt0LDQewsAjsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0:MQewsAjsnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T18175E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e076ee4bacb47f7687da1655d55137232e599451cfccd98084f1fa81863affd6
MD5 22cdeb1de988f8297ea9424717e60e49
SHA1 5f07908becf408459214b90f483f8b6e3ed7e601
SHA512 02ad68182ba52aa194539d36e3ff0dcdca4f5862dfdf055e6fed60d3357d2a550260a18fb7414dbb1dd8646ac1836b1775075957cdb8e4baa53de7f92e585577
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3L:GUEtQevvqc2W1cpV2EI32
TLSH
T14C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2cc413dbaea08c3db32de77df9309c71af763ae6cb4b38313308e10c97f97fad
MD5 9254467e207b45cbe2a114179fb9483f
SHA1 ebbecf0dc07f2d6fd7b63f858d98d3f9fb8d2358
SHA512 6cf3fecb671621509f4219c9a8ab64693a28335ea94dd06311e73f9e68ee14254bca4794d94cc9138e474fed295b38460056b003292de7fc010cc7055ed70ab5
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/zMQ/lFTjN4:FoqtVjnmQLm
TLSH
T17ED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4e33caab345db4a70d4b66b0314d2ce65db624b4d5374fdd1dacddf0e4a2339d
MD5 fa8c68cad5c44933fa67bad4f9976477
SHA1 4888bc66bed817a5a436b34e573524ab6c5c472c
SHA512 4dac0e5f9d1d0dbbac9f835ef92185e0c2046ced14a06da501c281be1c0329c4429428808db2f36ca97f3b24e6b94383fbf2e9c119240e2fdf3cb3de3818d183
SSDEEP 24576:YAhGLJIFoiwtA5l7S537nQ/tbw/2Mkjy6Fr7g0oc:YAMyFoiq5LQ/lFTjN4
TLSH
T14435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9ee5801b33b6d8f5a04744bb42c563bc45f1a4249e5390fe05ae02c1fc08c1fe
MD5 56c395b03df8c04953714904a1356f54
SHA1 5ba03fb70fa09a9b03144682b25d4f0c9c67adf5
SHA512 d0afb9ee45dcfa906c48d89437a69dad9ac549d3f1f940890cc32f0181a95b02844e9f9c8cbad43040cfade42184741c0b5ae5491b5138ca45779b076d51d448
SSDEEP 12288:Cmw5HEjsChN2BFgl0WDm+CvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM2:bwuHOWYnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1E665F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ec9776f0bdd62d0e48aba7d70e62c273d8ec4da89af4f53370d2ddd5b0b4e7d8
MD5 36dfc2a8533cf3d1b7c6565a40904f17
SHA1 9016a433c8732bc17166d9f41490f0856e9e2bd9
SHA512 e1f3aceef699707256ebb74acff83952506c9cdc14ea8fd8754df4ddf7144fd2be72c5b92f0f04f1dbf72ef94e839b4ec24cc35ab32a26b264577b2387a5c017
SSDEEP 12288:GXZ1IycGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:WZupnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T19E55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2cc7cd3e579167bc4184bb11e627fd4da3e2d0581bbb839027b19618f7b580b0
MD5 30f2209cd0cbedbb9d1980a615bede12
SHA1 70511c0ec93438c33f07d6e7b8fadc84d2b06679
SHA512 5ad913ed729fe872711f4d3786ce314fa8d5162b7896123e1bee824fb754d7c3a4ba81e98b20cc9d1bc70359248b30ffec79ac4076ddb8c95a8020c081fcc844
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:XQRQyi36YOcPQLvw2gAf+PN3tLm
TLSH
T118666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 50f52b701a006a86f489faede80ae46986ca948ee9b068b78ff05afe09c8b423
MD5 dd4909155717dfb5a422323d134350a1
SHA1 f9eb010a9a6779729c4a0e26a241a544ed08f839
SHA512 7fe44b45a68cb840a06d2410cd815d9ce18f2825073694dc0edf5ec80b3e99815b3aa16272ac8eff1962761df0bdd066cc9e35ea9aac80069ce139d7b7f92b0a
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:MQRQyi36YOcPQLvw2gAf+PN3tLm
TLSH
T1C9666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 408f15f33ca3d18b878c5b07c8b296d10886da3089cf9ba0e18997c71ee8be9c
MD5 005094661e9aaecbc920aad86e532231
SHA1 20191a6120ec2f75f9b319e029572b95f3614ed3
SHA512 71315c2d87207c70080b5c56757e4c950e3207d88e168ba37135610408472f5f52e2ad070bbc7fab2290a60e0525e125a65794ba7146bd039acf0d402ff15f6f
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL05nQ/tbw/2Mkjy6v:868Qg55nhheWu7PNU3/8Q/lFTjN4
TLSH
T1D7B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8a8cf08a3609b0ff06ffb496494c897e44262d55972e6f2e55da0d9558f9b737
MD5 0028c7fc8679610e7a312e6e6b63c29d
SHA1 bcdfe56afa2aff1a8780433078baa3831ddb1686
SHA512 8980a53820b953f1530a480363adefa7237784150b3d48ded9a1192c6408c7773e36b8f1c4e676dd0eaac3087da4abb731c406522089af995e995440e59cdd29
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99S:Ay5112gYy5azzVvL69nLKnhZKLm
TLSH
T11D167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7cdbf8c84873fb3808706295b353c3839a9382833fa6fca7c44b6767b6f7d4d9
MD5 f381fd33592b8d31c938da37a974f67b
SHA1 9158714dd778ffa7854496bc655731c7c825e605
SHA512 2ce9580456d8c99f094f0925c805771c3a374d58deffd6c188f62c2424a156af28bbd51506ee44938abb82bacc58a37df1ff66bb1dd3b419f65f87e9ded8220e
SSDEEP 49152:2B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKQ/lFTjN4:Eu6JmVxd2dFLm
TLSH
T18FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f5ce200dff93e814f128eef1015f62457b516f6c4c9111f7efa4a22e1f94c4ff
MD5 16cce36cadd8a9b23568d3f4cc875756
SHA1 0a4862f1e5215f13196ce796fe0155b9f9191755
SHA512 b292cda309434d51d4b39b3ac92640ce20601b9b9027d5ebcb96bbf4fa4d757de93a3d6af753df264ec9b7a9cfe3f0a67f4a75ea68775943b1c2f855ab041940
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4x2Q/lFTjN4:9mifPbRQLm
TLSH
T15DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a7c7fbccc4398f0a81d7d977ca5aa70b3baecdb6454b17628d60fca2eda07950
MD5 b753776a6d99eb8d963d7b281aa9192d
SHA1 48d339aed7a6ab98e025155d6aa46016453e2f5f
SHA512 5035b1a3c94dc0afdfe9656fe2f7ff29d8156456dc696af14cdd372800b78c52c36a71b2185f6f8f17d5992c34f48e0a728102c2639d6a3c2cd91b20a12fe61c
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqpQ/lFTjN4:T5dKTi61eLm
TLSH
T10BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5fc659abd258cbe755bdd11de01c36b7523524a76f09a3e4c28d9d2d584546ca
MD5 a5e7da2065236137c21061d9ed286b36
SHA1 883ff6ed427dc0eba453c27a9d1a9f08c2fed4f4
SHA512 ab56aaca570a469ef239911d9490a80204df126c0b0e80296713aa3fd4963b4bdc9fa989e54f2fc72c61bed4cb7ee1153aa7e9636db402cb57db22e488fe3d6e
SSDEEP 49152:ohtSn8EApI0figngiDn0AP5w6Q/lFTjN4:5X2iyphcLm
TLSH
T19995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dfdd5b576728a3a43fe1e02aa0cc096bf318d8e4397a38dcbd6f380e8f3a6358
MD5 8e13dc93347ba355d33caa40771694a9
SHA1 874a2ff916eba2c67019e2a4a6fda75125941117
SHA512 527915d2fc520bac6fe8ebffaab0e1637422ff6d8cb93cd43dd9bba93cf4d863237de669744d46fde41701396ffe9bfba71750ba74648fd19134bfee42738be4
SSDEEP 12288:9NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:9tnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T15F5523697965F98BFB1706F18C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d7c24144c0b1e7044ef60f4b70b1ae9face8f515cf73db5193cf1e7617f718e4
MD5 961d7ad11d37325b1e1a982173fefb4a
SHA1 773f96bdec14a990252a0fa175401725bf07ecd7
SHA512 176b04b9017bff8cb9616e4c43efcdb175677974b83172ee4ceee6f0be0090d6620e5c93fb3fd8993a536f6ae5b1c8c6af6ddea67e68e6972c0223fe5530f940
SSDEEP 12288:UwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:UQnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1735523697965F98BFB1706F14C828182973B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 930eef8a5ca7d91b21e00e4b3144a7a55bc51465fb4608f85b6cb0fbffdf82be
MD5 7398d21ae1544d8cdea1e068939d5fba
SHA1 d9ce3c85838e2d56b3cd85668642912cbb186f5e
SHA512 60614ec7cc2d4159711f5822ca050a3e0ca2967adfd26d3e52bb0a2155965addc3a7ac0bc6ea418b6a4fc9944348023bf5bed841eb5dcee52c9729131065f9ac
SSDEEP 12288:r+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:r+nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1B95523697965F98BFB1706F14C8281829B3B0DC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2436d0ee592640b7d3a7521d0ebeb35426a5e129510fa2fa595d2864565bb452
MD5 0779e7c453587a6410c09712f9ff4478
SHA1 b5e43d0167d1d2ab7c92c352e4fdc88686e85c7e
SHA512 60ecc364e5992a684594f55d40abcfdae1e6933b032962be41aaf01549024362f691f1369152bc17c068774adf6ae1672352ff26bc546db254db4b62ee24d0fc
SSDEEP 12288:7VrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:JnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T12D5523693A69F4C7FD2742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 64468d8afa8d43e4f6c01856791eeba895fa6e4733e02d966d681a2fa3978113
MD5 fefdf0aa7d63b552f3257186264f1a1a
SHA1 da84e3b747f18f68d31423d37d7012d5382f3701
SHA512 df6024f823c14a0f1856892edab08ebd0ac719f3a580bc8c0f2aafe668d15f43d504c0b4378e2f1017d3d7251e4d7c7f4e077d1a2139dc8a44398bccc3b653b0
SSDEEP 12288:+DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:+znQ/tbw/2Mkjy6Fr7g0od
TLSH
T1C65523697965F98BFB1B06F14C8381829B3B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2af9351c1de389214d36affa3cd12fecec4de970440d1a5a83df8fd4c1c68f28
MD5 f74e5b91f4c659f4b62dfa8e7d48af2a
SHA1 ad1724eac72e4c673ef5bcedcdb148b3b9082061
SHA512 790523322cf8f16098b01b7c24a8e3b3c901fb22b986163bb5e60d9d5119295411304ebfa5c8ded91dbe7c6c085cffc3d4421afeec698aae899cbd2a3b08c2e0
SSDEEP 12288:DUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:D0nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1E75523697965F98BFB1B06F18C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fa72847c6d47e433a24b3c81b716d96bcec2086b792a90a0c54b2969b321ea29
MD5 cfabb5d24f68219de5f9de4322c7a89d
SHA1 4d7c0ef8e43a951f651dd7c3f83d257022d216fb
SHA512 b6c8b7fef72e350a1755ac13ad9496905aeeebb866d2bf12df53d7f40b72af97171b7770aafd3507fba563b253c38ba8792aee840824f3d375d4b2e5d4c6a6e2
SSDEEP 12288:EoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:EonQ/tbw/2Mkjy6Fr7g0ok
TLSH
T16C5523797965F98BFB2B06F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 88b5f065ab66d22d6acd2a001e88932d60bb2ee6f6b7b239e2ace9ee8727c9e7
MD5 cb0d4a46debce9b0b362a686d9175f22
SHA1 de8a4dea8e74a74807b2af66604c3f63ec12b730
SHA512 0e04d9392fc231172963ddb9eb26dfd99c2d3a68474ad20851042bb074d1b0ce6dcc818732a1db53e0a133274afc05e26880340661b73d91e20c7d34fc69d8b7
SSDEEP 12288:piZwbDzzFEoS2cPvyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:sZM3zFVSOwnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T14B7501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0cd883f5882d4b3c1f4a4fa9183c2c262ff5e16d53ba1e42b4c0685d5dc496f6
MD5 4f195f899861b14d5c74f24f7489b2cd
SHA1 24a5d1b9164b8fb428e307bde613082b6300f907
SHA512 307f8c9e410a0283d274de5989248251510fbe66be1491725d7ae0d424912e8f06fc01760ba0c10b361aacbd90eaa05481c314ac23a029e6796a34f690ff1d52
SSDEEP 12288:PJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:PZnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T16B5523697965F88BFB1706F5488281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8dd74c2e66edb40071e7bf53ac8adf318c26ecb0df5b7d389076c28937886560
MD5 93e6ecae2999c1a972208133e5a26a20
SHA1 2fb62065bad92dddfc4061344e3d02e994b7d5c5
SHA512 81deaadc58082f959e2debaa0994092620550d63bc3fa0ef5166864ee2114f30b440503c4734ca5574838867b096991db26e47b4e54240b814c8e553783bb47d
SSDEEP 12288:n1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:nVnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1A85523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b5822d0537040dd9cfebc5d884342c89e03abede488394a2e47630f9d87bee68
MD5 979e125c0b98c06016d9f5ff1ec225db
SHA1 2d4c5cf54adee131cb673376f61e0d4a414bc260
SHA512 5467804b596fe070079ec51d978d14acc41cde0139d91b4a414d122c50226e202c642ee91d570ced198bcacb0a6bdf7a0e28d776081ca152af0d27b79d8f9d26
SSDEEP 12288:KyPz5L8cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:XzycnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T12465021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 88c60bb274f6f28b8fb62844b958c34cff518462d7c5824916e319acd27c4ab4
MD5 401cb9f8162769c4ab405ef891fdc804
SHA1 517ee4cf42f998e17e76cc54e961b42d954e4389
SHA512 326b8392c6c5369af3a97d25cd03b1b20b6780915efe89f19ff836cc1686639dd361c8ddf3db3144f30ece3d71402fb5e144cb655b23e459ea7fa21e745c428d
SSDEEP 12288:HJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:HZnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1EF5523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a036cc116d648d302023c48f71f3bd78925d89bb9013e103f359c35e1afbdd05
MD5 2a7ed4371d64cd7845562a98fa176c11
SHA1 b201c391383d5a53798fd23758473d1a60e9c3d3
SHA512 7c4459b7ed197354a1b39430e7f7952cf0cc4b9081381aeeba251bdb485aad550231170ac410ad35cab3de3cd86e85fc62e4f86f1198d9ce377e19feae3d4508
SSDEEP 12288:SJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:SZnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1D95523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 39c9a816adb24ec9e0e0faa41502682a5da6785ab4bd9a46587089ceae07d8b1
MD5 19424955bffccee9ffc157f3fe140453
SHA1 52dde257683bfe8b4f51f103c5b7f5dca4a06941
SHA512 058eea3962007468f2cde0d3e761304f33b0b8ba09a9f673ed621e304a78b895c68ac612e4ee37cd1330eb54063ba9d09c0d5c1e077662341989956055ec67ec
SSDEEP 12288:3yPz5L8cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:6zycnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1CA65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a343ff83347fbe6a3a509b3fb39b1864af71f1684eb81f15f79c2df064e5a5cb
MD5 8d4df3be8015c337575d376e92f7880c
SHA1 2129ef5dbf69908b5b17b121f64583b61bc48a13
SHA512 c7aa53b9cf11cd815bc30f94faf9568727f5a9653bda9892460b1740cd8b640294a81d0f1749a6da232c12c86ee2a39ffc22bf2997ed08c3afd1274fa9cbd2b5
SSDEEP 24576:5T0aLl3z0zDOnQ/tbw/2Mkjy6Fr7g0ox:5TDLljvQ/lFTjN4
TLSH
T1967501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 03f5f39e55c9dbccf12773b70a33addec194e2d59f6db34fddc15ba2a34d5fb5
MD5 5f7b7d7c3fd4587a2f88239412cd7443
SHA1 5ba14e78c3d12b908f49eda05f3eb2bb64d59f03
SHA512 df94c296e3ec78840c1f8a815e627b4a93c13c8277efa35908d7288dc08bff60c45f472c77c36abfd4997cddc73f6059aeded756d9d67870d43a199debc61124
SSDEEP 24576:m31d9CHKy7GZCnQ/tbw/2Mkjy6Fr7g0oW:I1d9CHKyakQ/lFTjN4
TLSH
T14D85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 78d2d53799c72eca1bc0843c5f831357fd0c15ed130413fbcd2e4031fb2a6431
MD5 e3f0f74526f559d6faf3d51e4e0448cc
SHA1 5fb73c75dfb7ef65e71d7c85ddb8ca18a34e856a
SHA512 ff61f9905ab4bae72f668daafe5d85b615f6fb0e8e482f513623650918002b26e5c72decfadcaa42181a93b4f2eaccb2ebc67b70181b138319ccde032f1b30ea
SSDEEP 12288:8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:8enQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1A65523697965F98BFB1706F18C8281829B3B0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9cbbababc50d75e1d39463e6319f05354c40cce84cd1c0a389aa14154b55ff42
MD5 21bf599bd3148f4452793799d022402c
SHA1 8cbcaa8fd2923d33366a874a97cde6830fd18159
SHA512 9c3ddbfee893fed49e7c9713d80ce658dd69dad0fa8ee47044ac17a1d7e9b2169dea6be5c9a7bce508b790ea94d0a3aa35ae88e9393b708b28aa759a566ac528
SSDEEP 12288:q8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:q8nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T11C5523787964F99BFB2B06F14C8281829B3F0EC6BFD1938F7B481129967D39406C6784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0557fd279f7445cdcc07721693359161ff3b807a301726ad1bd1822d361545b1
MD5 27e09cf659145d9d6815295038577ea1
SHA1 3d873a9321729a4775e4f3b90b14059c30f7a1f4
SHA512 2f30824c5f85dbe83d1749262d9ae834e9ccb20644e91ad9feff2154c778aa1c16b1f79fe6769cf9a20149fcbe58fd25b5428bf4459b19a2a7f50fd37d6825fb
SSDEEP 12288:RHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:RnnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T13E5523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 34305f1327d87539a64dc2c1b176deed5fa60173338a990201ac42a8c902a803
MD5 cd20e6a6ff2b110b1a0c5810516b491c
SHA1 2932d084e4f78d7b725643dd517801b5a5a71aae
SHA512 6082872b11f68764e8dc219ffb4290d87b397584d6bc909aead0bbebe669d6c1bab0a2fcaeca018c46968bdf6fabb9db84c616e926a7380d06966790c015f20a
SSDEEP 12288:GJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:GZnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T19E5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 41a39d6258e42f34e63dd7df3e72c73edd70743ea6b3bdad68b06fb68a3859dd
MD5 03060ddc48de1daf9c033ae2cb4ce9d3
SHA1 f4d2d172d72b8bd3e8a62ecc14fe789bd495c312
SHA512 d91f028033efa6796273aa66fb4f4454001d0e9b6c11bd6b1bb802be0a6ec6326f7601ce272017cb866a66522bfb6bc46d8e4892c55b6ea2bcfc636e4e59db60
SSDEEP 12288:ueGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:uenQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1495523697925F98BFB1B06F14C828182977F0DC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bd75d72e0543e69d53f6e2e98b312383722285313af13835925541de359a0021
MD5 37bc0c5c2c38312e70ca2cd7f86498f4
SHA1 92002f67e105c93e5caee03b48c4596c029c9ccb
SHA512 f6e907aa53df9909f172bfd14e4aaa6afb222e22af4c7a0f8d6ad67c4f92e7f765d28623e271bbfce4975d3f1e581920498b1dce42b5504ebac25d2a1de39493
SSDEEP 12288:QBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:QRnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1405523797964F98BFB1706F18C8281429B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a05bb8988310a6e6db7b1e8f9c977b66321d428958e6eb9f96dcfc8ac6591902
MD5 53b3fbe0c21dbc4d3089642fefe3e2d2
SHA1 d5cef46e8f7f3f43795ba85e34ae1b16a89aec6f
SHA512 dfc449982378841e9caf446930740086607537612f1680253d12e2c80fda347de44ec3db8eb35f48ae8d30bb83fb8710cc73f4e8e5225078cf02f16b7a2cb312
SSDEEP 12288:YDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:YznQ/tbw/2Mkjy6Fr7g0o6
TLSH
T10A5523697925F98BFB1706F14C8281829B3F0DC6BFD1A38F7B482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 dcfac61364167c08869d7716dec9dbe5769e72740a1a3c0fe6b28b247d738519
MD5 3e7733055a4478cc48b1299c7503ca67
SHA1 159e47cc4ff11f539ad3937eecbed0b1c0c50da0
SHA512 c5c4eabce5a5f1129edf11e4045f0cc6adb374006ee4669d77985211eb4d2ab8bae10b41edb6d8f1b38b4652b67f70796121cf2a45ced1586787acc83a7efb67
SSDEEP 12288:6mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:6GnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1725523697965F98BFB1706F14C8281429B3F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 f36e6fd9671d9ee421168f9b8dfec4b1e7da32a54bece6141412345581103105
MD5 3be8a2724acae380bf918397a14410e9
SHA1 aec30d65e29a386ead8370ef8ad285419c3beb5d
SHA512 27533ea72d51404de5969044a65f12f42acab6b574427712ad66dbbc49f55d360a1a2d755503e8f5d8a05ae3c0c837a4b1de16822e1fe1790c1c8dd29af9fd43
SSDEEP 12288:oDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:oznQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1785523697965F98BFB1706F14C8281829B3F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f6134b4e634e35361363b347059b9d29e53da53b0ddeb1887a55105bc4d2a712
MD5 a69c250de9f15572a0203f0cc3a1315a
SHA1 38b1c5b24a1500aa3593b454afa7db7d6160cd13
SHA512 697805e8b988503ad66ded79eae8899994b233708f0f1fdbb105627f85ec609dd2e0993221a71832474196e5eb29ad02d75be0801717b386d3b8842da9ac8db0
SSDEEP 24576:yfwv/k9RX6wkyAIFnQ/tbw/2Mkjy6Fr7g0ok:pMnYIFQ/lFTjN4
TLSH
T16585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 155b1d720b8411a45f1e7c5708683192ea0275db9dc10f3ea412a6dadc3ecafa
MD5 6aa1bd435fdcbcb63728e3b1e3ad0803
SHA1 c7332d0ab04742af455416b60a89f43440e59aef
SHA512 d6b3d02a75ba2ebefe59fb53d0a7bd619448ed129188520cec2a367d43a7427d71028e355b6ec6e7cb4de5e69f59c292bd325b6ae6d18da4328ee9508f4ee85c
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aQ/lFTjN4:iySzPNLm
TLSH
T175066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2d02b14ce9185a67aadb507dccaf64b12020ec6505e156f8e2ba1a8b529fd365
MD5 f2ff55f0c5970b9c7d97ac0d5b196c22
SHA1 be3df01a20eae287715a9e2ee69c86e5153115f1
SHA512 3fbf66b25ea5abab8bfb47416a828f9684f37cec7669595d260e002856ef2521f0d8d33fcb7db8e5075d817a1d69d51c57906ff03f9432cfcdfa63722efe5ca8
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgnQ/tbw/2Mkjy6Fr7g0oH:C47JUQj1irIhCnDHUPfF/KQ/lFTjN4
TLSH
T1D165AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e0ecaed75483aa544abad7c1816aa3190fda48a0bf20c4a1a747494435eb0a3f
MD5 ab7471f62d3e577172bda441229250a2
SHA1 31729f4c69d7c855d13c374988a537d12f5d7e1e
SHA512 3ed08f2af977bf946f6610032e977a8f8ed33b2ea51be04670e6465cb0c7a1f44b7c6b43a404be38bc890b1dec815afcd14368f2c0813185993b66fc1ad4d011
SSDEEP 12288:7ssfZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:3pnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T10A65F119E29852E9D12E1275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 51fa6f0aebc22977d00caf404f0a96409c199b0ff6ef9750d84b3c337aa817e2
MD5 ed9f8bcf3165f583e6ffd4eed0e6106c
SHA1 01a04f34d0118e75aa25b17c2bed9e4ff07f2275
SHA512 ac98de65956f66963f2fece15b08d612fc4955d4eeff52f717b351ff48b8b906ac2939450735b282a124f2c3964fae57bec1202039841306d56b53afab207abc
SSDEEP 12288:vFLE3vRU3fc/72/Kl1dGa9jAos958QgeaRMo398oR80N+:vF435UP3CHdNA5z8QgeaRMot8c80N+
TLSH
T1DC4529007626DB8BC6A940321E76D6CCA770BD06FE059F0772C9873FC576659BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 0dc0ec3a669d9e4bd3fa4dbc62cbfa1669983ef2e75a34ce83bc679b6bf58bbc
MD5 ac004689da111882f2faff6398ce0a0e
SHA1 cae441aea51b244208c527fd474ac3ec96fcbedc
SHA512 12170c24e90fef28252639db957954581e3b30b84125e9e1cd6275a3c2f1514b703548d156e69cb67218a543ec0e8a2770f3ac0871275a1ce9f7d4a835bce10d
SSDEEP 384:8L/llZlld2lTNBkYL/llZllYAZBkYL/llZllJ:8LllZllAlTNBxLllZllYGBxLllZllJ
TLSH
T1AA72D994F661EF62D8B205374DD9E3DD2B78F83D6E650303B685139DEC086864EAE2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 236ce03b220176c79373c51907272c63847428c1bfd93636c503e82f6747d2de
MD5 72992d21c0730d240068d84bcdc68ab1
SHA1 c74f0a8a0fe4c3b3f733cdfebfc4ba09958da505
SHA512 99e1776d0fd93b6918c42a61df0976c50210ec89071896bfc73a505b7cbe3619e18d085f92c320587dd3a8b318b2cf9692494e70007fa723002861249074b1bb
SSDEEP 12288:jWCgwKct98Us+H+/XlNaGZDVaLaduHarlJ0:jWK+nXlNlZmQWb
TLSH
T16E551B4155B7EB4FC9BE403703329A8DAB649C0AB7493F05A385C93AC877A5DB5E13C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f6794d3d5ef0918a80ea448b7d330a9995a5faac446d4e45297fcbee11d11c6a
MD5 6886ceebc3194077c50b7fab55fee654
SHA1 cf1f1c5545adb73193bfe816c300426f1e907ec3
SHA512 552be95bec8cb0f38ef2f54c270b0558f618a55c352e5018737f8d57384d315cd7b35fa9cab0e26132731f6d538a5d6b0cf7d374ee664cefda60beefecc740af
SSDEEP 12288:X67RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:+hnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1A85523796668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2f66496f42bf18ed29a0d32dcf9de212fc0014a8f58ebfc61414e75dd58f7721
MD5 98b2e812037f74909afd4fc9ae457faa
SHA1 ff4e7a6537b3305f658ace7b81c1d32c007688c4
SHA512 0ab075d05ae0e69372fca5f59bbdfa70e7b0fd9aafc45a88f24d7b91292ca8e507e21de6226ade3ad8fe993ef26fdf2fdb7092453234cf9173640284fd034ea6
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYvnQ/tbw/2Mkjy6Fr7g0ow:Jgb4mBIBhGFgQ/lFTjN4
TLSH
T1D065AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e4eab2d22f2bdab8c44da16da32101c8f4307b0455810aa41d2b1d48e1b2629f
MD5 4488f017afc9133d6b0d6fe32ca8da47
SHA1 49ffa5c877df271aca086166bfd8904192d194e2
SHA512 fd0488ac496356efecb6be366869527b7a682605b3444b6681718cc66c4a4553e08b1ce317cd232632e80f58e5e7744a02798cc63a4ba1aef1655c540e3b04aa
SSDEEP 24576:nG88u8FpJqH1Qzria7/mwnQ/tbw/2Mkjy6Fr7g0oK:G7ZFPqVva7/HQ/lFTjN4
TLSH
T15985F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a78b42e37614ee707699924077ae3ab7ce1d8e03d401dd740948334ad257b874
MD5 c6da0cb417977c690746ca346c8ba4ec
SHA1 83efaa711f5c1482a2982339dc9a848aa688bec2
SHA512 0fb12b6c886506d142b069a9420b9e2e7aab4cdd6967021a4e2b447bd6ed8d577831167355887636c26aad7c52f2af1894dd37948f5a3a01c1442e3879ad3c62
SSDEEP 12288:dHvUrBFrEjwaQEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:dPUr+NQknQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1C165E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7228f12192b60d9a5e58913e8e89d364f11e728a0e29a764e40c77e200418092
MD5 d3ed0745379693ab39f84cfb2a1601a2
SHA1 c98bf76706b95032e3ddf17b5054cea7f06fc686
SHA512 6c43a1217fc7619ad9729a9a8d8021261645a1240f2b76c8dbf7e3f881166546ccaabbb6e5d0c41e36c8612d4178472d6834ced8796ee17661c4ea8cbdcd42d1
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0Q/lFTjN4:fG05lO43bSLm
TLSH
T13CD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f2c069e8d905a5d0a6768f72d6fc924c0d88e2bf731536c4b0785f9574d3a3c4
MD5 a61fdd1b69b07fe4f9ce3415747d7be8
SHA1 84203ceb33492f0b6d5dbd4230781e8d17cd4457
SHA512 9f8da8d7692900afbf4f10de84ae71204d0fefdec18f292a34c1591049c6bab89a4189454950d44e6d3f805fa9f4611fe3e5e4275d7d251210d9f14897cf316c
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnanQ/tbw/2Mkjy6Fr7g0oJ:ea5POZ3+Jt2pasx2+m8Q/lFTjN4
TLSH
T1D565AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1e831edfd6659e9fd3c3308fe7c9262ec40ef5e6a78a767e2c17b1a42a2708cb
MD5 10cc88f5e54b241aab4b0a9956803bb0
SHA1 67f404898cc41c662d26b6eca9e4524acd7b4f52
SHA512 de24b51e10eaf38b2dd92d17946d2a50fe916242bae7dd55c97d8224d4742955b3c5168353af8a0d18bba5a221f3ba6940f42177f72954d192fec4994df305f1
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fk4nQ/tbw/2Mkjy6Fr7g0ov:iNc/zEOVHFnQ/lFTjN4
TLSH
T13D858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f931add92689e127a40ee964b1f37209bb920c917d65f6dff6712cd77517fe9d
MD5 30da4a3c969a9f4e5d32a675235c2f4a
SHA1 545d03dd89b6e7b69850a315d8d77372aa2acf3d
SHA512 3743083133a56a5856c47325bfa28275ed644ee80439f0b247a17b3b2c38a30fb97d9be1029cc8302d5fde6d4bbd0299a22181adda942ae76d02c623a708b2b2
SSDEEP 24576:28kNvNnaFeYhJNtmZBmGnQ/tbw/2Mkjy6Fr7g0oT:28MwBtOmGQ/lFTjN4
TLSH
T1CC55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 194e7b4de91711c1fe7c95f78006c8333099a962ce47959a6847fec97430c64e
MD5 ead31c138c519b2b04de8754f7aa1cc4
SHA1 c8b84e9093827b5e90ef613adb773c4c7cb09cfb
SHA512 529f41ed2bae7846145d53f5567012d9c80d94bc201b5f5ce33b132b6d581a54d1def425343089b5b2fc454233e8a57eadeaf89ba5ed70f07cfc96f2b6f0daae
SSDEEP 24576:vD3FHshBIYQgANnQ/tbw/2Mkjy6Fr7g0oP:vDVHeBIAANQ/lFTjN4
TLSH
T13A75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-311-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/204-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/204-78-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/204-83-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/1232-365-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1232-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1232-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1232-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2260-381-0x00000229BF9C0000-0x00000229BFC4B000-memory.dmp

Download

memory/3232-88-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3232-95-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3232-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3232-382-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3232-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3232-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3388-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3388-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3388-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3388-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3560-40-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/3560-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3560-46-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/3560-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3560-50-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/3624-369-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3624-120-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3624-122-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3624-114-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4228-133-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4228-138-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4228-126-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4228-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4228-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4556-319-0x0000000140000000-0x0000000140435000-memory.dmp

Download

memory/4556-1-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4556-93-0x0000000140000000-0x0000000140435000-memory.dmp

Download

memory/4556-9-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4556-0-0x0000000140000000-0x0000000140435000-memory.dmp

Download

memory/4556-310-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/5252-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5252-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5252-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5252-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5268-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5268-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5268-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5268-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5604-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5604-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5604-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5604-290-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5752-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5752-309-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5752-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5752-67-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6044-408-0x0000029D8B7F0000-0x0000029D8B9BA000-memory.dmp

Download