2e9d5253ca0d4927d9141e7b9157c6d19d8adf1865d7cb43504c2991c3d1e163

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
Size 4.6MB
Sample261027-apd7saat5n
SHA256 2e9d5253ca0d4927d9141e7b9157c6d19d8adf1865d7cb43504c2991c3d1e163
MD5 7025b7d9251570fdd3e0f10e66f0edde
SHA1 26f46d553440108bee43fb72259e6f06b9957803
SHA512 804be4edb6e32decf354c7dd74b0972c3e7b3be20ed474d3f3c6cbcfe15c8f4ca81e5db35fb0c377bc067378e9d8aff1bdf03fd50e84093b89a9a83c1f3d6f05
SSDEEP 49152:xuuIcmSwlKxviq33uXM+mDiHDqrKgMXRIxp9ZX51q9SASScpfB5X:xyfmF8oQRiF5s9SVN55
TLSH
T190265C157B4A58FAC05AC170C24B4B729A3174DE2B36BAFF4084A6743E75AF41F3D298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4696	elevation_service.exe
2336	elevation_service.exe
4380	maintenanceservice.exe
2220	OSE.EXE
5832	PerceptionSimulationService.exe
2528	perfhost.exe
708	ReFsDedupSvc.exe
1776	SensorDataService.exe
3816	ssh-agent.exe
3948	AgentService.exe
5988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b08c854c67fac3b7.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005057f25ba965dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090f2e25ba965dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000020bd6c5ca965dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d20455da965dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cbbad5da965dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d3b9d9ea965dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be0d6b9ea965dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	3948	AgentService.exe
Token: 33	5988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5988	SearchIndexer.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
Token: SeDebugPrivilege	4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
Token: SeDebugPrivilege	4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
Token: SeDebugPrivilege	4116	2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
Token: SeDebugPrivilege	4696	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 4132	5988	SearchIndexer.exe	101
PID 5988 wrote to memory of 4428	5988	SearchIndexer.exe	102
PID 5988 wrote to memory of 4500	5988	SearchIndexer.exe	103
PID 5988 wrote to memory of 6084	5988	SearchIndexer.exe	104
PID 5988 wrote to memory of 3284	5988	SearchIndexer.exe	106
PID 5988 wrote to memory of 2948	5988	SearchIndexer.exe	107
PID 5988 wrote to memory of 4772	5988	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_7025b7d9251570fdd3e0f10e66f0edde_akira_cobalt-strike_glassworm_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4380

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:708

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1776

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3816

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 01813ed8945b57b28eb3c086c6942b06c6b32a7a22a296b1e1ae8af50729b463
MD5 822d16edd080f479e19e176572389150
SHA1 8f5e15542f340b8f8118eae0ebf2ffc07b982b15
SHA512 09fe4a01bbac07abfe3eb68373379f505ac0e87abcb5fecc1abb4c298258b4d07b8e9b95a8c97ae006016d9a29bcf9723ff2feeaef9834ab91537989b513ade3
SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSq9SASScpfB5X:J3q6sjBW9SVN55
TLSH
T146D58D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c309efbc87763c1bbbf9d88186d256f940d8e1103811886c4a037a2001214e61
MD5 bc9f30725a225982329febe38cd570cb
SHA1 faa219664e3c41690f9545dd782a2265b0a0ce8b
SHA512 2182fad320cd0123ceb45186e4e50202ed773428f76b86b4bbda317a685c39eff7734f4bb46d59992c1761f4d64008ff66c17810cdf74ad23eab7493edeb5f37
SSDEEP 24576:tXYfDtczALrqUQSAlkSB+pfAOQ+7jXjra:4tccq9SASScpfB5X
TLSH
T10365012867D408F9EC578238CDA28411EA73B89547A0F7DB03E49A650F337D95D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9077942b923c0cf36c70c6ad4c99505b1d273848c891534c6af8ccbeccee9ca6
MD5 a06c74d485c9a1339db9d88ca333984b
SHA1 f32e7bdd6b2d780525f8d1c6fbd7b1fff8bbf52c
SHA512 553c90841d72c91eccb2deff92e3950b8f5ecaa46311b52c3881b335ec0ba83b3cf6e9451bd48b6bffa103540d5f61e746df3907000413a94d29ed3198893f7b
SSDEEP 24576:50Le5ji0hmx/rMorqUQSAlkSB+pfAOQ+7jXjra:5Pji0A91q9SASScpfB5X
TLSH
T1BF85AE65F6748331D073C0B9C5D2A69AED7130861B308ACB4286D77C6F67BE6893A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ed35e438a24c106080659fb91794eb448381faa730af876c2e4a542264c6b874
MD5 b62cdcc48008bcd7db2ccee63ca1ca44
SHA1 2b11de83cc9e83566d98b42ed7e6e77ef7b58eb4
SHA512 83e87b674b487550d47ee2e41b71e7cfc4ecb93f06c21d642f691717ed504985dc8052d154ca5458713aca6302470a696d4744ba72ea6a14f41978c63f553581
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWn6q8wyuWrqUQSAlkSB+pfAOQ+7jXjra:K/ezSC6vUzPveHjyxq9SASScpfB5X
TLSH
T1E1756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 442b338721b9a6bbde9942e91ada9690d0cfdfab8884ab9f6e366aa6cb271b65
MD5 8479ca38276f7e9f5775b18a1840a4f0
SHA1 ba7a50cc919062042a30efdb86c62707b69358f3
SHA512 9753bf294d499aa8eb87b4cafff8a8e7f4d980b615b5051f3e660fe4ec969db98f1049217f34820209b572f4c53bc34fddfeb58b2e1e3d8e11fbefd49f214a3f
SSDEEP 24576:LVbqPb88hv/l+YvrqUQSAlkSB+pfAOQ+7jXjra:LVO88hXl+Uq9SASScpfB5X
TLSH
T196559E66F5748331D073C0BAC5D39A9AEE3234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f9a389b943555a5196893174251200006f52bdb05da026bf7c377c4286caf23b
MD5 6e03eae0189705ae01dde98d75897a41
SHA1 55be2b23f5d67e2e27fab6fa76e8aab4e55d8150
SHA512 47b5216b36bdb265f97173c836f8531174bd55d5cd5e4621faa94ca7ae873ff01168f078cdd2edbb6735d1468a2de7a65f68c08ad46075e5a8848b4ded3bd8f7
SSDEEP 12288:sh1eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:shsrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T18D4523E44A5435F1E68706319E4E44E0DA78AED909D27B99CF90EBC08E30A97DC5DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ddce19195df52ddb03db7b4d4d1a45eb6de91dcf79c359214690dd81f5ed0829
MD5 882b9a189a2295d0101ec9ffcc75cd24
SHA1 350c7640808640531db3ba7c16a1973c6faa6760
SHA512 0b7a2d8c7409c2cbfb82d6cb3f360ef3cc1baa0992031859fe9d0c9f306105ca4ea504ebdcc8ff36594ec29653f40bdf8e42a84a092033e6037bb50f02730fd9
SSDEEP 12288:aeBNUbTVO86UEeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:aJIUHrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1F365CF7BAE28FCE2C27A4D785A918640D77278704F62A3CBD265C30ECE235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b91cf5d0c423a9b14cb2fbf0502281cd86e0689b1fca14c15a43300383d61d51
MD5 aefc21bc8e5812074d70b1e44777d597
SHA1 ff096aaa14d454eb514ba58350079c490c51d476
SHA512 b482c5e79310f5abf3ceaba474a3b5e76f815d5317cc2a146913063941d498ee7f1402068182d1c4ca283a195c83fb4536e3ec8d3ed1420d3ff4309266e1b8e6
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:jQvGAdlCEL8c/DRNw5CH9SVN55
TLSH
T16B266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a133fbc6d4ed8e467d818a56025b20ae042a8f290a37b4dbf1e20d22f0af8751
MD5 c648b4b9c719fbfeb1d9cd6a1cb9190b
SHA1 ed2b7a68d3c49fa9d8ffaf46abb7a70031c0250a
SHA512 29dd927dd3e646ea217fecc8299d041a9331c952a80aa160603f432143ead44b2ba4c77481e4d4adf9bdccdd1b37d974eb9bc0f3146e53da1a13da97a314b93a
SSDEEP 12288:tAwSfxL/2Dc3HDLLmt0LDQewsAj6eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7+:e+ewsAj1rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T12C75E071FE74E432C6BB0DB21B26C715547CB9604B912AC3E3E88E9D49302D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 af241fdfb963ac8e437a85ab4d24d68fa44fe4ab7eeb8f7b95f5fe9b632f174f
MD5 12df78d3001f73ba2c5e36c1ab8d54bf
SHA1 45bca91c0cf14dfa073517979722c353304d2654
SHA512 64fbdc821aa0b6c0e4bd93d57ac146682690b0f081bb9ab9ff4fdfb8bde34dbab212c2589945cd7f42d54468c00aa4dd32c7189bc37c154e70b4a48c3e265786
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHPVL5:oUEtQevvqc2W1cpV2tI327
TLSH
T161474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f48798cddd5dbbbb2dc6405be908c3180b9310140b63c236bb55347abddc1e7c
MD5 4cea1a560f8fe9702dda768d6c03e64f
SHA1 451087ce207e2764ecf020843327cbb73d2f50ed
SHA512 c12c49bf579aaf1ee7dbb027cdb871fdf8f2378dcbec52b00cda2d0eeba3a3b0cb30ac335c5a8ce7482596a81e220ce4c4b6154afd13b76d7578ecab990ba428
SSDEEP 49152:xCbRquA/m2yL5zifFiV+XenmE3/zFq9SASScpfB5X:+oqHVjnmD9SVN55
TLSH
T1A0D58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 808c7ab4434e9bee156a381cb96bae2238ef68fa90653d28386fc1e0cb446fc5
MD5 f7b496345a2b31894501a4c8459cfe30
SHA1 b5d3912349b36257cfd7fc666e7c3646dbe34d0f
SHA512 62b4042378443c37a913545d9c627cce5e45c4710668ef11cdb8de4ea6734e2b731522282c13e2a16a053b72a620d5326e911f716da3c495a5e8b253c61d8256
SSDEEP 24576:PAhGL3IFoiwtA5l7S53SrqUQSAlkSB+pfAOQ+7jXjra:PAMUFoiq5oq9SASScpfB5X
TLSH
T1D9359D80E7F955D4F5B3AA789DB68170EA76BCAA5E31D20F1250D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 324bf36cb1b8454a2ee74bed7c237410166364340bb909026a8f67a266a633a9
MD5 ac9e914fa912e58e8dbbe87823384c17
SHA1 858d38361a639b6a987066e97e921a5c31261088
SHA512 408331166dfc359ac97371de92a911a029742db9292271fc24f3e0f4f451f1f9e44df775607eb67dd221324a4edc9f66f1bcf1cdda6d61cef658cd39d5e0ad01
SSDEEP 12288:ymw5HEjsChNTBFgl0WDm+CveDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO+:rwuaOWxrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T16965F18576A41CF9E9A74239CA57C031E7F2BC022A61DB1F4760C65B5F33362AD2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 309c30a9b1d1d9224bbd4d2943ee3a0a94c9c820aa26833df79ed4c7090aa5b0
MD5 1028e2dc93f578fac5d1b2c9550124ef
SHA1 90a2537701867dba2bd3daaafe79a35fc731c3f3
SHA512 3432d13a14b30100cb46486309289c16693a9e5faea41472e56db1289c2caadb4fd5eeccdd8454a9ac6fd2978bbac0eedfeaf32bbdb906b6bf319ccc16c1b96c
SSDEEP 12288:WAZ1IyKeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:tZuArqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1FD5512A927A430F5E1930239CDA54580D7B2B8A627B253CF4B6487954F32AD79C3DB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2421a1253237534015ffbabdcbfc7c349a739b8beba652f8786b61c06f4a2375
MD5 34cfde1af9340e7a8eb9a761fa0af21d
SHA1 fea9e3de4be402d6916a434106e3683deb4f55f5
SHA512 52dcbf064b556b2c85885af8a99862921258e669a8c08264ec775c3beed0e1d226d2f5b9f75ea7955af66908d9771948e5c814b02abac05362fea067c3d11be0
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ud:wQRQyi36YOcPbLvw2gAf+PN369SVN55
TLSH
T1F8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e2b67c6ceb8d579613dbcf54cd5597069e6ece5e1b2fa15259641c81c685de30
MD5 5167ec748b030f2c716a919c3d68ed96
SHA1 f2839c01d8b401cdc21b143ce09595efa6d76f75
SHA512 e75133b43a2f95567695ccb48de2a45914158876c544e1f76eb9a66aee90e219c6926aac5e6f6dd30ad9696d953a0233c977975ce50a618cff3a7459a4cd0d98
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ud:AQRQyi36YOcPbLvw2gAf+PN369SVN55
TLSH
T159667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1b62a36fa4e2ac7e6fe1078fb453e8b656e688de936d41b3a1c84c4a85c0cf68
MD5 c2558caf4b02f046642bce4d855beedc
SHA1 4442b120e8b1db3d243ba09db1ef28428e391c8d
SHA512 02f686e373b3ae2bc9527f51efbeb9eb9c033cccc184b9177f08e92ca6bb31c1b711d38c2db301a88c16f81d3c9745089d5868741dcb98c6a3cf743f25e8622a
SSDEEP 49152:k68Qg55nhceWu7PNU3/1q9SASScpfB5X:OthLRc/s9SVN55
TLSH
T1D6B54933B2F600A9C44DE1769F4A872196E17C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d1a310d1631bd40af508f872fab26a8a4d4812b72f4158f25dd3f271fe5e96e0
MD5 e792bb603eeb88861ac0134c5160eb50
SHA1 fe8260e4f59c8ecd65c0f82d826638a1916be724
SHA512 0731a1c51146903b0b66a42e7882bd6c581d6765d66d86ea3280c44f9a8e4968826b9a9961d3d06377577620947a33d7a5fa5d6ef10e491ef255ddedb1906fe0
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk997:Iy5112gYy5azzVvt69nLKnhZ19SVN55
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3ad229eff9b2801cae44219eb8697c180699465cb27dcc6865623c4cf1cedd2e
MD5 eb0bb82a4dd46ede0648be2ded5720a3
SHA1 92e1248337ecb51af5cb87f6b96ec04d62098a20
SHA512 2c07ebebc43d9f0fa9a987ce3b45c7dffc6d5f6e272679c6d9a1db9cc2936d8541bed1cff0786e17f314e96e5d58a26220c20704a07129c7ea6a01338ed8e5e9
SSDEEP 49152:QB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glPq9SASScpfB5X:Ku6Jmdxd2di9SVN55
TLSH
T1C8D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1432b1bb5abad8ba56a629f0713f666ac64db8986e2ba7e3fc3b4a6355264c54
MD5 b41a422e0377977bb4982823424b20fc
SHA1 efeb1f6256ef29effffda46ef63a31e0371f8c32
SHA512 0d94be06d689cc9a3d574300f07d936052c1807402e8642909afac88c5ff3faf3cccbd8591b7276b1313fa757c162be6d8e03b1197565a4f60428ace5ed7492a
SSDEEP 49152:o1hpsNoJpF1A63U44CwH7R4xrq9SASScpfB5X:omifPWRD9SVN55
TLSH
T198B5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BAE45F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9775599a8770097656cf53b138967f76b3078ec6f156a769fc97caf2b986c1fe
MD5 0d86ea1958604569246bdb1c7a59d355
SHA1 926a4f6add2b25bb0c9b1f0f34ca4891942f4264
SHA512 ce37fb90029a53327449d8da4c984c2278fb7ecec03fe9778fa9e57f7eb67dec15538cf95aa1b6727155b24422d87c264380491633b499e6dbf8d4643629479b
SSDEEP 49152:1SuZQIY0Be2KcRVtOnks6NMHqCq9SASScpfB5X:b5dKii61Z9SVN55
TLSH
T162C5BE13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2cef30e8e7a0eaddc6ff9eb33b82569e1fff112ff82db6ce443353346dcc3570
MD5 f16f2f6b15dadb6be70d987e7d51193e
SHA1 c63ecec667afe0fd7fe792c5459afad109e71eda
SHA512 d602c06eda608a30a288ffb5737a151bb24ac12905bd0b608b1e87a650afeffe559d0e3a0cbd53fcc038410cbc89b5e181346a59503f5d9e732a031c5cb6667c
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5w/q9SASScpfB5X:iX2imphf9SVN55
TLSH
T1C295BE13F2D900E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1c0ba9262e9e1cc0753512186e9bcd3de695f15015522ba67f62c824982bae5b
MD5 7645474eb3d4773c90abecfbe24c6b31
SHA1 c8cb1fd5337adc696d389edfb29b836e159ebec7
SHA512 8c1167e55712b44e44e920ed632b1a69a61e1242d8c3e2ca51f8b08ab6939c9549ba96343e23301ee1a86b793f023f37a6a85152bbc71c0734278068c76e7299
SSDEEP 12288:BNeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:BkrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1B64523E4495525F1D5470671DE0A00E0D97CAEDB2AE337AEDF899A408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 847e2f1102d7e3669bf1c47f57233194147c3e4705a647485959455e03baead6
MD5 b0503dcc2015e58e00244b068ae037df
SHA1 d861586d6cf217b9598f6ad7bbac1b27816eef52
SHA512 15cba574d452936d415aca66bb6964f35e903dd90f3e0adb12f52dfb2602801eda21272515e013ba38f8ba0d9aff18a7a4f1e9addd40577c18d4f5ce7e477b16
SSDEEP 12288:jWeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:jZrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1EC4523E4595525E1D4460631DE0A40E0D97CAEDB2AE337EEDF88DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3b9880104afff69357a70ebda1f8453b80ca8f82f70a14a36ccc97d546f4662a
MD5 1cbbe426f12b599e12a0425af56dc546
SHA1 7f3d266c31b0ed751d2966ba45ca8e63f99ba372
SHA512 bc454e196ab0435527f8b02cd2fc2112d491a987ab0f59ef0c2803ef5f189a4dc744a906073167953f869ef4bbb41b69b046b7b2e68dc3279414c65115d34550
SSDEEP 12288:GceDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:G/rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1074523E4595525E1D4460631DE0A00E0D97CAEDB2AE337EEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b7358085aadcacd46f5bbe8aed4287d4a98f7c5233a8b2d06eb3a978a07115ce
MD5 36635d43396d2ad2e41fd18cd094d6f5
SHA1 380c06e4d7554bb85d631914412b774c16fe8f1c
SHA512 518139b5b3332cc593e09a9e701a743f8cea3a3a1d39acb4f9cddfff7c9c89dfda099f9f31c110906191644896b5c0f11f9ef1bd826c4abb38932ba27c9981d9
SSDEEP 12288:AVzeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:3rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1A04523E51B6925E1D4474235CE1A40E0D6B8BDDA5BB267EF8B404A854F307D6AC2CF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4373253a219467cedf7f228f73be2bf733d6d3707ca8f0f79d42d2a609a0d2fb
MD5 23a76e4c0ac4a088d6988b8a3ff7bee6
SHA1 52323bd2c549556759c6302bfa22458117e13a0f
SHA512 8203580f69079ce9b2c24684adf9d34d3c4973549680380a9599e4bea2575fec446dc2da4a6eb34a55bcba2aa0bd85d4c6b0d6e0516fde70ad8aebfa01483ea3
SSDEEP 12288:IbeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:I6rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T16F4523E4595525E1D4460631DE0A00E0D97CAEDB2AE337EEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0756aceb5100e64dfd300cb3f9726b6935a050b8efadccd38cdb6045eb9c6da0
MD5 a20ae5835ad50a55c38385dd7ef5e066
SHA1 02814f53cdea3189da17a74b209b61da56e864e1
SHA512 6e6769cccd48417c352a66e4e7b038194d0450437ca0bb9f173926b306dd342ae4ac4b9ef4877a2750004eb971299d06eec6b90a868712a971b465426cad1782
SSDEEP 12288:syeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:strqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1884523E4595529E1D4470631DE0A40E0D97CAEDB2AE337EE9F84DA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f9a858fa24ddda8046ae21f03161b66aa61d3c4602502436f9003c33324e4c52
MD5 166c2e24b7e2534462617f85ef10de3a
SHA1 c4256969c83add954cc25cd34621cee3a5703682
SHA512 ecc23c3ee9b7d78f29e2984da2b1eeec59a4f1a801dd5800d0668069d660a4333c26d3235229feb43d590f4d039d0a187d06c995e3ef302581b15f4eb800a2b2
SSDEEP 12288:n+eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:nBrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1824523E4595529E1D5470231DE0A44E0C97CAEDB1AE337AEDF85CA808F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 bfcb054395225fc3ed436823786272a7bec4ab123b8bd55ca658996c81bae436
MD5 3be5570ead341b04db91279e25f4ca50
SHA1 1184d8366dadf411cd07763650ec189bcedb0e46
SHA512 28991f8b4f669ff1086b920447e8be89d381bbe96f70bc136421bb0588c3758c6307a323325254f84fe7bcf426581f15e76173280d49ba7b8747d1b6fada48ba
SSDEEP 24576:JZM3zFVSO5rqUQSAlkSB+pfAOQ+7jXjra:JZM3zfNq9SASScpfB5X
TLSH
T1D66501A4B39018F4EC67823ECD158855D6B2BC5A0BB0C65F07E436664F333A25C2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cb6c24ae8e2b840a729bfbee95b5f044c6bb78d10f7a90b1ffe3a494c24dca55
MD5 3607de1da6d096a6e6a3478796db346e
SHA1 a3317d96de6dbc96bc9fc23b8aa8e87cac7bb411
SHA512 a4d8958886a8f4153a25483caa17b31391ec7b29ef6df6917c44a4dfeb2a0c810a3afe2a37970cc45598f21e61f0fedebbb8b625e621456faeb2cc978deb9a7e
SSDEEP 12288:FReDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:FwrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T11F4523E4595525E1D5460231DE0A44E0C97CAEDB2AE337EEDF89CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cabac317f6588dd979618e613752eefdaae16799574aff597fcf7c3a744c5a99
MD5 6c7a2a089b71c3f5e6d73e569908d82d
SHA1 b47ec051179ebf81ea459f267f90ea143d7322c4
SHA512 3f392cc085ad4d2650f9be36b43eab20838828c44af2d5de2adc5917fc2582ca499e069e67785994e3a1370df0c66e9f8a4f13b5c92e5062c38bfb87dda54e93
SSDEEP 12288:tFeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:tcrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1A34523E4595525E1D5470231DE0A44E0D97CAEDB2AE337EADF89CA404F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 beefca992062eceed2e7c09a6dd92da620b3ebe0fbe179e2cbec4f937a723f2f
MD5 37fcc9b1efbf335868f67434704c40bf
SHA1 c2b852970b02d9931e02a7fb6d7c5d6594e576f9
SHA512 6dc30e23a2905356ce4976d5cf1fab055ef15bc173b9b59720efafbbb444ebe2e5232a90e47967f4d5ef969b0f2d8bbd2d15a49b1784e22285c340252e96cef5
SSDEEP 12288:YyPz5L8KeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:5zylrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1DC55019763A130F9D0678238CD560980F775B8760B619BAF57A447B60F326E29C3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 46bb3af0df33eefaace89d4fe63040082fa2648a75f8cc05cac399b8e0b90e32
MD5 bbceed77fcac06f7bdb6f4b96bf51105
SHA1 24f67e4e6e0fc764ca6caf624853095f51caa6c9
SHA512 2438981f0ef226eb6bd34cf4d7e096a09c8085be38b5cd7755106e2ce773d58ea4847119b984c14af7de3acbe118d5951edbad580f0da934f3af9b4fb9929bc8
SSDEEP 12288:IReDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:IwrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T13A4523E4595525E1D5460231DE0A04E0C97CAEDB2AE337EEDF89DA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 702dcdd7f99569b61f955f82bb798dc36901fd55004645146ddedc141d5a8e51
MD5 e42d998238727a3fbcf9d238555044e9
SHA1 405c85dd6039b97716cddc834fffb5a02cd260e2
SHA512 b9176fbd21b70cf94f321a6201ec76bd3291a0bb9c204be6037ae63bd7177358ba3e59541aaed6fece414b8c0e1a808799e71326f255e441242ab41bb485b6bd
SSDEEP 12288:TReDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:TwrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1B84523E4595525E1D5460631DE0A04E0C97CAEDB2AE337EEDF89CA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d796b748505e2215b7f5e0bd6277f7c50bda1ce739218d70adf484c289110ed2
MD5 396308e8a91fa4132e65e1536afc0e35
SHA1 79c9c2ddc5e97172a30d474f51cb0d621cc894d7
SHA512 a054c8fefbe3b019ff50b121e3818819f5b07fe9a8e7718e0d4dfb9aba0806c115f33f4474bdcba70e7dba4968843e947af5a3bbc447315b348339bd9c9023e9
SSDEEP 12288:YyPz5L8KeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:5zylrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T17855019763A130F9D0678238CD560980F775B8760B619BAF57A447B60F326E29C3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7832bbbe6ab15ebd3dd6356d7948f27d763819e326010722cf2cbbe97d0acb01
MD5 1a2156b16761ba93d29ff799c5b9b7bb
SHA1 9b7df24ad90ab2ca0ec9f56886e92348eee42455
SHA512 ecfcb8a5efcd15fa635e4993caedd355fa84d12a630c0d3f1cdcfcce1f25a73f04efce9eddb03b53a9e868e43dd66c46f2b88790ccaf2b401c2488a6e420708b
SSDEEP 24576:ATNaLl3z0zDPrqUQSAlkSB+pfAOQ+7jXjra:ATALljMq9SASScpfB5X
TLSH
T1D765F1A4B35018F8EC67823ECD168955D6B2BC5A0BB0C65F07E436664F333A15C2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4f888c34c6aa10fab9514ec8d3204a4ad45ceb0fadceb7b3dfd7241764750c91
MD5 d4a4c9122fcd5005508e9b4af6b2b723
SHA1 b3e2bb42796f17a4df4accb8d8e3cc58168c08b2
SHA512 0933ae79530fedbd828d0138e2c1082bb00d3ed035acc1abaebe9503459b89280b00a80fac0fd1b14110fe4991014e9c464bbf6fb05e5f6b01006c65e6e11a6e
SSDEEP 24576:33Fd9CHKy7GZDrqUQSAlkSB+pfAOQ+7jXjra:HFd9CHKyaNq9SASScpfB5X
TLSH
T1B675CE90F3E414E8F0B78A358D664511DAB67C9A1B71DA8F03A4665A1F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f5168071a6429fcaa25a955e3b2cdbc2ab4e4423185a546aae9d293d46d6d32e
MD5 053a91a415cfab3bd31225669dd879a1
SHA1 d03081383b7990c8f97041b6748ac9f33bf59717
SHA512 1d7d57211d758c7ff7a9aaf38c384c8777d66db59e14e38eac969fc975f6263d63aac2eaa696cddc237276ea874647a67f3ea28746337620b1c722c94819ee8c
SSDEEP 12288:K8eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:KfrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1294523E4595525E1D4460631DE0A00E0D97CAEDB2AE337EEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4221657fbb950324df0ba7a19fa53b5f7a4265dd2bebabaab49e77cf602ef847
MD5 c68f2fd38edee8f83694d840d563a093
SHA1 80d8c1d5a54c67c60148c0a54cc08a558d8f3c66
SHA512 03ca664c66bb59bada10bd8d6bb34645aa5c665fbead2d10d5c436aab21652db7a0dfe9f024a4b50312bc6281428fb7841dbc7fd59494bc7aaab072a3ada8ca9
SSDEEP 12288:tqeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:tFrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1034523E4595529F1D44702719E0E44E0DA7CAEDB1AE337EADF858A408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4fa6ed89666747819ebdeb5026a06031a3e4910e89f0e2722c28f7fd3c4e32b5
MD5 967d3f5334be1f6d73f80918fb0718fd
SHA1 955a2bcb2ba8921f032007e84702a8ec7aab1b20
SHA512 b019768236b0594d377aa3ad57130ab24eecbd684466c87e06f30796bc6ed2c494f501388e1aacb185fe73c5dc5a509b3ffdd34aa11d97a7a40cf9d1908b42ea
SSDEEP 12288:+XeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:+erqUQSAlkSB+pfAOQ+7jXjra
TLSH
T11A4523E4595529E1D4460631DE0A44E0D97CAEDB2AE337EEDF85CA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 aba4ee4707113fe1ddb074a9705298414822a049eb04712c254070651da6a052
MD5 ab622abda6f0dd0ec27db05a008ee0b4
SHA1 398372afaf1fe66ed6f5bf2b39aedf1352505b53
SHA512 9f139e6c963a2f9902bd874810c8e84820a45afb13c87b596934314eee51f391f85f1137592fe3ee57b049d13855f79c004b461c9836608b7906fb5156003f19
SSDEEP 12288:bReDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:bwrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1144523E4595525E1D5460631DE0A04E0C97CAEDB2AE337EEDF89CA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fd4bfe90bd772a157fa1a214157ff171a59d7f5533fea2e066e0c20eb3630d1a
MD5 e4ade3b7d5566e3a3b68e3109b6e5b7a
SHA1 83d73d8617ff1b8855a8c7ad205571d6da15bf6f
SHA512 15d369172560a4753b8031ebe121d392e27c3b161aba07651f8cc23d10074f22d88e480df40bf5b44962fd88d4313ae29ba554a7c24942a2fd348bdef9e9777d
SSDEEP 12288:T8eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:TfrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1824523E4595525E1D4460631DE0A00E0D97CAEDB2AE337EEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5c37155625bceb84da403b4d4f50cbee680e2b44842745dc26933b6b03c7c200
MD5 65b23b3cf181bddcbf2f6b2238385292
SHA1 6c21edc132c1b764903554987c4be107d06ded78
SHA512 d48bcc21f6f4ef5d4ead808f5471a1ae53b6977145561aceeabf342bd9db12595a1f602d2e5a79e844ce9f19010a1e6f6755e9ab145e97a49b6b36459f0cc733
SSDEEP 12288:b5eDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:b4rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1FD4523E4595525E1D4460271DE0A04E0C97CAEDB2AE337EEDF85CA408F30ADB9C4DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8b7a692cc5e8f18cf90e7afaa63fd5e327f760357abd38dce4c034a94c5bc250
MD5 3c3630c2c0afdb772f2ba431b84fd966
SHA1 1a4567055e9489cf7161506eb87f63edd329d1e5
SHA512 bc584e1380a5f0508941569d99e14b09b592926879321c1601cbd017921a273aaba9a30bd7da1ef7490b01ec55b22d2d6b6d16e92d9348bd516f9b71a2c50dbf
SSDEEP 12288:rbeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:r6rqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1B34523E4595525E1D4460631DE0A00E0D97CAEDB2AE337EEDF89DA408F30ADB9C4DA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 193d08cd8ee075d7b1575b018f356556a67952184172f8a1059d9fcd04a49a88
MD5 9a1cca96bff95d34d2ad99086f443145
SHA1 94c6f4e1e464f7984a5e009025c69078188146c2
SHA512 36917cc5cc17ceaa1f62a06e34f8e58043bcccc722926fb5514121a7f8771ca9b4a4bce20addede98082c7295b013acd522613c8b5e602245bf8be530c3a4233
SSDEEP 24576:sfwvKk9RX6wkyAIMrqUQSAlkSB+pfAOQ+7jXjra:mMnYIOq9SASScpfB5X
TLSH
T14385DF29EBDC04E5E1B7923C8DA7464AF6B178691B31C2CF029A53AD0E33ED45D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9720463a73dfebc32800e3ea2087f80980a05796536bf0fe9aceab1327559530
MD5 74d42dffd1237185ad842a1301a379f0
SHA1 4ecd55436926344c9420caf9fefab9894b5fd9ab
SHA512 0b862da2b2f2eaaae30d694d0b5884200c8b67f51582158450dc346401dc9cc8aae95c9841d47ae470758d99a8dd3c6ac6478721d5420eeb42f8e96fc8d4ff16
SSDEEP 49152:HYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fq9SASScpfB5X:iySzPa9SVN55
TLSH
T111066C96A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e15009d52a98e23cc7f05cdcd7d501700ddf7dd9876b7b9ec55b5cb680e6f1e3
MD5 06d8f03735e242ee9fb7ce747765a13c
SHA1 07ce456043300b227b927285e1f2cecef2323f48
SHA512 0f44b6f8288db2e26d1618314b1a6b406f09efbba8a5672e678245351f5817ec57a5e29c142a48d85a701f12f84733ab2e395b3161adf9e57d7b66ceacbadc54
SSDEEP 24576:/47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYprqUQSAlkSB+pfAOQ+7jXjra:/47JUQjTirIhCnDHUPfF/Pq9SASScpfX
TLSH
T12065AE1DA3EC01E5E1BA827889154A5AEA71742E1F31DACF1270837D5F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 36c4d4c38b1a5d28550dcbff333a2687a56b490652a5b194fa3536ec4b9cf7db
MD5 29f868867d4a10947d90f3802ab8153a
SHA1 bb67bcbc8344f8cbc926a6a445e99fbda7b8c178
SHA512 556c021dc29058c4e4f6303ab37e1d60eac570a71e9047bbcb1b20a4572fd42b78780bd6e29ab529a9a2ff01a63a607a780b9ef80fc4eed2bf9f2e6c27979686
SSDEEP 12288:hZsfBeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:mArqUQSAlkSB+pfAOQ+7jXjra
TLSH
T14055F059D29812E8C05E5235CB464A80F7377C6647E2A3CB57C0FA7E0F356919CEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 06774a9f02325ceffff34db459dcff4de88bf29937b9d0a9b2dd8084fb22ff31
MD5 c86db06c151823a4bbd0acfc1f5ca06f
SHA1 d1d4fb6abc4cfdb46f624a56cae1eb1cf1bdf41f
SHA512 95f73294b2b94c364cc784efd409f4c2aff8f90bc8adccd9896edbfc7d081c2b636acdecaa52c2a159bc7f05f13559429a234b5e605ce60b84a51be8dd236a07
SSDEEP 12288:WOp5U3fj3/7v23X2io+ukQXeSgtwhTkDS+dc:WObUPZkMuwhT+S+dc
TLSH
T1B83528517666CB4FC5A940321E33D2CCAB707D05EE05AF0772C98B3FD576658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e08323901953f42cbc5414dcf29929808eb2b70a1d1d843cd25ad9de03b6e380
MD5 747691dd233d3f567bbb64db23fc00ff
SHA1 2e0a7b42ee98a69cfc2d7ade55f91bcceb60d0ae
SHA512 b02833d7bec255fc693e44204071d2ec9c3b2bfa70e49a133b506c493d7d8d6b3bfef0d7bd107e12e5ede266e0becb8b8f762a00a552ecd6acba34e4a9a7ca46
SSDEEP 6144:+hw+ICXTMCZU5Q0kvEtMxbR1HZWNAvEtMxE/NGvhp73ibTbHV/yDURw:d+ECZU5Q0uR1Hz7SPbV+URw
TLSH
T18E65F8409537A7CFD1BB6032072A5F4CABA4EC07B7056F26B3C9453AD86A711B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 109b42b67fa9b7a6eb663f73907bd2fa9fa24ba1f7e128b48094b91cb4359a63
MD5 b0c3aeef286fb7091a4abc107cbe7331
SHA1 fed0b3b4c9867084a43ceb698c8b2024576a26ba
SHA512 84611174c5ffeadfbed8ab1092d0879f331b7bfec666be64ebb665412b5b5e5df705e61a4c625a29712297a6468d096626b15309035290c9949f14039ea7a7ee
SSDEEP 12288:ip7peDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:CIrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1F04523E5475829E1E49606309E0E40B0DA3DBEAA1F9166DBDB4497808E30ED7DC7DB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 809535144f65cec26e2562f992c1bd8ce0c904c966e697df7d52cc5a57af4f4d
MD5 9a1ee06ce743b82e21ae2558d41d9c70
SHA1 d541164351e0af64c4b41d360f403cbef7bc0ac3
SHA512 1dccb4bdae8b8e60dc75cf828951133f83892e7591b63a06fc5b6ac3403eb5b783409e381e4ffd605588985661a2e519ef04da9498599218e35303ab57d492f6
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYWrqUQSAlkSB+pfAOQ+7jXjra:0gb4mBIBhGFJq9SASScpfB5X
TLSH
T1E765AF1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3a84512892e3577fbf06440f834fd83711245e5b8e5a620728f3057a12ed2c80
MD5 70777da880d20862b1adf1bc48934ea0
SHA1 025324db8fa50937cc0ef7f188e385775ed03ccc
SHA512 6829b61cd671317256bc1f65f4f834bdbec7429c9229401352d8e68397dbc45429e1311f8e8b06048cce412932574f6444f231bf980374a48a006147b4e52406
SSDEEP 24576:QG88u8FpJqH1pzria7/m5rqUQSAlkSB+pfAOQ+7jXjra:D7ZFPqVga7/Uq9SASScpfB5X
TLSH
T10785F16567E101F1D47BD1388E4646A3F6B1B8250364EBDF0BA88B510F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 99370535a9824e90ae993a8525b60f33fc69b5a5b828bb9f7d4023f7dac92ae8
MD5 3da348558c908fb7ee4ef49c26e1f683
SHA1 ef85f17fd9f98827af9d61c8f0c010e221d40ddb
SHA512 5dac724bfaf9f7e446258b463f18db498d344ffe1cb76eb10c0a98738faf9c36c81fece786753bae3f69287284913f1a6513dd1fcb1ab74558eae00785b80957
SSDEEP 12288:9HvUrBFrEjwaQCeDrqRjg9QADAlkSXk2j+pDiV+ntZcOQrkP7jXjcO2MB/AKYZ:9PUr+NQdrqUQSAlkSB+pfAOQ+7jXjra
TLSH
T1BE65F26F26AC18E5E676A17D89464659F771B8620712A2CF03D0817E4F33ED8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9e73ec1700f32d2a3ee93621f588846dd80d81c820841743bc827edc2dadba2c
MD5 b5721b78bbfe506620a243f87d091f3d
SHA1 2fdc10ee1524c2b0354bbb72ed2926387f2deea7
SHA512 b796807d33ec975b0a9a1f1f4ff8db93cb61ac13e790b1b4229991562e2f035d83554d59aed4e6003876b7196d3ec2d6b097ff5020f6784f6ce4de62f51c40aa
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdq9SASScpfB5X:VG05lO43bN9SVN55
TLSH
T1DFD5CF6A62EC11F9D1BBC17CDAC6460BEBB23415033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 52a486f48e08d2e224280b2714d88fbbe02b4b69f3e56213dbb9ed1c39f25d2f
MD5 c89807b2868bf71aa6d185f792635c94
SHA1 fd2ed7f291205de60c060b6f3c77cbad67342c8c
SHA512 9e5c7a303150b9891f8cb313af88f2c180241b129b13361cd6dd1404e2aa5211525d2119c0ae3dbd23fe3caf12011babc139cbee56d2044e2806a734e25b19ae
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnrrqUQSAlkSB+pfAOQ+7jXjra:ba5POZ3BJt2pasx2+m1q9SASScpfB5X
TLSH
T1E465BF5EA6FC01D5D5B9D17DC583861AE5B1342613329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 118fbd3f24b7e3b94b272c2ca849e80661db527ab657db1d5ef49c19c87ae323
MD5 bb5d1b868c1f7d0373b082027e2fdef8
SHA1 80a6108bfe6d1e94a2445892e60a3bcf89bef0e6
SHA512 a4ea6c4291c64e6e7f974de8bde485d49fb9648570b2dade9fafaae9a0c6cb0bf33fb9412a4660566dff818ff46b19afcc167bb6299ea809d3867c112b8f1dd4
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkRrqUQSAlkSB+pfAOQ+7jXjra:7Nc/zEOVHF0q9SASScpfB5X
TLSH
T1E6858C6623E901E4F1BBE1BE89779546FA71786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ff332f06c0fd4bdd5e657c4b71ea85728ccda284bd52bb14bb82189a3969459b
MD5 37a68a6a22c8d6ce592ba12b76030898
SHA1 79d9c85658a4ec6131ae22c6a157950c25369adb
SHA512 e2eb108eef3e0f1478128583d257804f76eff51725aa3345e7bd0fec8ba6b76e6d6767f85dbcc47d17fcec2c4dbe6780c7a8aab5c6e9206c9a015c307dca710d
SSDEEP 24576:MTkNvNnaFeYhJNtmZBm3rqUQSAlkSB+pfAOQ+7jXjraE:MTMwBtOm7q9SASScpfB5XR
TLSH
T1F755AF6EBAB806E4D1FEC6B5CD238512EA727461073293CB5390C13E4E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e414cb5d730f9f72bda8f61312d1b7245fba57e1133bb5ac144abb66d615d3b7
MD5 8ce9766cb5cfa1d0449750b7ae1f7451
SHA1 86ea0fa65811e81b393dbe9ffb38171b0f18fda7
SHA512 af561566dc6f3e9a15f357b268b52e251e0626c76e852ad8559685779cb1bbeb17ccb493a681ddd398f7e1eac0472cb27fcdcbfad002873663f07319e18c909b
SSDEEP 24576:5D3FHshBIYQgAErqUQSAlkSB+pfAOQ+7jXjra:5DVHeBIAAGq9SASScpfB5X
TLSH
T1C475E07DEA9C04E4E47BC2BCDA538906E77138A9032266DB06D481B55F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/708-329-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/708-93-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/708-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/708-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/708-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1776-111-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1776-315-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1776-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1776-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1776-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1776-105-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2220-57-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2220-281-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2220-58-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2220-64-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2336-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2336-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2336-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2336-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2336-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2528-87-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2528-81-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/2528-311-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/2528-82-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/3816-126-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3816-314-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/3816-120-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3816-118-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/3948-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3948-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3948-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3948-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3948-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4116-0-0x0000000140000000-0x00000001404A0000-memory.dmp

Download

memory/4116-80-0x0000000140000000-0x00000001404A0000-memory.dmp

Download

memory/4116-11-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/4116-1-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/4380-55-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4380-42-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/4380-41-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4380-48-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/4380-53-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/4380-49-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/4696-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4696-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4696-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4696-16-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4696-24-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5832-76-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5832-306-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/5832-70-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5832-68-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/5988-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5988-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5988-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5988-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download