5bfdc20093c03ee0a8fcf8558ad8bd97ea8ca009efe3a9a3c215ae0f3422e0e8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
Size 2.0MB
Sample261030-ta2jbaev6r
SHA256 5bfdc20093c03ee0a8fcf8558ad8bd97ea8ca009efe3a9a3c215ae0f3422e0e8
MD5 d4c1a6a78e1f388ad363af19c772855d
SHA1 63ff1bc6def0eeb43987ac793b8273e42258207a
SHA512 8ebebe470e1903a541e0665bcff7292f97cd6f1ac12b3364881ee4cd2ec3561230d2c5791da6b00c5d4043465edeb75f0d4ac33c8ed7028b9081309eb01d715d
SSDEEP 49152:rdoJ5AQYQOUIWAHE1MwBezWutEc0gyMWJTP6kuPJlkW18Q/lFTjN4:Czc0lcV1fLm
TLSH
T151A59E03E3A581ECC0AAC1798356A633FB71BC8A4934B6AF1BD45B213F65F50AB1D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4684	elevation_service.exe
4356	elevation_service.exe
4120	maintenanceservice.exe
6108	OSE.EXE
2020	PerceptionSimulationService.exe
4844	perfhost.exe
4180	ReFsDedupSvc.exe
5672	SensorDataService.exe
6060	ssh-agent.exe
6132	AgentService.exe
4372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28e561ab227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009925a5eb8668dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b440fa88668dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0fe85a78668dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4b47ca78668dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000fe53f2a78668dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
Token: SeBackupPrivilege	4180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4180	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6132	AgentService.exe
Token: 33	4372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4372	SearchIndexer.exe
Token: SeDebugPrivilege	2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
Token: SeDebugPrivilege	2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
Token: SeDebugPrivilege	2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
Token: SeDebugPrivilege	2540	2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
Token: SeDebugPrivilege	4684	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 428	4372	SearchIndexer.exe	101
PID 4372 wrote to memory of 4940	4372	SearchIndexer.exe	102
PID 4372 wrote to memory of 3436	4372	SearchIndexer.exe	103
PID 4372 wrote to memory of 4848	4372	SearchIndexer.exe	104
PID 4372 wrote to memory of 2324	4372	SearchIndexer.exe	106
PID 4372 wrote to memory of 3192	4372	SearchIndexer.exe	107
PID 4372 wrote to memory of 1716	4372	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_d4c1a6a78e1f388ad363af19c772855d_akira_glassworm_quasar-rat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4120

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6108

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4844

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6060

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2736 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2736 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 27aaa9b535537177e2e533896463ca33412dacfc8c36875a6c3ebf2afd8201ae
MD5 be126039b1e5173f3debf7dedfe8b7fa
SHA1 805bf65dc70d9b5bf53a8c31e9d48ced8bac55c6
SHA512 c2cdd80bf4ff4cff921afa73a78f315e47109b5fd9c8430441ecf4c3dae4e8d6add7b9ceaade278c92903b6b402859aa5ad8556d640893abbe4502f7512469b7
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn3Q/lFTjN4:u3q6HjBXLm
TLSH
T1B2D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 77381b8d2c7ac86599cae50e199a2451dc3f5c2826ddfcaa7c750074f1b2aab9
MD5 c331cd2d43e4f71719d9805d43705e68
SHA1 5e6b2aa1c6fe3800742497b8037878469ffed4d0
SHA512 6d1f224d99e83619ba2d960adc2a99a0f6e83d87cbffbc859943236293ef803551a24b381d9d2fd590412a3225888e757e0776ac8ad835dcd3c2ce91604ddb8a
SSDEEP 12288:m1XLsswWkxy2lRq2czAQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:EXYfDtczAwnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T17265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2c83cd446b7e85dcef8518a7cd7fce37a7a4d4b1bd5b1761b4eb6a8df294eefa
MD5 76d8e02650c073855022b2ce083b20ec
SHA1 49b55b199f50ef8810cb98efcfd5f78a9cafabff
SHA512 b503ad2ae769c1f73faa4d64a11d544dfa43da18beb4805dd90cbc9278864370ba4861dfea3da479d7f9b859aa2aba61fef74d3bc86157643ec3636eda086b34
SSDEEP 24576:z0Le5ji0hmxLrMPnQ/tbw/2Mkjy6Fr7g0o0:zPji0Al+Q/lFTjN4
TLSH
T1B5859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 288356630286e9a3428b687b9a756b74d404ded4d56a5e20680a2544e898852f
MD5 580c3f224cd96cbd23c271c47bc528f3
SHA1 8a99613e2f84834c42a035001b5ed1525fe17861
SHA512 08aec55917bdd3996ff9932f9f02a32ab28640d6f0b0eec4b2350d773704c9db29d9d15e5b443a9a798fcb0529e9dc3628dedb0ca7d2e13087b7a0c16ba81475
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuxnQ/tbw/2Mkjy6Fr7g0o6:E/ezSC6vUzPvxHjyaQ/lFTjN4
TLSH
T127755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3bf601a0aa17877c88ab177e1e444d1c9b58f043d5414c253c534d7394550f5a
MD5 bc1048fc6dcc322a26b473931f8b8b7c
SHA1 32ae388e0007aae459092b057aad6b20782c605b
SHA512 09a0bbd9c537e72fbcbefa65146e522f8849624488d82a1c5449c882f17fe5a2b71ff86b63c9d3ba9de39a6c4b21768c2b60bcb261acb22a0fe670acb262aed7
SSDEEP 24576:9VbqPb88hv/l+60nQ/tbw/2Mkjy6Fr7g0o1:9VO88hXl+rQ/lFTjN4
TLSH
T10B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 af22e323fa074ffd2dff18bb2076dfbdbb67d440fdc7900c98ca5cc4fb987da7
MD5 b2205598533a4c09a1ffc1802913444a
SHA1 53871410fd7cfb2702cda122e6e06333fcf3606f
SHA512 7f9c850c196e7ee460d7807cd370efbc4453b90ebbea667dff87b68c77ee495824ff915816585839b2d3b2ef592c2c6a484ab078729f515c22d85fd547e8ea65
SSDEEP 12288:zzDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:zzznQ/tbw/2Mkjy6Fr7g0om
TLSH
T1445523796A14F897FF2B06B15C8284826B7B0EC1BFD1EB4E6B44362D853C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7e9bbe245250e9afd0b415e304c104bf07c143204309204b3eec9e668588311e
MD5 aca0f00a9d6f06629f18a083e2dcc6e7
SHA1 47f5ffdf9419b93f738df12e779fec968e7292f7
SHA512 88f18a34936b67f594944c3554dbbce220d3f1354997a872b87cd00fc7842acce75e27d286d2be184b958c631fe20d31d948077d559839a3bca0b4eb36a8a1d3
SSDEEP 12288:xeBNUbTVO86UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:xJIUsnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T19875CF3BEE28FCD2C67E4DB85A918640D77278704F61A3CBD164820EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4b16d51434a7563680e6b4cc3e77776b996bb2a61a1eb62b3626a4c89bd4f46a
MD5 c6d90b7091bfb5bdf9ddf3302f4efb35
SHA1 bf6f5f3137c1617cc75de86ee108706a945b51b8
SHA512 73cbefb6e004f5ddd8036125ce8e039b656a7be50022f4adb34adc0fc857c07ed8d8b6f140b5106f78480e265559faffff0ff9a319135d6d9c287c1e103a2a88
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:SQvGAdlCEL8c/yRNw5CmLm
TLSH
T1FA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 454c8671487687fa96e9cbe6bd8b7f723e36b91a0af8705ea88490b2eb14dce0
MD5 0969d8944b9e9741ccb5e30156fbb370
SHA1 5b87685e7cb6410f12279891b1cffee4e3b04705
SHA512 b7fdfb70796686c7f3420b0225510fe85288835a650bc3e4f3cc33d20937da8fb1c61339f2a9559cf992c2acc0417a010589c86b7c8e663e92e478ed6e215eda
SSDEEP 12288:1AwSfxL/2Dc39DLLmt0LDQewsAjOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgD:WQewsAjOnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T17F75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8a2686dffef20274b9460b154559970055e59466871e55198f46a51b00bc3647
MD5 17fcbc1e44261ec20419ea5f966ad9f4
SHA1 da363513078daafaae60a72b18d1f82effb2b020
SHA512 45d405abcdc3a0299b72ac14316f7957280d5a04f19288dc17f1f4e44b0e53498a5b37f18074af5278d97891d6d76382e01e183cae9fb36d95027823b1e2da17
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBL:QUEtQevvqc2W1cpV2EI32
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5426bb008cf94b6d2e1419f6a4cc9b77172b3a86cdf9952bd3a7c626e993a100
MD5 714f99f339077f9dee9e5287f5d3be48
SHA1 0986b1ecf686b2475727c21f5514f5f49e11c8fb
SHA512 ef4e18cd8579fc8a9574cf9be30eba4011c04b6914c28b89576215f4a69da4580e94afcd56d5844df41a5977cbe3de9b5c0473af12f436b16982f9c3da628022
SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zuQ/lFTjN4:coqtVjnmyLm
TLSH
T1AED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0556b8005adae952276a1c8c9b1e4280c38ebc85c7e7a2870fca033f67c091a3
MD5 6787f8622560226e8962f55096108cdd
SHA1 f5df21274a950e14b120fbe29adb57aa1bf87d65
SHA512 f257850ad2c8ae529cdb61ed4d1282f8cad863056775c1bb63f20b35fe89ccf54d00d3f3fc3c8376b649d11747432262214aa1532676db77974f9b21ef5f4aa3
SSDEEP 24576:aAhGLJIFoiwtA5l7S53dnQ/tbw/2Mkjy6Fr7g0oy:aAMyFoiq5NQ/lFTjN4
TLSH
T1A435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1adf191df5fdde3459cdf7d88c24125bdecfb10de5d060ed35c4aef7ddb57db2
MD5 526d0a2f944291e2435ab171f7803143
SHA1 bd482680877c9eafa3424a7f1f3557c30780d21c
SHA512 73cf7505e0eafc9c49ada6bc14fccda2aaa951220d3bbf9964a1c824b65dc906f97cb18f55578f2173f9788f553908c4550311ebbde3f15a90bb36f0f773569a
SSDEEP 12288:hmw5HEjsChN2BFgl0WDm+CBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMa:8wuHOW6nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1C765F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9259105014f96c12984586631ac8a04fda7340f4926236d8309a3b0052b6677f
MD5 90b05485c03dae7ffd9715406858f598
SHA1 dd6ad3d6876dd84285950426d41ed6792248322c
SHA512 cd275734c8d70b3993ee342721f89c79086bbb1ecb29de9d47fbfd188565c3af21155e42e6ec9ea3d736f0494863d7a08b693cf15564a5b6a1d9396fabf3300f
SSDEEP 12288:5XZ1IyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:BZuHnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T13D55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3d2edf8560cd89d86c074833b82fb2e0e7c53c8b8a559421183d4178d1d51fa0
MD5 5b6157c56ff56328089f1ba074ba8f29
SHA1 ef29adf31161e046bcdcc0130a64900e8660a0a9
SHA512 2d8c802acfabbc60ffdb668e3fe5aad6921d0ea5f82e62816e588db8f9be435aa431cd8122fb80d550f1687a348501b0d0e37a4e7d44f827d4ef6264a6c933a8
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:hQRQyi36YOcPQLvw2gAf+PN3rLm
TLSH
T1CA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d0270537a11f2faa7874bfac777f309408c20f461ce74d086f923f9553f68c0a
MD5 ee255d6ee58981ff6bb56f09c4e7dda7
SHA1 3b6fd3db180a1e6327e2a33bff06662a0eb0ebf3
SHA512 15079f7cead529db58fc06b30373317d2c5958e0fdd10f8e9f3cd72c0c9edfc67264e0fa4e36c4128fcafe0e4feef2c50c360c74744b0a3d9dae1b85181e714a
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:CQRQyi36YOcPQLvw2gAf+PN3rLm
TLSH
T1AC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ae51b92ec71b8a7216f59a208dcb6ccc00a56e02feb9a19a05a1a6200b636c68
MD5 37c332fcd7d95e957755488be5817b87
SHA1 82670c2edd1b6173e3dc57f04f9d4a0b85dc564f
SHA512 57d5244c2f5b11bfdd25f6408774cf275a77c44ef4ae07907852c631b42795b5c000bcba364117eef243447098a4d4dd527e93624523ec67368eec6422e379ae
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL03nQ/tbw/2Mkjy61:168Qg55nhheWu7PNU3/+Q/lFTjN4
TLSH
T196B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9a281aa26316693c4e705714ef63db3e3eec57477b4aa247716f276c6f950f25
MD5 f9fff42857d58d49d1d5c39f425d355c
SHA1 71d781726b9c664b96cb280d4a05f814ea062fcc
SHA512 d80ca3f9be662913fa95b6667fa379ac539e90520dfd30841f38b406fe488948684ed25f035b9135b0e36f9a66a0ccc0de035ef867e24dbec958a3ddc803863b
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99s:uy5112gYy5azzVvL69nLKnhZYLm
TLSH
T113167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2d9bf71cbad9a994d935d4ad1d9614a810dfd3cd491a1ac878a4534335d2dad3
MD5 fe944cdd25f56d50c7c2bc85a7b20bed
SHA1 12d9ad2ad9b7552647e8308889cccdaee72365ab
SHA512 7ce54e9352dc2c5007850d5e3c8807c9127bb93b39454105dc27560ce8ab4884d20126b8f93cb0c1fe8ed8c54eb44f094160a1f316582faa17903d40021d48c6
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgQ/lFTjN4:qu6JmVxd2dzLm
TLSH
T179D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 42d9d49255fcb560c60a0140695108f0add6c08c1af7ee1d2a290f9359970bc5
MD5 595694a4f07756f7a90ad50c3fabe004
SHA1 a8c7e2964a63db31237475946419f93d30c8f821
SHA512 d081609bf454b155cac81249350f42328fe7e443470231a70dbbfcbbb24b37e8b583858de16f3ba7495d9c5f91799977504e54565a04d0d74ae42b18c764081a
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xMQ/lFTjN4:AmifPbRyLm
TLSH
T1D4B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d41fcdeb4a61fc83ec613e47ec1a78132b2ca5163babc9fe871df39200c18e71
MD5 b51560e57eec8ec0c5a865907be94361
SHA1 b16f04ded69900d58da9f004a692a05f29796d5b
SHA512 8b0c78897076d53f5ba3539fb4e9b8f6bdf7935e293b82455a61ad0cf5d29100be4b67736194fd7335b62a752b9f0a8c7d912d2b613c5b8cc5a571a96103b47a
SSDEEP 49152:3SuZQIY0Be2KRRVtOnks6NMHqHQ/lFTjN4:t5dKTi61sLm
TLSH
T115C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1af4a2aad37e50edcc580df003c144254b67c378e600412a9984db8092ca9067
MD5 fe0dea12059ab831d6727ddaed81f02f
SHA1 5ee90b110a782564fe27eeecac2929a60bcfc8cf
SHA512 07f78b6fe8bbc15ca55e84343fa89cbd3cebabd7cebadd6854afd6dfe0d06cb6cffbf0db6b5a0d39294562b7f037ec1bc8b4d0c23c5fe6f1d82624468f65a2c7
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wwQ/lFTjN4:oX2iypheLm
TLSH
T1B195BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7f4c98ab4f0e953ecd3f8ae04fb5d8557b65f6e235a65a0b232fa7938eae2df0
MD5 75b04cafbb83036751e937fc5cd291e1
SHA1 62bc6fa126efd12d38a63851bd863be1182f7530
SHA512 1497802fbdda276198133ca0874134705616af859f47c1ae7a514294c7eac0e6d1c4a3e6c826f72f62e00456a215b373cb5d50f037baa3a0f33f9954857e55cc
SSDEEP 12288:D7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:DrnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T18F5523697954F98BFA1706F18C828182AB7F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9b97d7fd75c7007ddf358ff7b1b952a537bee9c807d551fadb31d8cffeaa854e
MD5 86475ddff9061789ea4ee79b9833d407
SHA1 ca18daa88e92edcff7329b3bb35c817a9f0b20d0
SHA512 5bb2f7ac934d30ab67e960451d1bc296a7c843f2c7b23468181bbf75f9a0907c6c053f95da0f5ec41da939390a4072f51fc568e39f1eb45932e6ec92cd7a0462
SSDEEP 12288:qCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:qCnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1605523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5faf4ca1ffe377e7f210f2e1fadff594f2718f6445557e51ceb5a5127584c863
MD5 2b073b4c435ddcde21efe5e71ff1ac3b
SHA1 bb5baf59ca8cae061ae6bc2189643439496ba43d
SHA512 67308d6432fd1015051e67c047e763d950a0628d23164032e9ac6fb3ba6427b6aa0b7d98ba93c2ac2e806c81a0d9867ec46de6c5e679c357c46978c06a24c998
SSDEEP 12288:fEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:fknQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1835523697965F98BFA1706F14C8381829B7B0DC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2c742955d46ffbde83bf4af6ec4cf3474b5a6573be4af90df22d5da8c1c5c98b
MD5 ddb137f7bfcdd27012695697624a5cf0
SHA1 80e2d46df7501d669576d4681a7a1572a1308e7c
SHA512 0a98d9aaea13072eb88a5b98c5fa4c10ff92d2dbed8ffe0bfeec753b796d57ecde6b039c1616b9ac6956476de08b716e8fe20a3e748948797205115cd3966194
SSDEEP 12288:QVdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:MnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T15E5523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1f5993e6db48d8a652259d38828436a7fb12cb32401c90f9001aaf8764ba3cce
MD5 f4bdecb25e0b557b3153f97cd99b19ec
SHA1 ba3af3622c77bc5b709c656ea28da322c8526eb5
SHA512 5671285dc652a432f4f46be49dfed3784f1b419b1d5568591d70deff2d5d5488d611efbb5503e43ee8923639dc4c167d05be3e9025a2821c6913d02b5e5064e1
SSDEEP 12288:OlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:OFnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1315523697965F98BFA1706F14C8281829B7B0EC6BFD1938F7B4C2128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3d265f30a5e311f6ec08910083503cbea8f79d11b0da6b8e704f7d86e0ff9e54
MD5 a3713b0506fb458bc111b22a24695f7a
SHA1 decc4d08bf772d0d1130adabd0bfde633940bd13
SHA512 77f6a842fc0e9d162ffa61aa0ba1ad6f9ff12034eefc589c0cacf7d507d02c0601fbb81dd2909e404f9fa0f95f1475bb1f9d0a7064e2b82ac33b64ee58c93e33
SSDEEP 12288:8mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:8GnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1D45523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1c6fc8160fff4752387a66fbf244753d69dd696f4963a4a0028744a07d861714
MD5 5bdf3cde17b24e92e5a1ec7fe24c0369
SHA1 e08b7d857619eb2f58972f88fd03f09c67b0cd7b
SHA512 57d23e1b113d53b9e6291987f14597586d5f6f262397a9a960a43256d3b2f70f653db08bd6c244f03be619d9f559c9bbf8f10e6e6c047e2de88ca3ad38653b62
SSDEEP 12288:wqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:wqnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1D55523797955F98BFB2706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 85b37d07ed15647d6a78610391b5d3e53297e42421911c62b4ec96ef53dd9a09
MD5 39cd9a615f90f76bf9fde0c7b9abc2eb
SHA1 b33b7142f075162f0f8598e01cd5703e8dacc422
SHA512 81578bf7d9134cbf91a0b6d0adb1b841eb25b2a6ac802ae4dd3faa58328da41bffe5e935d2ad2636ee615e6641591f0595eaa83f14152f8fbf7c5a29c31947f1
SSDEEP 12288:8iZwbDzzFEoS2cPvyiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:fZM3zFVSOinQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1447501A5B39058F9EC67423ECC518906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 612613348471fd0236984f3824767f63b5bc9740944cf835b068b1cbfbb8d701
MD5 1d27046ee28c94b2768470231c69d3e4
SHA1 36c264de42c19bdaa68a321b51aa1bc1cc1bb951
SHA512 c0ba831456274b1b9138536959adb3d31d58348225ce157f2db6972b0d3af1fc89397ebf93480037a16cb6cb04f4451338dbf7b84f5875e4182240bea24ce387
SSDEEP 12288:d3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:dXnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T15C5523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0ae056b8b7eeb8e9900bd9d225d82929b60b38117e7e81e7278420f94583d906
MD5 798f3294890b2a001598bcbc3efaac2d
SHA1 120da40c417b3202710a253d25f7f3ee041404a7
SHA512 b23756d1c4720a26422978175bd601437d13110f7d9b82d16ebc96ddee084171dda708fb60269e26647bcf3f99f482e5dd0f25335156b6d2530126f1b06e5d3a
SSDEEP 12288:6TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:6DnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1D15523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 08f6b6774209db0b3f964123a5db52c58185fd5eda02f9f5394501672a1afb7e
MD5 5be5860f0aa84f12c310db1a0e8d0109
SHA1 664ac196493190d04428383f037e6cd9a130551f
SHA512 8f4fa11d97659138008d5d6b99cde55c3009ee1690edbe32a19cf123af3dd6c1273684e400a8dc0174d1b5d5e0dc2701cab28e28ed74fbbedb8f73668a74eecd
SSDEEP 12288:9yPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:0zyenQ/tbw/2Mkjy6Fr7g0om
TLSH
T1C365021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d09b1978676ffaf70a16f1fbfe8083b0355b15b42bf8b3b06629a0b50ad41bca
MD5 c0a390de8dd1145db1f32f4fba909ed2
SHA1 6efb66dcea9edae0ba48fde931eb5e1d6ae35d1f
SHA512 a08a740178bc7820da9640c8900cab0cf1802a50e14dfd7a720f036c7788fe226c0e2dc94f1272130a4850a3239873d2f36a3781aba04b2528ab8831afe5a824
SSDEEP 12288:Q3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:QXnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1725523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 be5aba32ce35f7e07ef22e43359c9686ff2903fcf84eda44e0d0e0092b2b5468
MD5 100f901b952527f13b1171827708cf3e
SHA1 da03a98ffc344c7b3c4b5ef603af0ec31ddd25fe
SHA512 2d0f257b102b40f8e80a5542e4d7fa6d967417d7eef230ac3b9067f50744e2e35aafd2496d9e4a42ca1602a4073f862c12c8d07883e172210b705bb145cc5488
SSDEEP 12288:N3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:NXnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1E85523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 dd46f3b1c6ec1ac3473229c04197179ec7b0e5fd3ba1ab22483c1dff6f77cf91
MD5 c6c23a8ec785a7dc4d0e6a056c63e52a
SHA1 d77082e0167f284846b373f55ff9b7c4c2bf251f
SHA512 89af7012c79908f7e19a75463b90273583fa2e9a85466b20c9255a3f2c7962a5f3cc9e4ae276b1170f25e4ab954d4a8d7106fa0ef20453f5c4b945860a9d540d
SSDEEP 12288:pyPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:IzyenQ/tbw/2Mkjy6Fr7g0oi
TLSH
T16865021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6f47dedc054c2d845b7b563982f6a3c16c6a932351cade8a51edb8db0748cd1e
MD5 2d09c9edd9ac341d59a751c976d4ea2f
SHA1 a8b7baaceb7bd955424f96f75ddf112ee7d38e79
SHA512 04c2cc8b87fd8e406ec87e225112ab5a1636ef20464e49b9964fe6230b2cb399fce3b8cb02568991be8f52a0dc93dcc2aff0d800c7c06746c68ba01687610606
SSDEEP 24576:YT0aLl3z0zDUnQ/tbw/2Mkjy6Fr7g0oC:YTDLljxQ/lFTjN4
TLSH
T1737501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 faf2d14f5f2a4a85366d05f86266dd70befa071e09fc80a5582e97bb779d1793
MD5 c82340b8037552f68185100ff0b6d3f8
SHA1 a28d2a85942dedfe140186a734c3fc9c09092ba3
SHA512 28ad7424f1cd3a4e075e95affb550eb539afdd2e1484f58eddd70c5c952454c0cbaa0208afdc7a7a7fe1101aab00f311d4f73adb3ec1c7a5cd6177817242be77
SSDEEP 24576:I31d9CHKy7GZonQ/tbw/2Mkjy6Fr7g0o3:S1d9CHKyaWQ/lFTjN4
TLSH
T17085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7d97c824eb47f2d2b760c75b3ed78c0894691f11f5c221e79300cebb8afc852c
MD5 d54433b5d105b12d632c1ce75333d152
SHA1 4e74e0e214fd923b33991549718c02d8d7104cf2
SHA512 facc46f5696ad8fc919155dd37e00a955a993c9d905082706ba1da64440cad56139c329e9253a0a8cc6a20f385499bb5555eaaa7ba9b4fb94f6983e3171cd98d
SSDEEP 12288:+kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:+EnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T17C5523697965F98BFA1706F14C8281829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9804cac5e02f1975dd59b6fbbbd10eede980d69dbe7a9e60451d135c59b13ea0
MD5 86c9389ada2c47d862f0ae049c7de6f8
SHA1 00734a457707894b20ccef9292623e47b9176a57
SHA512 f7fd24c2afdc08bef76fa714a2b212bab1e536329eeb19061155e40e29b17bb3507defdff254a66d669a7d4a0c2562c2acf66df4cd642a98d800fd107c268f67
SSDEEP 12288:Q+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:Q+nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1D55523797964F99BFA1B06F14C828142AB7F0EC6BFD1938F7B481129967D39406CA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 76c921f7b1205b22814b5410f77327df47fccf1b9b827c8d93257f5aa185cfae
MD5 c3f262acfe62a7696f23d1d7a1440947
SHA1 f063b74771c4454ae8829cb448daca0a78b5aa32
SHA512 da719374adb1ac62b63687ac8e7c3da9051e57eaecd20d1e99a0e7d9a3884dc72c06c544fbef73c93565de24bad4828ca67e52b77347e5ff62bcc1c003f4ef7f
SSDEEP 12288:kpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:k5nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T12B5523797965F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 90131c770e4aed6222def3015a54388fa113cbc137fc33ec56ffcdaa210527ca
MD5 10fa58aa6d8accbf81cb2f3c7b94ae54
SHA1 7810cba8ea2b97f31c39a9c582201a4d65802844
SHA512 38e96843845bc8de155a55b605cd110c63a921587246c5c03cd313c2764e32c4dbb116776b19e9b048c9583a344d14e305cbcd56ef8770ebe9fd009ddd29e40f
SSDEEP 12288:i3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:iXnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T12B5523697964F88BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1d59bcba0af33a2817fef98b582e639d8fc5d9f8aabad3f6f4bab46a19458e21
MD5 5d0ea4524497b015bdb5285cfc955778
SHA1 ce53126f6d6d7d617f2852811cf97d578b8b899d
SHA512 82a8f3b1dce9bac006f15e7c8e3a8f8db46b3c34d44e75f5c75ddd4bdce69788bd338019fba1baddbef21f66ab90f455adf0bb3e2a35ca5fef3c6780db2e46ed
SSDEEP 12288:akGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:aEnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1325523697965F98BFA1706F14C8281829B7F0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ebdba79130e53825b83daff0ebb4808f795524bf1866b4b274c40ff936a528bc
MD5 8ca574214bc6fcfd3f06854ca9b0e072
SHA1 476440163312fc259661f9d5159f23f7a2ddef2d
SHA512 c6cdbb85e71020227cebe5430f1e572a67b9741080af41411032e5472a5f6db6b23dfa5d237901c5739c193484576ecc4255d3df8659a9bee3b4d7b5af2bbb87
SSDEEP 12288:WfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:W/nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1E95523797964F98BFA1706F14C8281429B7F0EC6BFD2A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 75f13b55e29506bc7598068c2c147c24ddee20f4184bec0fa6039760eb2cd7a3
MD5 d13a43fa987cd8a2fea9ce4e09eefc45
SHA1 5ae8365bb4804a65d291d54cdbd71d392968507f
SHA512 62b248c337f78566a71e39c732298cb0502ae05793eb4bc1356447e40a54f8052865ee336d672f746b311e247c99151457a0b27ac99e8666bf2cf59dc25cc4b7
SSDEEP 12288:flGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:fFnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1FA5523697925F98BFA1706F14C838182AB3F0DC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 a99889a698f47badb8255c0e1b193215eb2d503c7e60989b13effc57b8f8e697
MD5 c959d14ff9c88f98889a97872ef9edec
SHA1 96a866483281a9cdb0507771fb3a592b5c6c9654
SHA512 e08ccb6c2453cef8cea92514f7d0f49f077b6e020a7af99b58248fc420a185eb578612e676c7a6f74e26d4a032bcdd08227ba6ff3bc1a739cbdc2b6adead4b85
SSDEEP 24576:Pfwv/k9RX6wkyAITnQ/tbw/2Mkjy6Fr7g0oJ:+MnYITQ/lFTjN4
TLSH
T19385DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7ca94de7006faea87eab32c336303a6530c172cb9ff38092eac2fc3ba7733755
MD5 b4b4b089b50bd71f39a4e7966cca2a00
SHA1 3ddc2a74ffbfd1c7247b5c51f184a6d62934a163
SHA512 519d843620c10d974c93c75c57779122bbc9dd62414afb83b409a579ec566398df24691caf3fcf2a4591eb33f48b564123de0f251a43e5b69a535b52fc38ca57
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QQ/lFTjN4:zySzPLLm
TLSH
T10B066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c5165afb5dcd0a67342ea1ad2ff1a168c8f27a9a5de3dfa0bf5deda5daa6f186
MD5 4fc66f44c2581f471e358c8b6fc74994
SHA1 65052424bc8ef902c3bc8f243cf32012e2349992
SHA512 52adf636f4160387d5f7a8b6c9aa3cac38a5d9b2456a509d20f0494ffad69ae667cc002f9160b7e79de8adeacbbab040754f72e59fa9f60d3a52f29754c931e3
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYynQ/tbw/2Mkjy6Fr7g0oR:C47JUQj1irIhCnDHUPfF/gQ/lFTjN4
TLSH
T12D65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dc3605cf68f2a357688b70e15170da7869a0308d66cabe6b2690e584e03f0ad2
MD5 5aed710b3839403f06ea1d140099ebb2
SHA1 a8fd872f95074d99e49476d9f10196375e7e30a4
SHA512 3e43aa0fb47569d85780b1e467469c4f21554d5f493783c8035c96d9d9e50862bd30247c413efb8582590c0cc9457edc9e83dd0d5132ffbee088391e363411a3
SSDEEP 12288:ussfnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:YHnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1C065F119E29852E9D02E5279CB428641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1142747fdcafe2add3084f8077f4169b57e754c591005e21cefea6084de5031e
MD5 bb6fff12348155869a1c376d09f0b92d
SHA1 0cb70ba1e137e86fa3c00feffb66613509b29674
SHA512 e5f24cbab0bbca5e27a47ccccc2df3b69f9c82074e2f7bf425ffeb53e7b7ccf6da26213f9eaec8a2bc5498514410e5c5e1d7e77da0ce5f019164432586cb96f3
SSDEEP 12288:XI+vQokU3foqa6R8apQ9KB1NSOWLv4/EMcRe4/sVsS:XI+vsUPlbpiENS5v4/Epe40V7
TLSH
T13345F6007666DA8FC5A940321E36D6CCA7707D02EE046F1773C9873FD476A59BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 096720cccdf5f277ebef8227f591ea3612148ec34221be6af0a3006891485f57
MD5 9ed5adfafbd43492fc3e7e05ef44714e
SHA1 800fe5e2689de603b69f518f5a12f8e1979f637e
SHA512 795dc93ecd116d5b233e16f9a24665024e31635cba1c14dc1255cac073964a7b538553ff427b08dc686810b24e33a6011407d6d00d75083472b9cfc3c7a025fe
SSDEEP 48:rU904wOdZny1llSllbUREK0kENRu+UKnenP:rUmUZy1llSllA+LRTX
TLSH
T10D02E2A2B784F633D89F81B28CA0F7DD577AF4606E111353759126EECC5D1820DAAF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 017e82cafb1a7b3d54d80e4181f0595c37e6716704e9937a82d67531b6c9128e
MD5 63c0d817793e6a471e8e2acfacbf9b19
SHA1 23294e64c01c621246e70ecaddc01388b16b9d81
SHA512 09dc86929355f9d5119241a8ebedc052c81f148aa2212ad748968976360c5341fa95c2c94b4063dc864277a706866e223e4136fcdc8e1d131abff3879f435903
SSDEEP 12288:zh7qti8IZ5L7C/z4x0clH2CFhKOfJaJWot4Ia8WeVaGMG5JF3rYkDBHJSi37:l7qgN2CFhjhAZtauVHJf37
TLSH
T1BD55F600A4A7EB4FC97E9037073686CDBBB45C07FB452B057345893C9867A6FB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4cff17d596c4360ea59b284fa9ca3c5befad64747936bc16d085c2bfd3785377
MD5 caa17f4d0c987f7b101a5e8ee188bb82
SHA1 7b6c5414414129db2d07abc881545d3f1ff77388
SHA512 0ef0b2aa103a47c1fe35ec556f4db28a1f15fd57e322f364d8f190a80739c483a5d24c69f5cc82ddde00c333dc639af460e6c9571e08ea6425f85ecdb13afcd0
SSDEEP 12288:t67PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:kvnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1605523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1fb63fbb301047c01b204c9e398a334e45742500648604d528e5c6f9a5a804c6
MD5 a69e1c74f325e1986ef7b23d7f43bfc7
SHA1 a56ede88a4db028839e73d79c083464889305a8b
SHA512 33063d8934358dd8fbac824327df78f5c2b7df183c323f2c2261e066a7935a488659758a9601068878cbd73973f0535f0e39d60e7f3db732e1ee593881108605
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYxnQ/tbw/2Mkjy6Fr7g0oH:sgb4mBIBhGFyQ/lFTjN4
TLSH
T17465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d295857aa75e9cb2d9bc31c59ce532f3cdfba72afc01c4c79f01b5501b724012
MD5 88c736d81bacd175e042c4847cb43c6c
SHA1 39f76d11b238d683ec19e309e513eb19fc35cb7c
SHA512 36e1e1cd9c16ca471726edd25cc6cd7a898eb868c0c48506877073dffe28f867d9a80b916f86e63eb5751986e4e34cf8e614c0baf2de97f54aaacfe81a24e5cd
SSDEEP 24576:+G88u8FpJqH1Qzria7/minQ/tbw/2Mkjy6Fr7g0oS:V7ZFPqVva7/ZQ/lFTjN4
TLSH
T19685F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a54232b4f00b8b604b5057c8c9008da75d93a29ab8eebd28a3f48c762cc0ea0b
MD5 f6ab4c3251397eed4b158bda8b03315d
SHA1 f83a1a8dacda94258f12953a8ef550448d5a9079
SHA512 fa508edf85605eaf3a1ece5c54a90d9d526e708f253b662da8d73d911fd6c4a5e180a8646e207a29fd4274b1dc782f4d2b602383fa897d6f5084bd44f352d3fd
SSDEEP 12288:nHvUrBFrEjwaQ2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:nPUr+NQWnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1B265E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0f03bfd1101df970d0c6413b6439a35bc9cf192061e166d37df34ccd8c179180
MD5 51f6fb9cdcebaef30c665ae4f0c345a5
SHA1 6ef34443495b5023ddef073edcd56292b27c2ab9
SHA512 3af433e97312cecfbe170c84810ae23ae2ec3151aac0bf287b35c7f310a159525bfbb81da8922f985e0c45e99a6c6ac822cbd1c6b674582ba7f66d9bc9266015
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGQ/lFTjN4:jG05lO43bwLm
TLSH
T159D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e253cf9146d0fa5d78185780cf63bcf478d2cf11a250a858bec583daeda2dbf6
MD5 d01b2fd2efbe53c1aa7b89531d42055a
SHA1 17dade0a9d2a2acf5ef22facbdf374297e54724a
SHA512 485d9369cf26169002c23c26061d96c69ff40619b0cb89a81bba6dd49124b09f4e34b6ac7187ee58045da56f8e30902790efeb1c6750f27a4c27ad9368744077
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQnQ/tbw/2Mkjy6Fr7g0oc:Fa5POZ3+Jt2pasx2+m+Q/lFTjN4
TLSH
T15A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a30fed9005bc99318ad52bfe75a63f1123dfdba65d863f0e5f0df0a7cc33c221
MD5 bc7dab6df6cce0b57a2828e4c408e400
SHA1 a80240f6f10184ef558fadf7a172fdcb62ed3f41
SHA512 3ee59a877a026be3462ce5d4b2af2229d6ac40e82b7de5f59007b253a4c21208ee9c9d3f0b4f302f0edd77b0a8ed17a7d0e644e69ed3f80302ec59ce20f00be0
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FkanQ/tbw/2Mkjy6Fr7g0oF:ZNc/zEOVHF5Q/lFTjN4
TLSH
T112858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6a9f88f9b542c36f8f68b630b25475e3ffc4144007ac67d8cd452c12102e5670
MD5 e477f5b809e809319461104373e9acc2
SHA1 94160be67e714b455ebfda261a7122ac8d2c576b
SHA512 4888197ce0be570c118924096963c3bd4d16a75b64305a4399b14e1334b86825179ed4846e840d3bf0efaed1ea52440e0e6a7441cd4ad5f8ea05939024cf6ff6
SSDEEP 24576:/8kNvNnaFeYhJNtmZBm8nQ/tbw/2Mkjy6Fr7g0oT:/8MwBtOm8Q/lFTjN4
TLSH
T12A55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7e509259bb77a69756dcfac11869b8345b963bc4e3c52f4b012cab65c07e1d59
MD5 0587a3e624b7284ef023782dcb1b82d2
SHA1 1f61c6028020fa46abf782f5c9a77068663828a4
SHA512 e436d214ab03e4679155c3e2e646581faa505b2a823e1195623870fa577f24a65c6924b5747edb91c8a1b860af3628c6fb56cf64ee364887320a1da5e4b9d0a2
SSDEEP 24576:pD3FHshBIYQgALnQ/tbw/2Mkjy6Fr7g0o8:pDVHeBIAALQ/lFTjN4
TLSH
T1FE75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2020-73-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2020-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2020-67-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2020-295-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2540-0-0x0000000140000000-0x000000014020C000-memory.dmp

Download

memory/2540-1-0x0000000002AC0000-0x0000000002B20000-memory.dmp

Download

memory/2540-8-0x0000000002AC0000-0x0000000002B20000-memory.dmp

Download

memory/2540-87-0x0000000140000000-0x000000014020C000-memory.dmp

Download

memory/2540-7-0x0000000002AC0000-0x0000000002B20000-memory.dmp

Download

memory/4120-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4120-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4120-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4120-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4120-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4180-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4180-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4180-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4180-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4180-331-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4180-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4356-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4356-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4356-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4356-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4356-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4372-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4372-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4372-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4372-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4684-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4684-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4684-16-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4684-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4844-310-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4844-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4844-83-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/4844-78-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/5672-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5672-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5672-315-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5672-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5672-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5672-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6060-114-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6060-115-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6060-314-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6060-121-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6108-279-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6108-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6108-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6108-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6132-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6132-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6132-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6132-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download