7cddd3f93295e0d5f2bae7fa978efcfafa1415196f2acb40c92fe021c613d534

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
Size 5.8MB
Sample260605-3pxncaft91
SHA256 7cddd3f93295e0d5f2bae7fa978efcfafa1415196f2acb40c92fe021c613d534
MD5 b31886f5fdef5a3922c095dea79e33bf
SHA1 4d079f43e20ac2088c597ca2a98561d5a0a562ec
SHA512 f41e47dfd4de7dbaae5f5696969d0db83f0814201515b2f84e07c6e5c266d1c564c59f1276cd7003d43a11222e6c7f4a6af8a82e48a88399a47c1f4120a5d3b0
SSDEEP 49152:Tzb6SumOPwCnD3evo3QChG5DhgCFEms4WNr22eGQ1ngKv/+Q2EDeS/rHyXiQJQxa:Bo3KDCCu4m05nxSPU8uoDw/z
TLSH
T1CD562815BA9BA8EDC199C874834A4A731E2170CB1B26B9FF44C446353FA9BB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3504	alg.exe
784	DiagnosticsHub.StandardCollector.Service.exe
1332	fxssvc.exe
2224	elevation_service.exe
1508	elevation_service.exe
5292	maintenanceservice.exe
2432	msdtc.exe
3032	OSE.EXE
2468	PerceptionSimulationService.exe
3788	perfhost.exe
1648	locator.exe
2820	SensorDataService.exe
2304	snmptrap.exe
4764	spectrum.exe
1608	ssh-agent.exe
5348	TieringEngineService.exe
3328	AgentService.exe
5840	vds.exe
5992	vssvc.exe
3660	wbengine.exe
5300	WmiApSrv.exe
5396	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f3977edbee2c9d24.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000243ac32045f5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb648c2045f5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec25cf2045f5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f5a652145f5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cafd82045f5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000260e92045f5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b58a932045f5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080ac162145f5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
784	DiagnosticsHub.StandardCollector.Service.exe
2224	elevation_service.exe
2224	elevation_service.exe
2224	elevation_service.exe
2224	elevation_service.exe
2224	elevation_service.exe
2224	elevation_service.exe
2224	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6140	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
Token: SeAuditPrivilege	1332	fxssvc.exe
Token: SeDebugPrivilege	784	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2224	elevation_service.exe
Token: SeRestorePrivilege	5348	TieringEngineService.exe
Token: SeManageVolumePrivilege	5348	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3328	AgentService.exe
Token: SeBackupPrivilege	5992	vssvc.exe
Token: SeRestorePrivilege	5992	vssvc.exe
Token: SeAuditPrivilege	5992	vssvc.exe
Token: SeBackupPrivilege	3660	wbengine.exe
Token: SeRestorePrivilege	3660	wbengine.exe
Token: SeSecurityPrivilege	3660	wbengine.exe
Token: 33	5396	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeDebugPrivilege	2224	elevation_service.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 3068	6140	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe	83
PID 6140 wrote to memory of 5828	6140	2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe	91
PID 5396 wrote to memory of 2072	5396	SearchIndexer.exe	108
PID 5396 wrote to memory of 3260	5396	SearchIndexer.exe	109
PID 5396 wrote to memory of 2816	5396	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_b31886f5fdef5a3922c095dea79e33bf_akira_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  "\\?\C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python.exe" -c "import json, sys; print('093385e9-59f7-4a16-a604-14bf206256fe');print(json.dumps({'version': '.'.join(str(n) for n in sys.version_info), 'sys_prefix': sys.prefix, 'executable': sys.executable, 'is64_bit': sys.maxsize > 2**32}))"
  2⤵
  PID:3068
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  "\\?\C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python3.exe" -c "import json, sys; print('093385e9-59f7-4a16-a604-14bf206256fe');print(json.dumps({'version': '.'.join(str(n) for n in sys.version_info), 'sys_prefix': sys.prefix, 'executable': sys.executable, 'is64_bit': sys.maxsize > 2**32}))"
  2⤵
  PID:5828

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5936

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1508

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5292

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3788

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2820

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2304

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1608

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3772

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2072
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2860 2864 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3260
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2924 2908 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 734de9ca98ad02a9d6ddd85e707b7cad146e185a66638fa6bc974314432ccce3
MD5 9a77fef248525111a7f0ea7789803afb
SHA1 cf4930bc6cb6e6907ed88cea2d5f16a5408db7bc
SHA512 5d3640904e39081db4f27f3066fc4f1b1713a967e9c8f7f905fad4dc4dde279bcece83b0640118431e626b6d19522931ec4df280640a57be89a7f99b25a7b591
SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxniDYf5zaCpXxPuR6E9dA:Q3q6mjBdoDw/z
TLSH
T1F4D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e19b6e3b508ab7bdc6acb2ac91f65cae63329710c7c1c90e080b40c66ca755c6
MD5 59d147caeb2049d45740148a23842160
SHA1 a93f842f65eda8032b0bcaa5296d5ac3728c274d
SHA512 2278bd1f94a3539f0aa0010f1fbe874e36644fdbe9f0119c8c580623692db4a2ad068d7e9fbe1bbacecd1c48845974b844fd418b11084ddd225e87da00ca30fb
SSDEEP 24576:ZXYfDtczA20Djsf9nz4mloFQnpXUMPQDR6q79dA:ctccDYf5zaCpXxPuR6E9dA
TLSH
T13405F129A79404F9EC77423CC8A2C511E672BC5147A0FB9B03E499665F333C95E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5a8b92c35277696d8280ea087d7f5b7b38c79859d40e1f8d41487812b4daa76b
MD5 b988958e1765ac37c09be5b751a6476a
SHA1 969202987d0051f91c8b626e6e116b90f48afa47
SHA512 624968aea7c05bcc206ab5b79cbcf133b72e29408da0a0038a8ba2c5d0541b62ee51e45379ba8476c0e404522a1d0da293dbe28a4be3c5269ceaa45a6d2a98d4
SSDEEP 24576:T0Le5ji0hmxhrMN0Djsf9nz4mloFQnpXUMPQDR6q79dA:TPji0Az/DYf5zaCpXxPuR6E9dA
TLSH
T18635AE16F6748331D073C0B9C5D2A69EE97130825B308ACB5286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d544d384b8f29f29df2e686dd18f9e030db4689aa353b26cc7a27af70033f8b1
MD5 fc2610b54b2daa0d656d35567969ac09
SHA1 b8153fa057c7065c6fc211bc5f3463049bdff628
SHA512 3bbae2fe1ebb26ad89339eb29bd1d37162986f3b6fe71cc04d0cafb6941d1f9a162df019c4319b62788cdab8243d9c3d2a5931312cd4b3f23cefe3eec5db1faa
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWj6q8wyu70Djsf9nz4mloFQnpXUMPQDR6q79dA:C/ezSC6vUzPv+HjybDYf5zaCpXxPuR67
TLSH
T1D7756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7ba8b74417780b32ec9e40466b13e8c8feeb661fa4e3eac5bb9483adc142add3
MD5 d36ef46953d902d7253c8438510872fc
SHA1 056ef42b870dae5ea1074e0c8a3e0e7b5b120eb8
SHA512 da9a6e082ee9af21334833bc2ef22635c43c653ba724f18d52f91b481088f2c170cf3164bf7c9e7f4b513f560d4e9c95d9fb84e5664e7ea6a93025e143080e92
SSDEEP 24576:5VbqPb88hv/l+Bm0Djsf9nz4mloFQnpXUMPQDR6q79dA:5VO88hXl+fDYf5zaCpXxPuR6E9dA
TLSH
T19B559E66F6748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 25e05e423d5d376ca084ed14d1ea42c111fd99eeaadac9091cfabcb1af713ae4
MD5 9522a0a1cbdcf7326c2a5b77d42ac7e2
SHA1 87709833d62273d1dc3b943dbc462f62deea6002
SHA512 a053705b3c4b67fd1eed05f21b4b0359bf74bf50250313e9927118718b62dcc8010f28b92b6c4183bbea5c39499fcd927dcd3a0545eb91aa943e8275dba7c354
SSDEEP 12288:6GxOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjd:6Gx0Djsf9nz4mloFQnpXUMPQDR6q79d
TLSH
T1DAC4238ECF0811F6E4722F3C28B1E325D2D4BD207D953E6A77A1E68A8C7574BC4A5583
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a4471c6fc30a5a8082e09df84382ed531ce7ff3bf1db9f77881185da2af1fbca
MD5 4f0ed4ccbdd4a920cdbcc76c2115a0f9
SHA1 b3df1e8c662954e19da4e063896cfb43348369e7
SHA512 dc2a7b679158f0fee66bcaa82d5c976784efcf24637e68aac102c4efabdeb69a71297767e6318e6b23adb4b454656b3ff2aba5c411a557918a19962dec9b250f
SSDEEP 24576:OJIUO0Djsf9nz4mloFQnpXUMPQDR6q79dA:OJIUZDYf5zaCpXxPuR6E9dA
TLSH
T1F905BF7BEE28FCE2C27A5D785A91C200D7A278304F62A3CBE165C20EDE236D55D79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 59cddf2b18f79c9f6dd8b5b861c74382bf33aec33ca394521b6cc9725b36bab3
MD5 14e16b400a05e92f1b5f8b89c73c973e
SHA1 5eefca55a594b8d47d7023867592a68e07445cd6
SHA512 e77b1e6bcdae28b56474c1c774a297a971afa5ce12bc69a8fd926c0b95a8ed3dc66486c519ce1209269f9d67a8c097d674cd14daab829513b125fe5e5909bd17
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THm:bQvGAdlCEL8c/WRNw5CmoDw/z
TLSH
T1B3266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 25df7893a9cb4dd7a2171988e39562a61b5cb6e927b2b1cc471a0fbb8ca19bb5
MD5 4fcc1dcfbf947aeff1410f82801d794a
SHA1 d922dafc63cb75abf1c7435cbe07b9f683eb141d
SHA512 d212b55c5177e5445fdd370f8f48d20db3aa9e75a75d2bfe02d25c58572028b418693374630447f652e7cb88543d1eacbf8866002cbc1c1be29a83b22201e378
SSDEEP 24576:ffewsAjs0Djsf9nz4mloFQnpXUMPQDR6q79dA:nljPDYf5zaCpXxPuR6E9dA
TLSH
T1B915E031FE74E036C67B0DB51B36D716546CB9204FA12AC3F3E88A9E59702C26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7723cd6ef8e31dfe243bfba4bbeddbe64112045167fdc384438f343e67eceee5
MD5 91994b31fbad3a038d968e4574b71d54
SHA1 7ea01b97342bff06c12be44ba24daf57d68ffecb
SHA512 41913770ff7678f4dd649c993e1f6e101fb6f0db2980913c726d05919bf7d7928a04f6d499cb7669692c4855682bbdac3dc488298d97e1617a3c596920adf48b
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHEA:nUEtQevvqc2W1cpV20I32E
TLSH
T10C474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 63a5ebaa26bb9e5954eb986fdd85e59feb3ff444ffc7529a852e048cc9055b78
MD5 4276c9da4c34370f18e74c3776da515b
SHA1 651f348b6b1c987962a9340807052a132395ccd4
SHA512 90a7e9ebc742fe93540098a9956c5ce3b5eee39d7755d89fd4b9ec17dd4e95adf9e4d5723814fc0e0db0feb7abec302ddb2e11d1fa58ae2f1d8d978404300126
SSDEEP 49152:XCbRquA/m2yL5zLfFiV+XenmE3/zvDYf5zaCpXxPuR6E9dA:Aoq2Vjnm6oDw/z
TLSH
T1DDD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6ab007514518cd73864f0517656ea68b2b48329bc6b4f6ff03a910a2acb9d341
MD5 00b0af8881ec4f3c4d317aaf239264bf
SHA1 b822d31777c36988ab07f89c387fae8cfedfff4c
SHA512 66ce4f71c853d36d6dea4ed2062af250ade3fbf3d2c72360246ef2e642dae9a2ca289de1d795d6dbc9914a8a2436702ce427f24b9ebf1667f5068ae2ef648fa2
SSDEEP 24576:TAhGL6IFoiwtA5l7S53H0Djsf9nz4mloFQnpXUMPQDR6q79dA:TAM5Foiq5EDYf5zaCpXxPuR6E9dA
TLSH
T19E359D81EBF951D4F5B3AA7899B69170EAB6BCA55E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3f977077579bc56c745e6135c121f69c5c9d2da8919fffb288547449bb70de45
MD5 a8a23ac830ce85ad365ca724cb4af88a
SHA1 c5fa2c381f70ea4da8a2b08faedeec7dbd47ef06
SHA512 569e00f41079a5249a7125c41765663afa3f88950f290827dbc9cd1f06b2c36bc24bf79f0321e1024f8e66086daf1ba6e445cc66b5faecc156ffb7e76bbf2443
SSDEEP 24576:ZwuROWY0Djsf9nz4mloFQnpXUMPQDR6q79dA:ZwSOEDYf5zaCpXxPuR6E9dA
TLSH
T1A805F14A7B9408F9E97356388597C136F7F2BC112A21EB2F17A0C65B5F33351AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e3a4e19161e019a3e6552b8bf6676f35f33fe6685ec175a0a9c91cb33be1a699
MD5 88dfedac3183dcd89a2a6be175d8c9c3
SHA1 9b5a52da2f6a9454aa684e1d715042145cdb3a0a
SHA512 2b9c0f6b4c47a4eb10cb2ca22e690f3f55e6a417cd2178dd1d5856efb3e1f5247b895247d1c042f568d97611b164953a8472355468e779c1bab7210a44dd0b39
SSDEEP 12288:WyZ1Iy8OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjI:vZuV0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T14EE4128E6B9420F6D0B31A3C98F19315D3B178227B7127DF2660829A5F73BC65D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b2ab8d792d202e69080d798236aec13a0dbdb575585c629667a4d2cbf9a2533b
MD5 9d9bc6f9d265ed58a7a7961f14de9fd4
SHA1 2c39640a0d2434f2ac9b9b651b9ab0f356f8e035
SHA512 af03e0268933e7bed296baf4b1e51a0c9010f41bb9c119ea2b8efddba726f6aa45a9d82e03f5bf0fc70b37e2529698f3151d1ef51086fe2db6192bfca9b06a43
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UK:BQRQyi36YOcPDLvw2gAf+PN3NoDw/z
TLSH
T1D4667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2e299911911d9c499d5623ab0624b1f988426e6a275c7428492852f411fd4cd
MD5 a97e59f7c495b895934a4377c7837a00
SHA1 5f78bbfd11251a344f2c996e10bd8ba9b3a2f03d
SHA512 19e8d883a8791833edebc939502605f41c9ad669faca62808c9b1bba2378b654d8640ee356cc67f3b73aff29b79d7a3cf1d3db4da46414bce36f0bd91ba7325b
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UK:5QRQyi36YOcPDLvw2gAf+PN3NoDw/z
TLSH
T185667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 da0190ed9c7f0f17fbd31202e54b7667f5206d9e7991fb3cc8926f7a732af22b
MD5 f0be0b0f697a73cef6ae6b3d60af3b86
SHA1 50efd4fb794c3459655a225dd7aa5f04ffbccd0e
SHA512 4355a3ef3796dcb5492ade01b94b915c4045737eb9e8bb06894ec12c99f18f1cd4eea1ba7cc35f50eebb3a7700afe119ef02524cbcceb659e1cbc99fa1579161
SSDEEP 49152:t68Qg55nhkeWu7PNU3//DYf5zaCpXxPuR6E9dA:rthTRc/roDw/z
TLSH
T17DB54933B2F600A9C45DE1769F4A873196D17C718FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c8ff6e9e99aa30cce8a412a5e620c97da34e6c9ad4ce9048e13341abbc9ef73a
MD5 3c899d9f96b8707f8fd54d81fb0a1f1b
SHA1 7adaf41d944c51c7ebd1f75f3f08a7c0df10e6e7
SHA512 a3cd013b45e6b2088684cbcb9c3ede3f4606bf3232511ffacb458240283d28d4d5664e287ff60cafbe8cada59ae0dac52e5002f0704da483b0edc1ef5f04f020
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99k:ly5112gYy5azzVvU69nLKnhZ4oDw/z
TLSH
T1BD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 baef9b0428697d7e0b107b816394a51a859772c99c342b2c7a241048fb6f5b9d
MD5 d93ca62b05827bfdaa668c317b6818d5
SHA1 d994f26463e135c189dae64feda8e95b20096ad2
SHA512 da84a6db0f3b6a4d4b5191eb650e09622e488f8cffc925885aea51e50aa026f109ffa2c7e99ec9d607908ff24cab067721245e95138408f40182b99c8c567195
SSDEEP 49152:XB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRDYf5zaCpXxPuR6E9dA:5u6JmIxd2dBoDw/z
TLSH
T110D59D13F1D901E8D06AD578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0ae1f75456edb38206b9849084d7eb84f1e2a2f5124861c2050409ea6ecb1a82
MD5 33a41d94b1579dd5dedf9e85ac6f4ecb
SHA1 156e952474b45c6c416e444fc4c9ae8450d019eb
SHA512 6b15a207373fd9d5831106d2e1a6a565638d895d610b741c256d47f9db21fb8dfb9c6459a66966fa2a93b30a2e52984818ec746e757c456643521fd9732a1739
SSDEEP 49152:Y1hpsNoJpF1A67U44CwH7R4x5DYf5zaCpXxPuR6E9dA:YmifPqR6oDw/z
TLSH
T1B2B5BE13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ccdd92fc957484d9b4ccf9740cef0deefb2dd2ef8460ee5b688310e8a56b9a6c
MD5 1c5a240b7b3ff3e3634d5c2ec2595bda
SHA1 b198eafa425446a8548a435af48203c189959f4d
SHA512 f4875d7d265477b5f579a7451772ad18502ec954e9b920f462f179ab305bce494043a55b1d9fdc550aef06197f104304881f39c95afe62a06079d09f6b6668b2
SSDEEP 49152:WSuZQIY0Be2KkRVtOnks6NMHqqDYf5zaCpXxPuR6E9dA:45dKqi610oDw/z
TLSH
T1E7C5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b14f440b4706b3da9bbcaa26b68f472fe7ba3f7313aec434120208d9d141fbd4
MD5 eacc36cb74c43164bce8e29032e588d4
SHA1 3bcbafa6a877bdc1c756e32751f1e9afed77daf1
SHA512 baa5771164d11fd3d3e436a67ec075252ee961d52ea1952cc0e9b86d3b540a6f7eb355d81a43b8317371b7db8bf04d741bb2c1c06ca59c2213e90282eccb2314
SSDEEP 49152:JhtSn8EApI0figjgiDn0AP5w9DYf5zaCpXxPuR6E9dA:4X2iWphOoDw/z
TLSH
T17795BE13F2D900E8D06ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 fbf82161e8d35ae1e1cd36a99ada930b0c419b60750174f93b48282aff324bfa
MD5 fcbb7a8c4bd9435ee253d48f70eb5d23
SHA1 9106efe9c386c81dfdbad308f11b89216ae0dcf4
SHA512 8af5a636508bfa7dea5022873da4ae4407521678c3164750985f8b92f5718d1c4c525d01aa5060d4152de264dd3b4776217dd9d1bc0c1332fe98c326b889bd84
SSDEEP 12288:J5OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjq:J50Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T123C4238EDF0911F6D0312F3C28B1E324D2D8BE21BED53ABA77A1D14ADDB574B4065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ac14f32ca6860fb29b2a5af3e11d917d208f3afd5a8a6fc451688c8ba111864b
MD5 1a1e1f36833e6af2772f1127137710c2
SHA1 051ef4af15dfc8025d91ff21e3ce856558e27e39
SHA512 bffc3e198cd8678d0d14d6354d0750083b61c841f1b15be57e59fbfbcc9881c1cd09aeb7fb90213dd607f428f8deb930e40176700b532650b402ee8246fec0b6
SSDEEP 12288:9wOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjq:9w0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1F7C4238EDF0911F6D0312F3C28A1D324D2D4BE21BED23ABA77A1D14ADDB574B84658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a067074344ffbf8294be6f7d1ac9f08e8d194ec38fb4c910cdf17bdb27be57e7
MD5 5a7b2aa9498fcc37df57dd4f9e2c3d23
SHA1 7bac60d27145cea0374034941b1b4357b0c49c14
SHA512 e1c80b495c003f90a3fff9e4c317f7e17156f4feb241b27aaec96e369fb1673522f2ccac6964c4a213307fe0ac0d09e21d5093b4e8ba868f179ea1be7ee59b3c
SSDEEP 12288:RWOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjq:RW0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T10FC4238EDF0911F6D0312F3C28A1D324D2D4BE21BED13ABABBA1D14ADD7574B84658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 379fea5185c9924f45511155c4974768c2b91b2f78f1af1b71a1ec8c5a4b7f75
MD5 b8d05aa7a8259efe1963210ddad31360
SHA1 d26dc5c0d5f5345d3f88170505975a813d025617
SHA512 7bfd5acae8a0c84c39e7d6f5b454143672b9f5c5e20f57afbe3f3afec2a28e964b866ea15895e49b329407318fa43f19d985d9a0ac67ed705e7d8a7c6eb82455
SSDEEP 12288:CVnOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjN:I0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1A1D4234ADF0911F6D4722F3C58B1D225D3E4BD20BF723BAFBB50854A8D7178A9474A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3f85815f31b9d647c53664ce5f5007a4d74ce2e0f186bef8d68f6164ce380f6c
MD5 c9dc32387b3079bd539b12de6647f809
SHA1 0f59c8788bd13348ec8573efc4ebdd4bc5531438
SHA512 f02abb5c20063e7113852e2f1519c5e93eb8d68375fa9f4a77f708deb0def8c1c2f88b645ecb8020ac1b4031325221ad925fe38a1b39264c967261b3cf53d05e
SSDEEP 12288:jfOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjg:jf0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T105C4238EDF0911F6D0312F3C28A1D324D2D8BE21BED13ABA7BA1D14ADDB574B44658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 019728aaa06ffb6fd09a6609cdafdf03ae75ea015f9dcaf785f2bb52685f6741
MD5 c82aa280cdf229f3e6e4b6874d8ee365
SHA1 86043edaafa6ee01d727d580159a2ce3eb78a681
SHA512 c0581d1c8173d6a6a03c257a94c0eab463d23fa2d93b13e7bdf4aba3caac8e3b887a3e03f56671b5e8c5e928a688e8e20abfaca12ae5ac69cf33a61e5b39160b
SSDEEP 12288:rUOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjg:rU0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T16CC4238EDF0911F6D0312F3C28B1D324D2D4BE21BE913ABA7BA1D14ADDB574B8465886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6f7bf5c550a61e4072b32d650f35df9fa76b79e71f40b0113368519e8859de09
MD5 6f69676da3435652fc1b60de94658cd0
SHA1 9aa4ac5478ee4721454ea05b992fd85e0d9f1ab8
SHA512 98852f3c279879fac336a641042b98f088a2e1c8165ff12b1c50eb475e8ccf7689e721d7f832a9045a566228d10958806fed76d86fd26b9b08d3bf011cacc879
SSDEEP 12288:5oOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjY:5o0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T118C4238EDF0911F6D0312F3C28A1D324D2D8BE21BED53A7ABBA1D14ADDB574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d5b39df496ca6a7ea019ee59feba6860b8479af59038537f7616e5ae31ac4541
MD5 9448e3f620885346bfe8a2300bc1c613
SHA1 1a32d0e93b9aac87acce9440927200d6af4c8963
SHA512 1a2011322488523234ab1d639a36684a631e064196656fa0ff99232950f53aa29ba06c99c2e364df538986c3da4175e29736bb3a3569c51fda9b7a8f1f437933
SSDEEP 24576:EZM3zFVSOQ0Djsf9nz4mloFQnpXUMPQDR6q79dA:EZM3zfnDYf5zaCpXxPuR6E9dA
TLSH
T10D05F199B75018F8EC73463D88618A16D2F27C261BA0DA1F13E4366B5F733911C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 37e1bb98e915de920c95f81017323e0ed62250c7cd43b17a6066567a33541274
MD5 92a5a3e2693737f0b7979ece2d2195a6
SHA1 270d541d74ddd6ef450966f3af3732e4591ebc1f
SHA512 2f4f3d0e3ac42fcd8512dd4fef246dffef5d11cec33c49f94909443b7086e0ba10c2c50bda5909fbb3bf51b1d3f5b3e60a0c9867211fc4008e3f098031535e48
SSDEEP 12288:olOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjJ:ol0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T142C4238EDF0911F6D0312F3C28A1D324D2D8BE21BED13ABABBA5D14ADD7574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 290bd9763f34428ca9d975066f0ef61760b9b8a701789c2957c8fabf285cd9f5
MD5 ef2eb9fb364d85b2a4139c717185180e
SHA1 7dad9bf3abcd7217bb413d927386f6f95d8d8304
SHA512 dc8eb173fc57a8e88395d179cf7fa8ab89a9bcb3ddfae068fab9cccfe9586518a7e6884d40f2a915b3aaef74d95076aadd58a98eef8bc6439c1c2ccd1b3d24d4
SSDEEP 12288:TBOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjt:TB0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1D6C4238EDF0911F6D0312F3C28A1D324D2D8BE21BED23ABA7BA1D14ADD7574B44658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9df9a54a2287fefc45896828604fd560c11c8d03ef3424086693b8d6076e743f
MD5 50c7b42f2a4a79f5d2e60521be7e583a
SHA1 1ac6268e34199ef8d5cf34059a43e1d1069a9868
SHA512 dc395535aa5d4222f3bda38cdb185e59e84828b096fec9e1522812851fee572fc752062c32dbcb2cc6137489d477d1460c1e662df8e7100e98a2f3b2710fb4ab
SSDEEP 12288:JyPz5L88OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjj:ozy80Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T1AAF4024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c19dfe52cdcccb6a9231439a67875d7b89cd755324c69d759d68971e91236dca
MD5 d382e10b4547532d4eda1e8358a8e483
SHA1 56938dee17e089d93153c56aefdbfd6b8d18d82c
SHA512 e53ee3f10bdcf53de814aa67ab30198bc074e827c75638720ba8d8ac158608ece647b8fc02cd9be28d3d1e765e76e49b508d6f6e70a1d1a7d4799c7f72676938
SSDEEP 12288:olOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjt:ol0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T13FC4238EDF0911F6D0312F3C28A1D324D2D8BE21BED13ABABBA1D14ADD7574B44658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7991ea2ea936e01c606babbe6bde4b205209967330ffb7c90637fcfb7676314b
MD5 1cdec894ec05f5aff5537e1f4cd9859f
SHA1 d20962a9bc0929beb42026bedb755f024e03fd9b
SHA512 af1c2f1811bc27a759d6b6d0ffb2c474194d56b2fd6a91f7927ba72e9f14ec1d8e0f4c9c49969da4956625dc158a5c4479341af5c3a37432b0b88f4d696f2c14
SSDEEP 12288:dlOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjg:dl0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T12BC4238EDF0911F6D0312F3C28A1D324D2D8BE21BED13ABABBA1D14ADD7574B44658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a3fcc27b8b2fa50b2169a2bef3d86fdb259c14a88f7cc3b5bd3f6da5b38916b8
MD5 5192c8e5b28d10faca1361d6eab1d454
SHA1 d5261403360b843d9d65daa82f4d71514c17308b
SHA512 d9e62966d2a24b4107f7b1417749feb96d8f1454a72704dbde982100087db9e8b64fbd7c180d51f8cd40347a18e75e13e480b61d9b4895a0ddbd645f70a44fa1
SSDEEP 12288:UyPz5L88OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjO:Nzy80Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T18FF4024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 24e0170a1f823ec99d3db23bdc6f79d0eb72e3b9d8130bb5816d28b5319018a9
MD5 165ba565e95fb3eabce859189c9fb298
SHA1 777310752b0f9d8023492375f11685ddb1622ac3
SHA512 5364c5e815de0537b50307e17ad606da3df4a959ec7d0217f13acd949d07fb590053b619e350571c5f29fe7bae056720d30d37802e67693e7cd75f6c2e6e4f94
SSDEEP 24576:HT8aLl3z0zDG0Djsf9nz4mloFQnpXUMPQDR6q79dA:HT7LljIDYf5zaCpXxPuR6E9dA
TLSH
T1DA05F199B75018F8EC73463D88618A16D2F27C261BB0CA5F13A4366B5F333915C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 13dc7dcbae6627f2121229dd77762d6e9e4bee212d1c8a6c0f21c414ec6e19a6
MD5 47274d79a8d654e4a108e028489ed722
SHA1 1bb56e89f09f447b5f45dc88bbed86aa816729a2
SHA512 b8d7c3d49a06d1ec0eee2de76ad8c278c9d1e0c657dc46b99a9063dbb4fbc7ef8d6a68cc84f78db0f87723b3bfe9456ca1f64a96beb41667277e99adee622cc3
SSDEEP 24576:Q3rd9CHKy7GZa0Djsf9nz4mloFQnpXUMPQDR6q79dA:ard9CHKyanDYf5zaCpXxPuR6E9dA
TLSH
T19525CF90F7E410E8F0B39A3988729511DAB67C591B71DE8F13A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 11757fdb0e3d95685109912284e3e4f6b3f82720eb32b289b691dee974b2d6cf
MD5 78851c361926cf65b2ff0d2e742041b2
SHA1 e94683b3dbee2bdd0b339779a7bf719925ff577a
SHA512 6a6cb8fd9121ecda4afd81549bc0c8bb058b7ea429fd607a312675195bcbbea28c06a3bd5d4249c5f934f43d76ea87af3e1e8be4085d1ae4f6fc3998992f5a74
SSDEEP 12288:PpsfVOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj8:gV0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B9E4F14AD64802E9C07E2638CB519601F3737C21A7E1A7CB67D0F53E0F766859DEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AILog.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Size 1KB
SHA256 f300a4b39f280920202f330de84d430534e548de383d85e2411df1216dc3cf86
MD5 bebfeef9476482247d7d56a0e1c29fc3
SHA1 738810a2fe856ec68825fcd44a219a480d9381ac
SHA512 54a6f64ed1481f9fcd3d87f4d4f740144c7df15e4665e244c8f8b2401c1c278c84c70365e8ae030fc1bf4276c2f53b3506a120c67788ff3177c6e72502fbb3cd
TLSH
T14421410303F0D1B7185E868D339D33D8479E5987588894ACA3961A0E2BD621937A8EA7
MD5 SHA1 SHA512 TLSH

Submit Download

AILog.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Size 712B
SHA256 75407ec05ed7f0f0ff59de338f0cc7ce109a438becfa207389c3a6ae04baa346
MD5 de861bc190ed09a7804e06fe312b0ad3
SHA1 02798a7702b18b3f27e81f9c4dcfa02f2a91af20
SHA512 61b6f4cfcf470a7196248510744d96d2b220dc961316ae071c37b0c2b6a709f8842102de9e1f7acad370e099ca954183e1b3de175db250b9f62246e2aa69dd99
TLSH
T1B4014E0303F0D2B7185E864D339D33D8079E5987148894ACE3961A4E2BA621927A8EAB
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c24b798e399b5e8edf7a95d2bb002b8105f67c10f8941d285697d0b2a3f70fbf
MD5 6a2007d413b5984955a13dc6537d4f74
SHA1 901e94bf0aea4ae0cd1939dfcc114117e6d14165
SHA512 411cc26153b99e384dbb4e4c091281ac77546d9d723160e5ca7877e776cf3303bcb4a4c5909a9593fa1eb47979075ea77971887e608100b6f6c87873445ac2f0
SSDEEP 12288:FqOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjD:Fq0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T179D4234ACF0851B6E4712F3C14B5D334D298BE207F913AEBB691928A9C757CB8874987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ab6aa9734b1c49abbffdded7affbb3c608616f8608e635550983707abe8596e6
MD5 341c20c7851ad9556c168fe90f27fd1a
SHA1 fe313e61a9fb4304b8b836bfc08bc7f72451a0d0
SHA512 e6372595476cadbefe0f4dcfc7efca9773eccebf86e4743000dae3204c59ef0536c3fa0adab386306a190de2df4e838be786271d2a5799f5e6d6fabbfcc77e52
SSDEEP 49152:rRZwQCyiHiQEaaPnMzDYf5zaCpXxPuR6E9dA:t9xvPooDw/z
TLSH
T12385B01E63DC42A5E0BAD278CD674407E6B278165731A7CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 4c817f23c19c418088cb90f5066de7de58ccfd32134fd8180d4e06d013877e01
MD5 848a5d0208c6a3332d94f704bb7429c6
SHA1 6fc4a76d790c1998ee9bd02546f3b912cbd3e996
SHA512 3b8f18f9cae2e99ef3d448e85906cf3a9752b6160064d5e61bd78d4c2e2ac87c18f0a21f69c33d041075bbd7c3431f65b3f3de6733cec10172954ad037f513c6
SSDEEP 12288:xbxA1U7K6OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjv:xbxA1UG60Djsf9nz4mloFQnpXUMPQDRE
TLSH
T15FE4026E9A9C10F5E0726A3C58E18205D371BC262B6167EF21D1C27E4F37BD99C35E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8605ef74693888a88637a60673c6916d92f11e24a7733c2a429a942647fc4888
MD5 7059216d78b92ff0bbefc1bc033f9566
SHA1 fe80f101d0e17e93e4864ee09b8d89cc7edb4090
SHA512 697a7c947b1dc13721504d701b71d2c53dbdde7f06ab345ed9c4a7b898335046d675828bc2bdf5baaf49adc908aff4689a8c3a8bcef22baa6d7c3af081f5f18c
SSDEEP 24576:RjsmP0yHaqrVqHra44KDzMsrnr0Djsf9nz4mloFQnpXUMPQDR6q79dA:RjRP0yHfVqzlAsrn4DYf5zaCpXxPuR67
TLSH
T1B245BF2EF2B910F9D4AAD136454107B5FB71782D1F209ACB0170C235AF1AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 6352b926c8740094cba1ec87c23d58fd5d193dcc33061caa5c5118f30265aead
MD5 a4e8d27c65fe7b8faba7f10fe104fa6d
SHA1 ed5bcd487216e70aa74a53c173333967cf577df3
SHA512 804b5483de545e1688fab29eeeab8fb22e89ded731d176014cdcf93d8fec23a0a59f566ef188be2de8adec5d7d5728af68b5ad5790cade00fa235e61157265e5
SSDEEP 12288:/kOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjg:/k0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T120D4228DDF0911B6D4312F3C28A1D324D2D4BE207FA63BEB76A1E14A8D757CB8475982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 0f1f1fd8890aec52f1d212c3e88fc7f24dc2dcd6bbe2f501a8a8bb7de6de827d
MD5 7b363b92b8a88398658c0a7a211b9a61
SHA1 5af0d6aa09c703bdddddf5dff0ae439127e09727
SHA512 218c2b19386962292c3ad9f5a9e48d6c519490d0731ab2a84693149c8d37f3561ea7b991be64c765acb31229897057ad37ccadb0d3f9cb86b76382a00c1bfe84
SSDEEP 24576:xALBUTH0Djsf9nz4mloFQnpXUMPQDR6q79dA:xALBUgDYf5zaCpXxPuR6E9dA
TLSH
T15E250159EB9400F5E877923C88B28616D2B2B85D1764F7DF03A88B551F237E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 76b703f3a811b0f364071d8e8baeb649bfffdc8097cac858d44a0dba976e4cb8
MD5 ac0a1d69e61763e744ade1fc047f479c
SHA1 607bb3f1422a4c1250de104c1bd5cee8d2b728b6
SHA512 23867f91fcde3d30810c52b440d9c05154d89313fba0c5608b386f0b6d46f9b5ed7d3380624aa2906092ad9879b1dedd898c3d3dc2e2b80fd7ddf3f4eb36d2f2
SSDEEP 24576:bfYNHn0Djsf9nz4mloFQnpXUMPQDR6q79dA:bfYt0DYf5zaCpXxPuR6E9dA
TLSH
T12F05F11F965D08E5D53B623D89C28219F2B278621751A3DF15F0C27A0E27FE9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 27a150aa7d33791841eb515303d2f0afbbbf857d7786e19006b89ae4f2e57f78
MD5 5f38affab1eedb139a2fccad8fac7b4b
SHA1 7031c37f60aad204bd5cb22a1a45ae0de54f90c6
SHA512 97d1022b9b342a19b137d55923964a4f4dd5374894432a1d89bad55640d436edeef30c2ebf134466043be1a1346c9cef620701dc6f7dab62851bb3c8c953585f
SSDEEP 24576:InXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK5:InXoJJYH84VVS6AmETJas+cHBjSSKHPp
TLSH
T15165BF9EA6BC04E8D5BBD13CC5C24506F5B178621331DACF0261C2BA7F27AE55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6ed4ae20ba667bbf03ff769e8292625361a3c541b97aa064a0ef7de250b943db
MD5 bd9cbc4cd885fe613e776188913b712c
SHA1 22f278a84e361ce29b66688a94fb08c1b8f2cfc5
SHA512 428eb92d493ca6cd18e67d3fcb2a0979623145d7128b977c6abb3134b5efbb7144b81cc6e6c5d887ab4d31f343eb65749617b3f03c24ee874041ea1a7e65ecf1
SSDEEP 49152:lDLL9TuJ0M/TYW2PaDYf5zaCpXxPuR6E9dA:WloDw/z
TLSH
T132858D5EA3EC42D4E07BDABD85B39146FAB2B855273091CF1290856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 fb87b792057734c862ed4aafd336b63ac7fc62493de87d64a5d79bfd7a0fdd79
MD5 55aeee7643ec8138863e1d2a1b5a4b01
SHA1 1a8a5d113ce4e0234fd11db2b4d82eac7cec5d73
SHA512 e9cd533b115e18bc6c53f6044756ed6f3050b986b241338cc3210963148e12c51386104fe9aa5059e0003d81b7eacf5e81d3a23650c9a89ebe94f0af00e2ce65
SSDEEP 24576:2egJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wH0Djsf9nz4mloFQnpXUMPQDR6q792:2ngOJOmPOHkUDYf5zaCpXxPuR6E9dA
TLSH
T14F55C03FABBC15D5D03EC13D89928916F6B1782613356ACF0560827E5F2BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 0a328d6cc0a7df656d71c86d8c615efd19fe6c6a2721f43fe4e897c35a82720f
MD5 2ee2b2b76aa0a104032a6cc1c0aedcee
SHA1 9ffc1d29009877a3e5581a02924aa028d13d58f4
SHA512 531f4208065c08dc02e3f19ce37c31e2d9bdedd47f183ec213083aa76898aa37709b3281adc96cfd08e04f8e4de4569fa3aac4818a1016448a7fd1804e855a08
SSDEEP 24576:nLJnJiTk3R3waE4JrOF0Djsf9nz4mloFQnpXUMPQDR6q79dA:nLJnJK8R304lZDYf5zaCpXxPuR6E9dA
TLSH
T1DD15D02DD2A810E8D4B7C2B4815A5756FF71382C2F216ACB29B4D5313F12FD0AA79F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3a9af73c7d8020e0202157696db34ca0e979ed95a0953b47943e648918527fc0
MD5 dbfd91fbe67ed6ef750fed7e377ac7af
SHA1 6c96c6b691ac02beb1644e354eb11a89035d68e7
SHA512 23a2c770e67f5dc196a24579dd3b18c340c3b279f63162c69a26b6810974f335494f9e702f21132acb9f9e10f51fa4a87970c4b12a40ac04689d3ee417b7e25e
SSDEEP 49152:29GqCzDScAZmlvTcFg8Ph6eDYf5zaCpXxPuR6E9dA:ItoDw/z
TLSH
T164955D05F7EB5298E8B3CAF1C96294159B327C509B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 b015229b27a37d44f7425745cae188c26fb7ada1e24454c960cd9decba37daae
MD5 ad96c36565fa5b5d59b69f6fb69370ff
SHA1 24ae3001494eb281002cb4c967f08882379662c2
SHA512 d6675781cfadc39b28872cafca6a852b721f92ef9caa0cedb68f0d1c4d4d2e1e938b036b5e74a3fe56a8094fa903a6fc702753f590ba3f02622156f7e6bfdace
SSDEEP 12288:2lYJeXm5nkEUuEGOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRlN:2lYJeXm5jUuEG0Djsf9nz4mloFQnpXUa
TLSH
T1FAE4125DAA4C30F5E0365A3C58A18214D3B1F8312B5137FF62E0C27A8E76BDA5D39E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 b888e099950403ef56a7a3641727ff6faf5fa48fe6b1f0371136ee0c9d01a940
MD5 f8fe9a04249284165a2b8b878b3a1eb0
SHA1 47ac25e8604267d7dc761daf8aae2a46c64d1d03
SHA512 7828f7ea4d3b6cc009e1df40475651047b492694e20a42f9afecf7ef5f28a2ce45543d1d11b9e7e40051e0ee283f4632f4f378e06eb3c370a902ef0687b8719c
SSDEEP 12288:Swu6kyLOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjr:SVtyL0Djsf9nz4mloFQnpXUMPQDR6q78
TLSH
T1BDF41209AB4461F5E4711F3C98B28264DBB4BC206F6167EF66E0E63F5E727C59830B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 a15057dcd4cc392c34b957800ffe68874c385cd9b972be7779f57ba47e3fc470
MD5 4d388441d3df2588ce1683f167872180
SHA1 42676cc786df41ab49ae60146c095a844ba15867
SHA512 1a675d4543711ad1772c5f57934b48c264ba46dedf941a5e6c559c4bec849b856445f074f6ddc1722bd2b922f15aa8dba7e4c4efb16592ab9ea721bac50c4c8c
SSDEEP 12288:6PHOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjH:WH0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1ACD4124D9F0921B6D4322F3C14619224D2E4BE307FA13AFF76E0E16ACEB57879475982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 abb2f675ed30b3ec59286ba812f383a98369ed924a5ba7b60abb2b28161f75d9
MD5 5bff2717cb210613ccc35514bfaa722b
SHA1 213ae9efa9f9034c0ff134b9854079bc8cf6de45
SHA512 e3261855f8fcaec01dc0e2410a12a93c31aa9a6c07e29b494a0e09df62cdb252a568b1b494a7b9200dc8377c5d102096aa81b169ad80acad4914ec9d575055ca
SSDEEP 24576:ZC+TyQIu93VAumZr7jmo0Djsf9nz4mloFQnpXUMPQDR6q79dA:Z/TfIq+YrDYf5zaCpXxPuR6E9dA
TLSH
T1A4559D1DA7E919CAE176C675C8A34493E633B872237196CF2044C07D499EFE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 4adc1397ebbd62e7e05d39fcf02fc479c078e8b94827e08b931d7b753e71d0cb
MD5 0039091cca4dd5c0917c5e5601ea61c3
SHA1 126264f6730ee6d5770d7928e20d86a664aab977
SHA512 75efc4ef89c37b378529d858a850d6181b25ca226c4ec1df053a1d0c6d2f2634fc71bfa8457de485882fbee6d4761b337bd91783b3edf95a000c453ac76c5c19
SSDEEP 12288:wcyrWOstaa3kcsjOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRlz:lLQikZj0Djsf9nz4mloFQnpXUMPQDR67
TLSH
T149F4F10FB76A10A5D077823C88918215F6B37830575267EF52A0C7794FB76EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f7c5993b44dce6765676bdb4b120aa744ae589d342b5d48527301b323d8f8968
MD5 5283cb5352942161f70cae2bda4575e9
SHA1 e7a818b1cc8821092a6d7c663683744cdcd8fc35
SHA512 e8a48a3b97be2e411c6bb58d5e426b5d608ca975e2994a4d37658c65afead01a22d857a05edc2459253e9e3e455b60eb80b8806a8cfa0eb56b6fbe1db771dea1
SSDEEP 49152:opJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPJDYf5zaCp5:5pC7b4+80GTkIoDw/z
TLSH
T191A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3d29a43f6fa4ed3f585d4e5b07a020a4307a3870f0ede1b0188d8857dde3b59b
MD5 57084ebab8c43031f599083ca495e05f
SHA1 05a300acc2fa686d485db5aa884c16b49efa3f72
SHA512 eacf8134b58f832badf5b6587e8c6cd2939e17fa980ff1b2ae57498f5e35f21383709d45d2ae89a7f767dacc1afb72adcfdaf18578eb57a3ec0768ad2f05dc8b
SSDEEP 24576:hSAwJPE1IDAo+4Kt+l4413lUQj0Djsf9nz4mloFQnpXUMPQDR6q79dA:hqPCIo4Kol4jQQDYf5zaCpXxPuR6E9d
TLSH
T14355B01AE7F946F5E17ACB749663C211FB727822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 feed030af9d725b5cab1e868f9bd6e30d15ea783487063f0734b371389f16e4c
MD5 0061eeaec5065267a2369030b63855a5
SHA1 3462fb80848b7f84c537007c7005fdde44e0d349
SHA512 414bb59dcf304d2c5dbc8d80300ad66e917b1a296db52c90dddbbae208f56f75a242b9dd6c5ad1b03da57c61d84605a900092189db12ff271d542a0e0af19cd0
SSDEEP 12288:y9lyvj3IkxjbBzSOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRli:yWv8qjpS0Djsf9nz4mloFQnpXUMPQDRE
TLSH
T17BF4124E9B8420E5E0351B38A4728225C1B1BD322BA57AFF71D4D57A8F35BC6943EF42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-25-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/784-128-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/784-18-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/784-24-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1332-57-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1332-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1508-54-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1508-68-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1508-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1508-280-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1608-317-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1608-310-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1608-311-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1608-429-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1648-126-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1648-283-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2224-279-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2224-33-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2224-38-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2224-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2304-425-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2304-295-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2432-74-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2432-281-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2468-93-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2468-282-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2468-99-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2468-125-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2820-516-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2820-351-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2820-291-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3032-102-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3032-79-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3032-85-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3260-450-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-437-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-469-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-436-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-451-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-467-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-468-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-453-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-454-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-443-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-455-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-442-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-457-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-458-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-441-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-459-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-460-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-440-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-452-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-461-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-435-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-444-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-438-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-449-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-445-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-447-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-462-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-448-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-439-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-463-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-464-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-456-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-465-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-466-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-434-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-433-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3260-446-0x000001D48C3E0000-0x000001D48C3F0000-memory.dmp

Download

memory/3328-324-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3328-326-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3504-127-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3504-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3660-337-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3660-515-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3788-129-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3788-115-0x00000000007E0000-0x0000000000846000-memory.dmp

Download

memory/3788-110-0x00000000007E0000-0x0000000000846000-memory.dmp

Download

memory/4764-305-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4764-428-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4764-298-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4764-299-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5292-72-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/5292-59-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/5292-65-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/5292-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5292-70-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5300-340-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5300-517-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5348-430-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5348-321-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5396-518-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5396-343-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5396-349-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5396-391-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5396-407-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5396-423-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5396-352-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5396-431-0x000000000BE90000-0x000000000BE98000-memory.dmp

Download

memory/5840-513-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5840-328-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5992-333-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5992-514-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/6140-124-0x0000000140000000-0x00000001405D0000-memory.dmp

Download

memory/6140-119-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/6140-88-0x0000000140000000-0x00000001405D0000-memory.dmp

Download

memory/6140-9-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/6140-1-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/6140-0-0x0000000140000000-0x00000001405D0000-memory.dmp

Download