25b70575ccf7c2c507928e13eb2d582690d7f9363e5b5f1c28e778e0cfa1d0f4

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Size 1.3MB
Sample260809-31lefsfp3v
SHA256 25b70575ccf7c2c507928e13eb2d582690d7f9363e5b5f1c28e778e0cfa1d0f4
MD5 463ebdef459ba406e002bd69e7cc5fb2
SHA1 45002acbda9278e95b424fe7a0d310203f334f91
SHA512 34661626caf942e048f5d881338737d21922ec62419071360dcbffe6c89486a9b7a2a49eb68458f5d34ae4dd3863666543032ea306db2016bbedf135d73d17a9
SSDEEP 24576:UdKx4n0yqC6BsrAHtoAfYLH8AcevDN0FImbwQuq3Wia7gD:wKIhVe2AQgAT76sQuE
TLSH
T1C055B013B24A91ECD96EC07C471651727632B88D47307AEB22956F383E6BDC22B7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1524	alg.exe
2212	DiagnosticsHub.StandardCollector.Service.exe
3752	fxssvc.exe
876	elevation_service.exe
1172	elevation_service.exe
2156	maintenanceservice.exe
2944	msdtc.exe
1736	OSE.EXE
4104	PerceptionSimulationService.exe
3472	perfhost.exe
4728	locator.exe
2600	SensorDataService.exe
2728	snmptrap.exe
1484	spectrum.exe
1780	ssh-agent.exe
4988	TieringEngineService.exe
2232	AgentService.exe
4532	vds.exe
3328	vssvc.exe
4068	wbengine.exe
2384	WmiApSrv.exe
4040	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5e0af1ea19fe9b3.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f1ac9125b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a696f195b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b834f125b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeAuditPrivilege	3752	fxssvc.exe
Token: SeRestorePrivilege	4988	TieringEngineService.exe
Token: SeManageVolumePrivilege	4988	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2232	AgentService.exe
Token: SeBackupPrivilege	3328	vssvc.exe
Token: SeRestorePrivilege	3328	vssvc.exe
Token: SeAuditPrivilege	3328	vssvc.exe
Token: SeBackupPrivilege	4068	wbengine.exe
Token: SeRestorePrivilege	4068	wbengine.exe
Token: SeSecurityPrivilege	4068	wbengine.exe
Token: 33	4040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeDebugPrivilege	2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	2776	2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
Token: SeDebugPrivilege	1524	alg.exe
Token: SeDebugPrivilege	1524	alg.exe
Token: SeDebugPrivilege	1524	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4348	4040	SearchIndexer.exe	110
PID 4040 wrote to memory of 936	4040	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_463ebdef459ba406e002bd69e7cc5fb2_akira_quasar-rat_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4832

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1172

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2156

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3472

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2600

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2728

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1484

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3104

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6d8f571e9601f047005810799518a98470a31ec0e8691c30065abd46b0200446
MD5 96c3ffa1f5012804cf1e5f5ae68ca2db
SHA1 96cee2c60dd062f754128bb8b388b08f335b2440
SHA512 1c712537034fa1eb5906d3f55673d3b2869b51393e778df0df3f7da1ec436986a8c1fb90c2288fb9e96afcbaa58997789e03d61b47035f9b4e128373fc309372
SSDEEP 49152:8b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnkAQgAT76sQuE:m3q6sjBSqGsQr
TLSH
T123D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 69b4e74c4cad44404f2397d06a99ca10ee18b5bf48e4cfa8a14b7d695c78183a
MD5 18d3b23920e85b970ff45e3581a7e240
SHA1 48b28ab233b883bf4ee78022c2453df25c799536
SHA512 c1856beb2eb7a109724869a183d3e86ed44eee8c42050a3a7a6ccd206b443dcdffd9aa3b633ee2a1124e8d0d79b790ee1134c37f8cbde24e5dc68b7e5951da69
SSDEEP 24576:2XYfDtczAlAfYLH8AcevDN0FImbwQuq3Wia7gD:1tcuAQgAT76sQuE
TLSH
T15E75F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 177c5c5b25fc1a2694dd3665f910d3ffd1a18014df3b5e2ede47941cc6de8838
MD5 00e1a6dd883b73763c1ced6d8100ed99
SHA1 523a98f3e799a6c91f6f20a1c9a3f7c717637d12
SHA512 77be1bd2d86e22c45c4f4590ee17f8ee07300923a091f72a08b8f7b0014d7bb7d3c0fd4c0f9120e5bcfe94f0460530107b5c9e3c720530b64dc79253a48c8008
SSDEEP 24576:90Le5ji0hmxxrM8AfYLH8AcevDN0FImbwQuq3Wia7gD:9Pji0Aj7AQgAT76sQuE
TLSH
T18F85AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f692ab0a4b074ef474861ca6398a0def157d3b809ce342a9bb09ce3ff6c5f676
MD5 abf03787b1229d4411e7372707fcd04f
SHA1 c07aaf905a334847a2659160eaac2b002f790111
SHA512 78b2d4fb5eda3fc257bd434155cb0649f7fddd1644f042e80a946c425adfbd58628ea13d2eda1d57889f2f62c83307a10c3d7413791f7a5ab1b48cbfc5207d08
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyu+AfYLH8AcevDN0FImbwQuq3Wia7gD:J/ezSC6vUzPveHjynAQgAT76sQuE
TLSH
T105755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e155a52b4dd7ceaedd0b08753ed1216fbb3eaca36951ae236ae2ca695540eb03
MD5 e0512363e8503bc4302a90e8b8721448
SHA1 d56e60254bd6b70b80cdbdcde1071efbb6119049
SHA512 de367ef3cf792e506ed7d2e1aa6b6b494b9420b1f65cd17ab2dc6102a3cbfab083f6273556207f0ca9427d30648aca6ae6dbcbb7bf97125ff95fd3b43609f7e3
SSDEEP 24576:cVbqPb88hv/l+YZAfYLH8AcevDN0FImbwQuq3Wia7gD:cVO88hXl+mAQgAT76sQuE
TLSH
T19C559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5374e28f5b907efe238feca74b7f79937d6e2fbb20ba640903a812c375def8aa
MD5 5fe6043fdf1e09b06310c0a4a68692cb
SHA1 c3d78af49016747cb16ee00544571887e2c8b81e
SHA512 b4794858df9f2cbf24abf9cd52a3e8454ba830d1e77671dc224c7ea9f92f455140b067cb79d0108ba94be9e64c308ed0c378e2d6cbcd27646927eda52fc68e2f
SSDEEP 12288:eLwAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:eLwAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1325523574A4C70EAFEFBD1369CBBA5B963D1BCB8824497AA00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0302ae3803a5541fddb2111abfc6046d6aa6cfb09b2bf1a706db1d3ae680aec3
MD5 59d74e70074e6505f8bf819df703d7a1
SHA1 1f71bad2823b483d10e47b834fe5a11e7d3d8a71
SHA512 50ff9286ebbef678e4c505079a689e4b1ff1ace7edd23738cad41e9a209b387d7ca728cb3c2bba2e70f101c25c747718f3811254ed8284cf933fbadb2e1b7bbe
SSDEEP 24576:iJIURAfYLH8AcevDN0FImbwQuq3Wia7gD:iJIURAQgAT76sQuE
TLSH
T11575DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 488893348eed4f69bd443fcab34e7ec970d5808c52460f600586182a04870e0a
MD5 b6e40ba8ca4de7c20bbc9e0ddf801f95
SHA1 ceca8df696ff3285b33d422da3ae1b563f40f229
SHA512 e46e6f799a9c767553c2ef633f6b8b588f583ce6f13237b0d797d14080be912fc77bdffb5073bc7727d1a17bd02891e35774fe1c0ddfb0947811571293716b0e
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH6:eQvGAdlCEL8c/DRNw5CnqGsQr
TLSH
T18B266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b76d666f492334d85325da2ea2760a920f843fdbd0d801602f3b331149bad25b
MD5 7829baca30f9819e2d3eefe5a6123309
SHA1 1034d29aa570ea02efd59d6e7f529cafc46016bd
SHA512 4c999e5f2ed853a3cf3615756ef1edd7e982822b936fe9cb69753ab246b99f4763533d986c5fd20dd371803cd82d07f35f5a015880b13b0ac6c76ad4642c6ea3
SSDEEP 24576:m0ewsAjLAfYLH8AcevDN0FImbwQuq3Wia7gD:3ljLAQgAT76sQuE
TLSH
T1F775E031FE74E036C6BF0DB61B36C716146CB9204B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3bb6cf1655b108f60348faff8873f6494b0d12d9807e81b37651b0d19ff09fe6
MD5 d63a403b51335224d2ae44c4ed5b4d43
SHA1 663128107cbcc41265c269600af6c6ad57441cc8
SHA512 c35dc8459d5f78c47f4e2b6fad3051619d8cca2a037215bf3ea0153093185b9d88cf85a27ed880f2331f00ad2947784e429ee4deb6518669ef485ab9e11ac3fa
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6j:DUEtQevvqc2W1cpV2tI32
TLSH
T188474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ea2857392f192c1ab987b0c800b806047358e1e72d3fc6b13c7b326cb2a22e34
MD5 514d6617aea5a5a830c0dc064b9851ac
SHA1 300699f85c34670d4543f9c48101863f9582efef
SHA512 08217446a0fb9f8efccf58b949d77ccc260db43d812ceac8263cae13eb369a771381fdbab8b8262a795a9e40f1ddf1e1cb2e3fa1d95127ada214b335f898d8ac
SSDEEP 49152:tCbRquA/m2yL5zTfFiV+XenmE3/zrAQgAT76sQuE:KoquVjnmDqGsQr
TLSH
T17CD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 56f2d14080af532a2d901dc19803cae5f8214144413b59d2e7551d4b0bb4ed1e
MD5 e550f861ae128dce25af13345eef0664
SHA1 2dad969d3986c7728cbd5a2dc377537fa6dfd2e1
SHA512 076ba25d4257c675ea058a672cabe7974b2163e8b8c5453bfa345d895ee68e1428f36d0df497efa8dfbac6a17790e45a9989165dbddc2b28f44e6d5f895f8fab
SSDEEP 24576:jAhGL3IFoiwtA5l7S53KAfYLH8AcevDN0FImbwQuq3Wia7gD:jAMUFoiq56AQgAT76sQuE
TLSH
T1BF359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cb08b1bc3018859155a4ac2b9b32261fab7a53e1b4e861a6613877d7974f1905
MD5 c3194254a92f14c7366d8b19e030833f
SHA1 5822c3c7379d0915e92b3a3ba6f4461beaa9a8ea
SHA512 e0afbb8c8052ff7e9444f13d8adde73abe3e05461f24df1b925ea1167516cb1eb5cf8cf78004b3421fa62e6ad517ef12a6f699e2df1fb5ec6176daf4d350c00b
SSDEEP 24576:Lwu4OWHAfYLH8AcevDN0FImbwQuq3Wia7gD:LwvOWAQgAT76sQuE
TLSH
T1FF65F14676A81CF9E9A7813985A7C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5cec5a76e2bd6b5f7a7a55dfdee6bcc53aabf82d48ec4180367476be982937b0
MD5 ade51f3a682e346f5fda71201db3f568
SHA1 df05881dcc7c4b5c6c5263e02dcf9f5a023ffe09
SHA512 7a49bb46f29e7a515a92154ac22b269c94dce4a23a144530867cd3b8e2996f9cfe8f6f7dab9850beafc464000fdb37bde4da84cc81876b0a36bd1981a019739e
SSDEEP 24576:gZu0AfYLH8AcevDN0FImbwQuq3Wia7gD:OAQgAT76sQuE
TLSH
T16955125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7cb1d0b6478acddfe691e20a688f316f7daaa7b47afbc6643a612aa83657de6b
MD5 a82442b617878a33300985d7557d7eb8
SHA1 8f1045aed24d6df33274551b34e8f3c1e8555276
SHA512 d9504db52cf3f5c83b233b901781d95b8207b9c98149ffb16364dd71b75d1313e26a0546106185539e70fbfab1310c609ca84fdcbb6234dea456ecf346297939
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:gQRQyi36YOcPbLvw2gAf+PN3GqGsQr
TLSH
T188667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 859aeb20131e0803042e87e3df4ec5b4f3c1a43c30774bfc7ff7f2245c7a6a68
MD5 e33d9d2da4f6a14d464c919645c751f0
SHA1 8946596740cbb88087498255d8f6cd1ef37a3b13
SHA512 ef0978511ce59dc6a3018f24d39633df59ab9857a5bf2985cd0bca1d37ae1feeabd75f7521c8b716922982834277ffe0eec20a23002a1af4876a396bc5e158f2
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:mQRQyi36YOcPbLvw2gAf+PN3GqGsQr
TLSH
T136667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ce460f90be6e72c0958a2267eccd0c61999968ad368e38e437f3ccecfbbbc563
MD5 8a7cac697ee0a40d16106ec7d6fd15dd
SHA1 898fb071e4568e40341b4bede423e00c979c07f8
SHA512 dee7d576e41326ef5fd71eb0e559ebdae4c9a594b13f6c1b06b97ecb2ffd8d7d535814c873a863d5364ea00d11605aea2cca6f03ee3333b96d382fc1281c01b7
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0kAfYLH8AcevDN0Z:G68Qg55nhceWu7PNU3/7AQgAT76sQuE
TLSH
T1B7B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ad4143916ff634a3d91870a5ed2e9e8470db2f9ba84d543edf2dc5fb04756ead
MD5 260a9527ed6700e7a13e4977e980991e
SHA1 5a74d406d66a3e5573cabcbc8245bc876fb15bd5
SHA512 f274bb95ec393d2d8c77edd34fce53509221ae11f8b166c3f55d5578fd705ea76117111f96a42fa3756b9e6ff87020bcad1e53aa01d649ea08b79f451b8db1c4
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99w:Jy5112gYy5azzVvt69nLKnhZlqGsQr
TLSH
T16D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e59fac3fe5d32d3de7533f167c4aa250de0fcd8ef7af9e52316c778a2f75f02c
MD5 6d67000c5fd6cda6906f6da1e2507c2b
SHA1 36d114bd0f2971fe55a87b1eee5273cf70cbebf8
SHA512 255e25c9e4866aa3c9a35aa0b7b65c6f6e8ac8a6d67b5e0539f19a112ade3ccc930fa704988914a7d4b343cfb5afe3eb36b03d4bf90066ddb5eeff48d835fa58
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glVAQgAT76sQuE:zu6Jmdxd2d+qGsQr
TLSH
T1A7D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1788b992732f3de6b279bc601a8254b2529f4a0d3b276a7ec718bb0745b32436
MD5 e7730f63db860df22fe3e992a8c7a17c
SHA1 cfc9c999719956d5ac00619d4bef3feeba845b2c
SHA512 7056470331bdce188a7a988961c5b011c218e0d94395be263102a634f3d68a4c0222b040530d6abd4e3cf5f13b9325d22134a9075da096841e57b5e4a78a6190
SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xxAQgAT76sQuE:6mifPWRDqGsQr
TLSH
T160B5BE13F2D900E8D06ED17887569232EA62BC450B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7efacf6be905279ec50a13541cf1dbfc60a71828462d55f8d15c2d99f2acb605
MD5 681db3e4b59fc64b9276768eebb15903
SHA1 453f952ac105495b1ff1f5db18023c4e73c2a64c
SHA512 db6c1db8f0873ea0befdffe67a70b58ce9764fcbabaaed590bee325723c16005610efdc71bbffb0b381aecc7a993ec6aa0ef2e6091f6587832844f0002b08c23
SSDEEP 49152:zSuZQIY0Be2KcRVtOnks6NMHq0AQgAT76sQuE:x5dKii61ZqGsQr
TLSH
T1D2C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8e0cffd066bce94de8ca855fa6e052f0b07eaa8e4417e162714a3e0af912a687
MD5 5f8a1cb0099372d5596bc63fb1903f4d
SHA1 c434505c43459b6b6d9e79b17e4c108d3e691bed
SHA512 139b8fd1f7c586b1e9171b1e8837323ca1c7f7d220d2dad458183cc1dff07f0c5c6a5f434aeb3159208eee7b55ea26fb5986b6fefa20f99f480fbde924c20dc3
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5wlAQgAT76sQuE:cX2imphvqGsQr
TLSH
T13295BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 76c18d830fa20d95192e252e20f8e26b6078b8031dff4d434e51c81d48085268
MD5 8edbcfa924e45da29bbac48f18a2c700
SHA1 4b06aaf1b04b86e7ef407ad809804d2f5f0c0ccc
SHA512 f759db23878c60af99417eb02a4cfcab7e4c4cc6ffacb30ba6e634460b74cc668da88863051d70f729dcc3b3be8cbd8e836edae1e1a33e42137895d26a98f93c
SSDEEP 12288:LoAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:LoAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10D55235B594C34EFFCBAD1368CB7A1B9A3C07CBDD346939A110A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 176d51ad00f7544c1409b4925ef3ffec6644c08a4328a18e957915f226ebd572
MD5 35b5fa71668a202bfc3e9a00ed5163a3
SHA1 ab303062b3b1ed1bc1546d8431369613e57845f2
SHA512 4720470b941298f06add43baeac5232f7d9a822a336f21b8b7f41bc80d6f39cd3a852b4edc1b194878fea8bf09e760ca9db002399222b4100284514f79cba0b4
SSDEEP 12288:kPAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:kPAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T117552357594C24EFFCBAD1368CB791B8A3C07CBED345939A110E2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 12f0e671567301174137244daeaa23f96316357634ebd0d23c75e7a15281af4a
MD5 a342be37a9a4cc2599833df9085400b9
SHA1 9950bdda67b3dd24dfcfe5d299766cfa5278e748
SHA512 d5741ebab92c5d9e3cba2f85d5ad44af0fba56d4402c24e6635c2a0db3305fa2f66ae927de9cf55b10436c537f4ec16299bd6431e953277b9eb314a97d160744
SSDEEP 12288:ZJAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ZJAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17F55235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3c42465ce788c6345904f6e528a435a00da1d21e64992b1d342ee2fd3faf3f00
MD5 6405dbcf4509fa6f521da4a7d6df859e
SHA1 ff6213410c6e457b36b8914b1e262e81e15e9089
SHA512 9db78a35ce7e214c007731a17b5e0ca1bffed00bb0d64f81f569ff79da5b7644c56c587265fc97476d02d6dbaa9754bd7d4118ccd8c729873b9251c407e0b73a
SSDEEP 12288:zVqAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13C552357165C20DAFCBBD135CCB39179E3E1BCB9931293DF06051A8A2E3A248D5B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c07a41419e2872d04539f1a445703c055116c7c6a83c15d0b67024ae0cdb1faf
MD5 3e42c7ed4736f63dc9b6ad3fe3eab330
SHA1 f11c3f2caa870d347446378f402be2f4ace9eea1
SHA512 14653eb811929b5a69c747f1e325985ed235fce9ecee281579fbb24f525a331437b2e9272f71c6328db0c1806cbdedd9b9a8cf1a83040ba30d5ab1c14d1f534f
SSDEEP 12288:kSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:kSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D2552357594C30EFFCAAD1368CB791F8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2b79b04afd566271b9871bda5ec52ae6d84cb5a8b19810ed312e5b52961f3107
MD5 652c8f0b652f08ad26b610f254e6ab34
SHA1 5c8200551f858e790c951dacb7f5371b733e0697
SHA512 5ba6f55c3c1a8b0ede9fde2c5209aeb72f80453acd4e6ff38beb9ea41a69ddad3d6fbcd8c787dbc5ffa2336343eca5b0a70aa646ef02ad2960028e9e8dffc493
SSDEEP 12288:UjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15A55235B594C20EFFCBBD1368CB791BCA3C07CBD9346939A150A2A867A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 21e03ce23b4fc4088e0e9c006f2744be9ad318f2465126c60a585a9c396a05d9
MD5 3a00f2c1e9cca7849ee06c98cd87969c
SHA1 0492be1455d1c1fdf61be21b8f56b95139955e05
SHA512 d0fe9799b7af8ef28ffec832ea5b924199337b9a1e37fd7f5a83fd976786c2978041509e7af7a2d2d0e0b224643229a38a397b28bbbd765a88618831d7290597
SSDEEP 12288:13AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:13AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12155235B594C24EFFCBAC1368CB7A1B8A3C07CBED345939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1051599945ee7cb2bdb592c683f1811787fe4bf0a8fd6df5e63df336fa01f1e0
MD5 36bc0abb2a14310f47143904db251982
SHA1 48e92b1ddc1c20f2f740e2405bf0bb647c7b9996
SHA512 86f1acb2ad94d6a402af39956da88ac939a7a87eba18c5a95ddfa135af7694efede3a24c4879c468a3edecad80130c574eea8ac1b4922ba885b7fd5203a2914e
SSDEEP 24576:HZMRzFVSOvAfYLH8AcevDN0FImbwQuq3Wia7gD:HZMRzfzAQgAT76sQuE
TLSH
T198750196B39018F8EC67813ECC668916D2B27C6A0760C65F03A436676F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0d957d4cb9cb02ac6905fbb5b6a86a380de76db556da43f8c26b10e36a8355b7
MD5 b14f936fa73c2fa73eadb7e54c2b14ae
SHA1 10eb42ed9a7f9abec86fa04d11c3992970331c69
SHA512 cbc61c515ca5c0ca4eb181e03394602ddd0079dc54ed7ef052c8bead334612e83f86465cb57caccf6c88c221dcef29eead9eb20ece3a3f58c466ba4e33660b3b
SSDEEP 12288:/EAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/EAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16255235B594C34EFFCBAC1368CB791B893D07CBD9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b1ae6ab36693dad5e0190b6382fee0b00a17074dbb8546e876b83d3298d4b2ce
MD5 45f9817c72a5021f9e2457073d7baa36
SHA1 333f6515d6078396f513fc73910f71cb5a05ff12
SHA512 38e6985fa544be270c1fc2eee75a910398fc1bcdbf0439a8c279e2a5ef738e8ed38b7b938480a9d19a0b4bebcb586bafb95df0c7aed06aae29d39f98fb8d2804
SSDEEP 12288:ZAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ZAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16455235B594C24EFFCBAC1368CB791B893D07CBE9346939A150E2B867A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 97faaa774830734fb5245c138f83921e1a0aba2d2364ca726e884ad74583858e
MD5 7fe8ec465b9d8459be31af7562b66c0b
SHA1 ac6c931ce0e99d241f28c6c1126da306de63ac95
SHA512 84caf55aae2343903d4e1f4e44ff3aa3a26e3eeffb876acfbcac941adfd7872054fa80cf873bf5a5ad4123a9440ac9581c6a38f8b690b639f62a6e692737dd47
SSDEEP 24576:DzybAfYLH8AcevDN0FImbwQuq3Wia7gD:D2AQgAT76sQuE
TLSH
T19F65020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c14aa5e50fdb76241d96bda4ee0e48bf737b361a956850d8139888c8905311a7
MD5 4e9291b35c409b49e268e5f70893199e
SHA1 2b033169d47bd0f11ec1b4e9d23978bbb9533401
SHA512 abc13bb2be70f843f23390f8cee122c9db6ef013229f5c276cbda50f0b834192b8ad261a85ece1492f1b5998574fa622977432a7faec4c612bb03da3014e83b0
SSDEEP 12288:PEAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:PEAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AC55235B594C34EFFCBAC1368CB791B893C47CBE9346939A150E2A897A3E408D1D8C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9b41b73348c759539292f3ef7e6858efb93b9c0bf8b702e8776d6648951dd35d
MD5 3a5ee49c1d3d87d6e8580ae0a7b145eb
SHA1 b655694dd52f36dadeca1c22db324f415da5f8c7
SHA512 188c89fc42876cec8bd298a722d697c016c156343cc045033aae8de28235065d7fa273d93cb69a9126c576f01f006f1fca87d58d395b887c03ed93d70d6b10c5
SSDEEP 12288:IEAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IEAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10F55235B594C34EFFCBAC1368C7791B8A3C47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 23520cf62a283990f9976b448495af0dcbfc9bfb45b5f82c4bb1c36961876a68
MD5 9f5bc0b5bac1a3fa0ebdb0658e5e740d
SHA1 79e5bf9be9a36a20a3d43bd4172689a7bf650749
SHA512 393ff5a942e933f61aedfd565a73078a6509f50be8775d8eab03dfcf9898bad6ae592d0ab087ee0a06d12c481102211ab2e6fedd8dcae1cf1a295a0055644324
SSDEEP 24576:JzybAfYLH8AcevDN0FImbwQuq3Wia7gD:J2AQgAT76sQuE
TLSH
T14065020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bed7accfcca2e7e9eb101ded827b067bee12dcdcd446a88ba02243c154440f5a
MD5 c44e50cbe5cac3175a26ac1222fd362a
SHA1 e71f0ff0830086a53c8af10175217edd7681e489
SHA512 77ae22b6b4ffdcf81c6c816975aa012152264c3d4639e1222bc607a829d22aca4dd61e29661aec0bac39905870c3f295545a11301be3fa61a37f5e73c0f4b3b4
SSDEEP 24576:acP4mcvIjkGOxhKP2l71SNKbrh/8KBsAfYLH8AcevDN0FImbwQuq3Wia7gD:FP4m4IpOO67N8KOAQgAT76sQuE
TLSH
T1DE65AE2DABDC0096D0BB913885668A49FAB1742A1F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 185da86416a8bd52c8b9b7d81a01feefc0ae7e23a7d8e457ae0d2de62d9dbb54
MD5 9610d2c10a2acc7de094e82c8b48d998
SHA1 e8ae5707a937f8324e659233ee87f8192f2547d1
SHA512 5acba06d45db937c0423a6c72c7e0880a0128b8ac27dd1c8a109af104743dcf3c7dbdaa24ac9e762b18c90c9012b7bbe5a0de27356467b10c50b0c1cb830f929
SSDEEP 12288:vbsf0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:C0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12C65010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5a15a1decb8490be622e0eb2f8813a1dd0972ad04154b425ef8c93913306b820
MD5 0b5f3b6ea9b05290092b5031b0d48397
SHA1 570e3ce2038883f6e737021ce50510d4d71506d3
SHA512 41ceea19ea59c87bb8610e5a224f18e3d3afe35c71a01bc276ba6368d1af8ef28136e353f53bc9ab7cdf36e22196f033bfe9fbde99df361bbfdb8e6b3acb3cae
SSDEEP 12288:hUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T103552317868C74DBFCBBE2314877D17863997DBC8B04D29B640A278A393D858D4E4E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7715c5947d435cdc35aae4a82c97cfd4bf26ab9da03b2d4ed501d25acd57b533
MD5 b6ee1ea40a4415f95dfea10723a4fd08
SHA1 ed2156f46294d8b51c3f951913d9477f407623ec
SHA512 95a6294f5b136dbc6d30e0c89a7e452e538149b75c3198f89d08269fa6edaf699d3884deaea8166a1777abdfe891ff753c4af4506a70f09d2f467a484e169570
SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQSAQgAT76sQuE:qa0hNYG4Jw4qGsQr
TLSH
T194859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 52f2e8dee94b4704d63f6d4e9f949fbd83296fcf581562a419c05350821ce9b7
MD5 18a5af73f1695ca82dc896d6dfc4ad1f
SHA1 27da3874befe146234780b9351e6e86744ea7b3b
SHA512 ed78e34106596c6ab213277fe8ca46d64feba87d26ce184d7eb667a6e7da767263bdf1df50c34ae0750b90cdb5b9dd76497764a08227b1b01e4f2a60de147b40
SSDEEP 24576:ZhbHjP/AfYLH8AcevDN0FImbwQuq3Wia7gD:ZhbHj3AQgAT76sQuE
TLSH
T17155017F16AC20D9F576E13D89A2854AD371BC79170193EF128282BA1F3BAD84C78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2e207e5de3be7ac36779f161d7da991aa18d712658f3f61b3447ebd56b178e9c
MD5 fcde5d93c4164e93a136315eb917fb04
SHA1 c09bf9a4b8a894ab5f6e85fe756105f1f8034a75
SHA512 83a69f89bb544f16f16765fc2d297127c882b5150cdb8933c146a76b33f4d8032315407960236b5460a95aa77d49e7d8d7bfebe6524de0a5586fb2e3b9c464d7
SSDEEP 24576:/3YgnJcRTk4yti+R5dpR/HAfYLH8AcevDN0FImbwQuq3Wia7gD:/IgnaTk46ppR/HAQgAT76sQuE
TLSH
T1D545BF2EF2B910F9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5a1d52c9465f318b826bbd28495b7b0616d0e42b3d40434fa199c553bd977167
MD5 1e5b2c9a7bd1df3e62d2d37b44ffb6f1
SHA1 b54f5e8656427f811b0a40b811b355f3d4967170
SHA512 e2e272dddc47b55d5c810e7a05dc18dbf86a4ceff8e5b57e454a8062bc7e2fda4ca792faac25a5dc3e627faf8923b9fe3259f616d9575dc21df8d1862aafe333
SSDEEP 12288:UQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AA55235B464C74EFFCBAD1368CB795B863C07DB8834653DB100A2A8A7A3E499D1F4D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 a051bc8fdf0b4aba9bb6c58de7b8e9778eb9d07cd2054682dd6c505e68bf4ead
MD5 9eb3fdd69cb3c31cb489541ce9ed3062
SHA1 9ad3005f914820f7c055b4727386deca25942415
SHA512 a566389cefeb538ab4552b42c2f517472e6e97492a47a493cd61bd119ab7d192b01437f9c8bc5d14b0dac03081f18f987d71bcf1d0e4dee6eedef862594637d6
SSDEEP 24576:ZbL3UTlAfYLH8AcevDN0FImbwQuq3Wia7gD:ZbL3URAQgAT76sQuE
TLSH
T19A75F155E79400F9E87BD13CC9B28526E2B278AD0354E7DF03A84B551F236E58E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 7b6680c582714e37600bdb0b1cb2acdfd214e4a3931032fed91eaff4c0e3feff
MD5 2070d78e55cfc96a6db4ce521d156624
SHA1 1265bcf0e36fb31742763944763f8e440f5e2e72
SHA512 fd3b5c393043cfd9c3db17e6487767c6812183cdce93e4467cc0faf8412eceff696b58da5fc914a78872213047af90f71c2420a60c056f9dbcd28570014a2187
SSDEEP 12288:opFtIOxAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:DOxAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BB55021A36DC20E9E47AE13D89A3825DD3B1B875071253EF029041BE1F77EE89C79E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6c02cf2baf676ce92a9a9a10155d3747e69ead58009e4a73bf6aa7fbb68ceb75
MD5 16515c4fdb2f22a8faf7ac5ee20f197f
SHA1 4815dbf5b22e4e646f2a811806affab4b82f47d6
SHA512 d00a1c4b8281c1dd5b0567be13e46de3f0d206026a0dcf847ce1a2a3197caf7db9d57373af142368aee09fd2ac57196ad3e483ddeb590b92855933183559b7df
SSDEEP 24576:67NM9YmZqmWMUkPjZM48Mv6bEhsEAfYLH8AcevDN0FImbwQuq3Wia7gD:67cBWMpPjN8DbEhfAQgAT76sQuE
TLSH
T15B659E2E6BAC81E5D477D13DC9A28245F6F2B4611B318ACB1152833E7F37AE44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9921a062c1c7a3a42c5138022c7eb4028a5e2bc244b7533af63c327861c27317
MD5 106cdb02b2d7d179b413716f14f23d48
SHA1 b3dd6401a6e045f150f1cac6add3cea98441a15f
SHA512 81b727db22948d551624fd241540ca7c7d7387f6218989c3617b564b396e3f54912dd57c0bd91f2a44e68abab263194b7b4c2310fa0c9dffdb3bd384df88e1bd
SSDEEP 24576:RW6BApg2YuyuNDYTabvcRvNYf8km1mAfYLH8AcevDN0FImbwQuq3Wia7gD:RF2YuHNETovcvNYf8kmkAQgAT76sQuE
TLSH
T17B857E2A27ED80A4E0BBD27D45B7D146FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7c107c1439a6dcf610d06f5698a188afffb4d2a10d92436970e24bd7fe2d8639
MD5 dc6cd5fe75cae1ce0b1ec5e327f7fae1
SHA1 3b2203472c6f0d5bfed81b7fbc6f040a7904644b
SHA512 ad26f3c1860ab86867a253eec4f36b466b1fc9b888f97a20a77c989825e90b54c5a89e6ce75c051d1b1255e3fa8a2cd73da7a0431b71a9e10431694205ef4ff4
SSDEEP 24576:8AFs06+OmlfkNXEbTodAfYLH8AcevDN0FImbwQuq3Wia7gD:RFs060lwXuyAQgAT76sQuE
TLSH
T15E65BF2F62AC00D5E07ED17E8997C91AF3B1746703255ACB0160867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9470213f857a9c3a96cdb7d8b2cea12a8bffb09706b835224e2e2155d5050c7a
MD5 76b4c23d6288977e721cbfb0adfc92b9
SHA1 e6afc277a7c8f06bd549adafb91da6bed4048591
SHA512 048744d6757a57eec83bbf2c40fe028acddf52d9cf3892ae23b76542db07e3820cbd7480480ea50b5ab07cffa1a6bc99b5a54f2411cd1c6274e267546c2e43c0
SSDEEP 24576:4JnJ5D3WtyAfYLH8AcevDN0FImbwQuq3Wia7gD:4JnJ5DGtyAQgAT76sQuE
TLSH
T1AB75D02DD2A810F8E4B7C274815A1796FFB2387D2B226AC72474D5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 840004877bb2ff957bad50d0f05a70e808f458321e6c8bb0ed030b684ec9e8c3
MD5 e64de0ef44027078ccef11c70a2a627f
SHA1 5e300746c238de6978f85070254048392caf5f1a
SHA512 3e17fd2ddd11b733cf68a3a680adf7ced6d8f6453abfe39eca5e8ea9fb82e26f25cf714ad2eb7ced412ab66b443ab31bc6ee9022525d7d03bb8cd34c6082bd43
SSDEEP 49152:Ko06DIKdwc+eQnSt65aVoAQgAT76sQuE:rfqGsQr
TLSH
T1D3956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 158a6880eec53ae750acbd06a1c1ffbad348bb6ab875bf0ed536de2d65f39cc7
MD5 df4626abfbfc987933f240ec62487d80
SHA1 6ca00ee0ace4a1ec1117fe4e979880357dd782e5
SHA512 91cb568b7428c1baadce1c63b667ce207af8ef510d9014e00e5ca51fccf73bd05c94ad9206f3b5921456d3fd9f68c492ebff37875790668eea74751d02db9452
SSDEEP 12288:KEP3RreAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:preAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A355126E279C70EAE47AD03D88A28259D3B2F474574223EF1191827E5F3B9E95D38E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 5b2daa4c2fb42768dbf207d8e0ce8c152f18a3515ca085b55020e69c46ac8940
MD5 50386ebd98759661658562657823bd54
SHA1 d68f031f1508a68e27c9a4802bcfb83bc8adbaa7
SHA512 0615207a602e2ec46770ed8061f1f3b74ddf069ecbc98709ca9410046863c70075be434e78d7bd730966a2db4e5010929e7a4246dcb872f5f93ca6468eba1705
SSDEEP 24576:xIyPAfYLH8AcevDN0FImbwQuq3Wia7gD:xIiAQgAT76sQuE
TLSH
T15F65120A539C60D9E9BA81398D7381B49BB1BC745B1193DF5080B73E7F3AAD4A874F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f9cda8c6ae40120f984fba3a1fe07e0dc3f515bf00f5abef48c24e92c6bda401
MD5 8a2e6ef3e038091da6b20a09b2226052
SHA1 1a28d767d087aafdf767e30fd5a555cd4ea0b597
SHA512 5cc04268850cf19247428508a0200318635398c60d1ae552524f66db7e327bd5a57e0b0b4dbd67ca9f2ef1c01158bee0c3aa2592fbc304375551ecb680f8b539
SSDEEP 12288:GFBAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EBAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A155235F165C30EEFC7AC139887796B853E07CBC530162EF108966BAAA3E489D1F4D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7ba0e7d2aa918b4381c3e113798da675688c95512cce51ac42160e6278105dc1
MD5 05fab430e4322d15f9e723297c1ffd0f
SHA1 52813d661315ccdb0e3bd9f9d75a10f263971f4e
SHA512 fe33de033eec31247c83405dc0f89e84f70d6c1c7c551114ac1b9f1511a5bbd8d096e186ea79d1c81da1ead0f513e702e5db9f7d7f32d33b3e613905a3f12950
SSDEEP 24576:1Q9MxZKdcz97w3cAfYLH8AcevDN0FImbwQuq3Wia7gD:1VKXcAQgAT76sQuE
TLSH
T184558C2DABE9059AE177D23994B250C3A673B4311B31D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 74040b4793607b7ff2854a46aa3457d8f3d03b30870b059c0b1d4ed58546f202
MD5 0e0acd25b5b15a8d7b083f7bdfb82951
SHA1 6b81bc67da66f0dcadc8c1fa8e40f3aeeda64406
SHA512 22fa5bb3550b0c4f9126dbc6007c4954d695a531391edb8d3ce8a7c04af7ca0f1d3ba6df8f8a38783d09cd1442075ef9dc7a98bf137eb8419fe6022d79a97fd8
SSDEEP 24576:EyocxApLAfYLH8AcevDN0FImbwQuq3Wia7gD:5ocxApLAQgAT76sQuE
TLSH
T16165EF1FBB6D40E2E076813C89968255E7B3B0745B5253CB6581833E8E37AE9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b09e8edc14ec11420bca65e97e139e36f8f276b2aa0e0695f4ca8c86870a2c03
MD5 dca3ae12693f0ce63a50e13f7b0d2eaa
SHA1 429f163b23b9fbc35b10020342950bb10f4d27ee
SHA512 48930c8c64c249d2503dac729526c23ee02883ed7e2a4dc7bb9fb86415c03ebf433346ab977142c648265c422fbf8b2089b02861a3dfc9b4c9ca2fbe4180e352
SSDEEP 49152:3WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKLAQgAT76sQuE:v0zuNI8qGsQr
TLSH
T10BA57C3DA2BC00A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c0a64120aaa03aea8093e622ba5d8a8f553de184af2167a976e45b86ab18caf5
MD5 6b4ed972a98ad83e7bb5ade4d0ede7a4
SHA1 ef57346b11a95ad68408e846b13505269c7f2eda
SHA512 754b51ce00991d980982af36919be9aec530a76e2ca30f427e64b1ea7af9fa8d12c8f390a324fbc39b8400a22f23158c55bc9ef9deb0c8d8b90dc244bf460b15
SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYujMqbeAfYLH8AcevDN0FImbwQuq3Wia7gD:pTDxR+N5YzT4jMRAQgAT76sQuE
TLSH
T10F55B02EA7F815E9D1BEC5798A23C512FA727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 724ed43bab3ae23922ef4474a20aba1d20f4faf79f0da917bb656598f36ffe16
MD5 412d3f1db5407e25c744c62e4402e17a
SHA1 8c4bec348405b1e9b68a19ca4a3ec1891b9a519e
SHA512 5b5136d85637944c7a688404ff36fde7c94b0a0ce1d358daa0150929767a6e9a8ba1a8da68f1a795a9debc4780ee5b48f9a26fc664dd414ac223de953146f764
SSDEEP 24576:bTMdOz0FFS+bmSLqAfYLH8AcevDN0FImbwQuq3Wia7gD:J0K+bmSLqAQgAT76sQuE
TLSH
T1E175F13EA36D14E9E47BC17CDA538906E67238750312A6DB0690C1B93F6BEE47979F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 901bb4a7f32438a3d33cdd60c2fd4d3a9bedf8c8bd1bc2509aed7ab8d1afc00f
MD5 d3eaee1b82b74c6f51c9c7f35824b896
SHA1 957978d04bc8b640819113a1d0f3191ec1ab7c32
SHA512 45e33dcf5e9e2c0a269736a1619822d77399bc2349ccc3088e0b05e42c52010db230855275d4f5a4f2bd94086df925824b1599c4ff80ceaac2465711ae83ef48
SSDEEP 12288:647lAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JlAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F155120E13DC30D9F876D2358A77416992B0BC79130166FF24C49ABA6F3A9D8D5B8F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/876-51-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/876-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/876-58-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/876-457-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/936-469-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-471-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-461-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-465-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-466-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-467-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-468-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-479-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-470-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-478-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-473-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-474-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-472-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-462-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-463-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-464-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-459-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-460-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-480-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/936-481-0x0000028831460000-0x0000028831470000-memory.dmp

Download

memory/1172-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1172-458-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1172-70-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1172-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1484-160-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1484-166-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1484-403-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1524-100-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1524-22-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1524-21-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1524-13-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1736-110-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1736-418-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1780-171-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1780-404-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1780-177-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2156-79-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2156-73-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2156-86-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2156-88-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2156-90-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2212-27-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2212-36-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2212-424-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2212-35-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2232-202-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2232-191-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2232-197-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2232-200-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2384-234-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2384-240-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2384-413-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2600-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2600-456-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2600-401-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2600-454-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2728-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2728-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2728-402-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2776-0-0x0000000140000000-0x000000014015C000-memory.dmp

Download

memory/2776-83-0x0000000140000000-0x000000014015C000-memory.dmp

Download

memory/2776-9-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2776-1-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2944-92-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2944-98-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2944-391-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3328-214-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3328-407-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3328-220-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3472-397-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3752-81-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3752-48-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3752-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3752-39-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3752-87-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4040-245-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4040-475-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4040-414-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4040-251-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4040-261-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/4040-293-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/4040-277-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/4068-408-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4068-224-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4068-230-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4104-116-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4104-392-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4104-122-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4532-204-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4532-210-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4532-406-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4728-135-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4728-129-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4728-399-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4988-405-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4988-187-0x0000000000800000-0x0000000000860000-memory.dmp

Download