f3cab9c492e032ea7e9be7149a94270b4c76178dfa602d6098fd5b1f2cceb5f9

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
Size 1.3MB
Sample260810-2h1wrazgnc
SHA256 f3cab9c492e032ea7e9be7149a94270b4c76178dfa602d6098fd5b1f2cceb5f9
MD5 4d9fbf046e82df7982726a08775d9975
SHA1 334fe6a9b6d69c8f6d3d7a13d852cf04ee320f86
SHA512 2600d73397396cb9819bf6220b20e15d10ca7a04e0becf185490b211e57c3bc9f6be015118cdcdb5bcd7360db2de838f2bbc9539e4ce6751dee657e0c396341c
SSDEEP 24576:jR6X7yy8BoMXFtB8+AycCnrFlsZJbeWBpc8G:jYGhB1PXwCnrfsZgWBa/
TLSH
T1F155C012E68A90ACD95DC074974796327932B8CE07306AFF22E46B353D66ED26F3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4816	alg.exe
4220	DiagnosticsHub.StandardCollector.Service.exe
5072	fxssvc.exe
3388	elevation_service.exe
4656	elevation_service.exe
4584	maintenanceservice.exe
3136	msdtc.exe
2148	OSE.EXE
3200	PerceptionSimulationService.exe
1264	perfhost.exe
4564	locator.exe
4960	SensorDataService.exe
5032	snmptrap.exe
2172	spectrum.exe
2800	ssh-agent.exe
2156	TieringEngineService.exe
4192	AgentService.exe
4180	vds.exe
5068	vssvc.exe
4972	wbengine.exe
4684	WmiApSrv.exe
1860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c44cc80f77cf242.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034892a9e1829dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000747366a31829dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1bcc09e1829dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e77f89d1829dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080c6069e1829dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000574076a41829dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fb4d49d1829dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
Token: SeAuditPrivilege	5072	fxssvc.exe
Token: SeRestorePrivilege	2156	TieringEngineService.exe
Token: SeManageVolumePrivilege	2156	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4192	AgentService.exe
Token: SeBackupPrivilege	5068	vssvc.exe
Token: SeRestorePrivilege	5068	vssvc.exe
Token: SeAuditPrivilege	5068	vssvc.exe
Token: SeBackupPrivilege	4972	wbengine.exe
Token: SeRestorePrivilege	4972	wbengine.exe
Token: SeSecurityPrivilege	4972	wbengine.exe
Token: 33	1860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe
Token: SeDebugPrivilege	4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
Token: SeDebugPrivilege	4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
Token: SeDebugPrivilege	4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
Token: SeDebugPrivilege	4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
Token: SeDebugPrivilege	4056	2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
Token: SeDebugPrivilege	4816	alg.exe
Token: SeDebugPrivilege	4816	alg.exe
Token: SeDebugPrivilege	4816	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 5036	1860	SearchIndexer.exe	111
PID 1860 wrote to memory of 3372	1860	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_4d9fbf046e82df7982726a08775d9975_akira_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4800

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4656

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4584

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3136

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1264

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4960

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5032

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2172

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4540

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5036
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 de2935ca0a2b2ae4f229027bec5b72422b1a7c013e5b4a5dd5113d2f8f871cda
MD5 a0d511926cd30e2d8d8c8611b9dd102c
SHA1 03bb02ae8835421fbb22c95a3388e4befb2cd223
SHA512 c0197d242ed06c2be51c08512c51265f5f2035f9bca75645aceeb8abdf818772b8287b1ab6d2b74cffca6626d4a1c53fed2ec32c726a92e99a35b7a8d8c21f16
SSDEEP 49152:+b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnuwCnrfsZgWBaN:A3q60jBzrsaN
TLSH
T1D2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bcde766171bbff8c605cb03bd6fe557f598b7afa0ea3c639e4ad6aab040b4846
MD5 e63f34d2e35397b2ac5fa1f9566d830e
SHA1 d7c73f4cc70bebae308449e2dcb9a8e193fd02cb
SHA512 1a478101e4715efa92fadac80d1af5563587d73f76ef897ec055c7859def0d7e26c66997effc0f55ef7931e791c82d019a8f0af9067575f88d7da751fcfaeefd
SSDEEP 12288:q1XLsswWkxy2lRq2czANPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi8:gXYfDtczAN8+AycCnrFlsZJbeWBpc8n
TLSH
T17C65F16977D505F8DD67813CCCA28516EA3378950360EB9B03E4AA2A0F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 03aed11a30ea4bc9905c4d7bfddff3f28a934d743b32cd882769dca8cb1142f7
MD5 9a94c12070320decbc60c88a8697a3ed
SHA1 46e27918c129e3d5f7465f5ff9b43928444229ed
SHA512 128b12b5a1424c34da5f4e8f815202522e0427ee3bde291cd95c5a0efcb4be8c3a51b6244cabfaeac38ce199e431f76e5d728863ae290d325e97180836d68bb9
SSDEEP 24576:C0Le5ji0hmxTrM28+AycCnrFlsZJbeWBpc8Q:CPji0AFhwCnrfsZgWBaV
TLSH
T1DC859E56F5788331D073C0B9C5D2A69EED7130861B308ACB4286D77C6E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dab0c668e62c6a3f430c028f430ef2cfb26e49c4efc6abdea4c010848ac323e3
MD5 803bc147d43bfe4e97ba5283a77b006f
SHA1 878f5fcbd0a1cef57870fe7f66b2f4b83665b4e5
SHA512 2f19cd072e28448b06e10a80aa8ad4ac19e89c9466554ea939760662d9607a0e56d6bf4e356b5894400d7933fe3b3fbea9d0272850e4f30fd443152da9496d6d
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWr6q8wyuQ8+AycCnrFlsZJbeWBpc8g:C/ezSC6vUzPviHjydwCnrfsZgWBat
TLSH
T1AE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9201a52a6995b2a5da0e52bb1eff1f773333af37f2bbd520f73f3acb182ea3d4
MD5 1f4181286ce057f04cd0aedbe893b683
SHA1 2dfc17c9ded3341cd265af65fd07676219487f0c
SHA512 d0e08e1c2ded8d50cc991ab9046d71e9c1dce4f56c7c532617e88b415f548eb8576d4f6e20abb5cfca7f1ae83d052562937a05c2393e713f7ab7d303f319754f
SSDEEP 24576:2VbqPb88hv/l+b58+AycCnrFlsZJbeWBpc8K:2VO88hXl+TwCnrfsZgWBaP
TLSH
T19555AF66F5748331D073C0BAC5D2AA9EEE3234424B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 248455b218ba9b48cd209eb914dd04f787dd229c21182a3abc93787d94348395
MD5 573ce20d78fba60416f84bb8a9b026a1
SHA1 6a1e9cf371f0991271ab7110bacbcee1bb79e1ff
SHA512 46579ae745de5cf6ce350f1349623c59e2c82cf3dec678df03cd3f08cf01435e9eebb7979bfb2acc3832f5cbcf872881d4527b692235e35ab2128e0a50f15cb6
SSDEEP 12288:y4CPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k:y4C8+AycCnrFlsZJbeWBpc8
TLSH
T1FA4523DA688EB1E0C3EB813CB979BC1E3C399DEA05056E6452D0FB6F4431B69D11A307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0f44099db0e96432a5593a88babe8c87209472d6b31f375ed62b01b42d84299b
MD5 b0dded500473699ace1bb1844ac8325e
SHA1 c5fa4c2b3a6e94abd0d7b8496e9c37b3daa8459f
SHA512 cfbe78b2275a5c8100cc6d8213a43f1f1794a78f1fca4d40eb221d3a0860c596595bbc62d7c1131013c06b634a4993442aa6327ad4279daed2f69fc263794128
SSDEEP 12288:YeBNUbTVO86URPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8O:YJIUR8+AycCnrFlsZJbeWBpc8O
TLSH
T17E65CF7BEE28FCE1C27E8D785A918600A77278714B12A7CBD164C30ECE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 82c6e2ae474d6451167497648a1a04f280d542513892bcb838eef431a74ad94a
MD5 3f606fa8c6524f4cb6ec1224bc490944
SHA1 72e34ea4e846c158e24dfedfe80a1805c824c5c5
SHA512 0a046ecb35917f61063ff7a7c64593a8abea34c0d7272f403bf7312ad7a0fdd5220ee46109be99d6dacc3eea24f370cb0c3edfb53ba25b1e4dc5bbef4a9c6e5a
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THW:jQvGAdlCEL8c/RRNw5C8rsaC
TLSH
T166267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7ad154a68d4004171d1c02822db25874052748da65903b8afa3576d5115e0987
MD5 1d1e286821d3f9f0c6e32bde162e02b1
SHA1 8d8048022e8b62f1b5248a990d4bfe7ee0464c02
SHA512 6a693e018500211531fbbc3d5b0bd31e031f97aca81302a0014a20bbd4edce5ceea29e15e9effb43ddbc94f3c7590cb7a1ae424b68642e1a474d8fcabd1c5e57
SSDEEP 12288:OAwSfxL/2Dc35DLLmt0LDQewsAjbPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/u:zMewsAjb8+AycCnrFlsZJbeWBpc8
TLSH
T1FE75E071FE75E032C3BB0DB61B35D71A287D69604B511AC3E3E89E9E49302D26336A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7fab4d898eddefd8441546119f0984aedd5da7bb8c82e78103884408e1338fc5
MD5 d3f54df2fc7b7c58e7c86e9dfa39386f
SHA1 c5c769de29db24dba4f817f7da4a1e21e68a2db8
SHA512 d7cf58b8ae6836cbcefcd35c72ea045e5a15c04f3a408d78d6cbc0e8a4ca7a31a46de422ed54e16429d9f37bbf926dbea95e890fdecaad4e9dbd78f045cc0d70
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHV9:nUEtQevvqc2W1cpV2RI32V9
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 10626225ec284345743b35f0df95321605f69f34704fcf2ba81dc74c963143e6
MD5 615f7b9e7e9863f52c8dd1737f09fd28
SHA1 97972e5543d7d484fa4f0fc3aac8cecba663da70
SHA512 0f2ee2c6c02f55ca9c5c47e955daba0e323ae70f275b8215cdd805a22e43ee2ba79f2330fdf4b0f3328bfd0c4f29b17440b6396c64191d51732baf32a61c887b
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zxwCnrfsZgWBa8:qoquVjnmArsa8
TLSH
T192D58D0976B8C2E4D1F6C37896A2C647F37178154B31ABEF4265461E1E33BE58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d9efad1d4f2598f0ba5d75a695ab9de495ea66167fcf4759669d4ef5b50c9edc
MD5 c314d4300ebf9c04538af18c98073b3d
SHA1 2887ad2e59ff76feb3c042b94f65f9ba76d819d7
SHA512 6a2595425ce4500ba130198e5a8444ffe4fa62077757400c3d404d78e2e7388a1633a5f74abcbf5ec529fe3ac8137c61bde4cc64321c0118181e2e450afda74e
SSDEEP 24576:BAhGL2IFoiwtA5l7S53U8+AycCnrFlsZJbeWBpc8P:BAM1Foiq5EwCnrfsZgWBaa
TLSH
T1A6359D81E7F951D4F5F3AA7899B69571AA76BCAA1E31C20F2150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5167c274e521d70b29c63577c697f1c6bb5e26bbbfa14279a8b232ed338bef5d
MD5 19ead67eb89540d4d7bf5c32d3c47533
SHA1 3e56c049a722149f527c39459a2fef2c8ba48463
SHA512 5b809dc0325b502e13d421acd8e18d2af49536ce93176571868ffbcac61ac296f462d710c9f89ba18f0445d378a3a6c28b8384464b99c116a6774633f8445767
SSDEEP 12288:rmw5HEjsChNoBFgl0WDm+CwPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp41:qwuxOWP8+AycCnrFlsZJbeWBpc8B
TLSH
T18565F18A76D918F8E5A78138C557D536FBB2BC522A21DB1F03A0C65B5F33321AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 786284e3ccc3b7ffaa7af06c9e6a4993d3dd636611681ac29816702e93434ca6
MD5 597f439e65dca3711381916e3ae302ff
SHA1 8cf38cb58112f1f2b6c1cbcdc4d4d9f6c912a755
SHA512 7e4af06b5e53c610ca3cd006cb91c26b85dfdd6def46b38b30f550260ca3063ffb8fe3e8aab4c5e0cceaf19553ed95e4c13ef2c4ed73aed695a376d0fd160cc3
SSDEEP 12288:XlZ1IyrPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kZ:1Zuu8+AycCnrFlsZJbeWBpc8u
TLSH
T15C55129A32D830F4D2A7813CD9F5690AAB7178A6133157CF12A0A76E0F33BD55D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 df0b6bcb667d2f410733d11fe062f7ec1dcfb96bc672bb48c4eb67fce6afacaf
MD5 caef96353192447e5fe22f4098789309
SHA1 db7d838496a53d362a1e990e62f7c5791291c8a2
SHA512 398055f7e64005ed7b08235c23392c4feb9e83e449148964c48f0df13f8c4d095f4786fc86ca539501710c3b223f07f448044e76addc9162713cd43822abf340
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U8:XQRQyi36YOcPhLvw2gAf+PN3Prsa8
TLSH
T19D667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ae681a451ecafdc2fc07dbccd205ee5993cde968e8bb1bad102c675e4e29ad0
MD5 c88b2cfaac82165c9e6cc3aac5bc7c55
SHA1 2033a7e3e860de87c176ab71b54df31214071bcc
SHA512 4de96e3ad001d3e22acbb90a827fa33b76b9545e8f6f4a3519b36a51fbd237b3c25884913b7197d5c12f5d04d13b16073232e08d38c205ca95088e5880fa6800
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UR:EQRQyi36YOcPhLvw2gAf+PN3PrsaR
TLSH
T114667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e688f11359b44244590e7d42b228775d9da4bf46999a3c5c21126ad6bd41e3a2
MD5 5f15734a890e26d9fc7b4ae889101c61
SHA1 c1388a1a6642756aab9130515e4ec09c4d7944ec
SHA512 47326e2b32cd19ffe7f5df686ab25c3db73d830a7bdc86c4f27fc0fe3af9e7c5a36b90b6f27cf1e4dbeac18d0008140adf676644b2e0cfe27a95d069d7a82d2e
SSDEEP 49152:Y68Qg55nhceWu7PNU3/hwCnrfsZgWBa7:ithLRc/Brsa7
TLSH
T177B55A33B2F600A9C04DE1769F4A973196D17C758FE0E7DB8151720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 27084b8c777b225f3e7dd3c7fa6fe0564d1176cef21e04a341786dcc18058180
MD5 cd2f4814fb62f705a575fad0ba6c9d88
SHA1 9a5380eaa4ce0ea406604945aae13c0336923b0f
SHA512 5aa6d16b9c068e9f6a522d199340283cd747c882b785acdb29181f7b25784d8b722a8916b2991f99bfb90ee5d76110cc1b5a228125c5682b1cef36c8e562b3f4
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk990:dy5112gYy5azzVva69nLKnhZirsa6
TLSH
T173167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 39edb2465d1137cea3cd19a18a98333ed0ecaba1286e10456d06e3587899214e
MD5 ecc9bf4559785b67d91c7b1bf83c607b
SHA1 986fb91b8f5d2cd4b4a4822a5da0089a7a151940
SHA512 288492da89349f54aa912b71d9382c16cecdb83de6c9eb09a4fe0a7ea1f7130c628974c4f4266115c2828f1e97c47b3ffaf4c921ace5a61203ac4a0661a0e778
SSDEEP 49152:QB+taZ3usBWOBr4tEG20bqx0z+n217aau1glLwCnrfsZgWBa/:Ku6JmUxd2d3rsa/
TLSH
T1E0D59D13F1DA01E8D06ED078974A9233F962BC490B35B6EF0A9073562A77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b6820338ce41ec603837713aab06051a01dfe645af91747349c3af473c7d31ef
MD5 eb3e4636a85584d52a1e4a41e3398793
SHA1 02cad1fd54556512d1719145e55b3b276755012b
SHA512 ca411e5d6f63bce7fd7276f63de12943fb90b82d95d19513332fc95ede02dbdbb24b0194533820cb6db62dc0168e4971b877b654f5bdfab1ed845754c35dbe87
SSDEEP 49152:G1hpsNoJpF1A6BU44CwH7R4xnwCnrfsZgWBao:GmifPkRArsao
TLSH
T1BDB5BE13F2D901E8D06EC17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 12c338e0d8998ca26237880cafb906f2005d189cce12c6c39c3ebfdad7501c34
MD5 ce4f3822aa03595d8ce5ac098b0ebf4f
SHA1 ac1b44412e5a8fde26de92e159f46c6d4bab2674
SHA512 1ce081322829357c2cc1d3fb45e0f85930018d6affc1430061d80fa6e11bf510a814e2b1e31c966b4549c6d58e17793fe8f3230bdddb792bdb2325a47abe4eba
SSDEEP 49152:iSuZQIY0Be2KNRVtOnks6NMHqewCnrfsZgWBaK:85dKvi61ersaK
TLSH
T16FC5BF03F2E940E8E0BED67887659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 07d06fe43c8758819f635447af32061d713648c29d83bd8d11225934f88dc311
MD5 78721c97859bfc9c9da2398d8df7514b
SHA1 cd7a617ae426021ab31d5680d0e313b357ff6e4c
SHA512 fd7486cd5bb59504c17486469b9ffe70fca3a560da883446e92711310f09a85987f6b75a92c35cc72e6a5bbb11b34fab2882a3384a54a9ae9db6b49bc5aeb5b0
SSDEEP 49152:2htSn8EApI0figXgiDn0AP5w7wCnrfsZgWBac:XX2iyphUrsac
TLSH
T19395BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ddda32e382386dd2a48f444e701a8befdad58a5de517e32b1836dbdf7fcad864
MD5 e8603472c9a17c7f9000b93dd1c36828
SHA1 bb8b5e19c652f66bbc2254d3b862630d17051f0c
SHA512 49fa91fafabd611c1a369a92b5c56ec5103f39a153d7f18cdf63af747a01e1b607b79052f35bce664a35370ce561d6786a9034a58342b5fb2cdd439ae69b8ad6
SSDEEP 12288:W6Ph2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k9:W68+AycCnrFlsZJbeWBpc8q
TLSH
T18C4523DA78CEB2E0C396C13CE974795E3C385DEB12062EA463D4F62F4631B69910D70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4b3167c2e7d0bbc7d4bfd28d8498810956712fdf59b7ccbe8fcb026a875ebd74
MD5 b6f707916f3ec5c9b40cea887fa4d46a
SHA1 6e90ae700ab07d0ffae05ae40e9905626e0bfbfa
SHA512 71ad881f166170b08c49feab9b4f725ceb3ed73c8290480ab3078d7423a80d204adffef168d52eec8f05f338428ed9cd217c378bec15a614f06cc14fd979d28b
SSDEEP 12288:VXPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k2:VX8+AycCnrFlsZJbeWBpc8N
TLSH
T14E4523DA78CE72E0C396C13CE974B95E3C385DEB16022EA463D4F62F4631B69910D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fa3776472800ae89bbb5a7adc1c07f1f80dfe70efb354b18951cf7bd6176abd8
MD5 82ac07c8ac5818b69f503fface6628da
SHA1 f75a1cd51bb0f14d67895ae91630c898ba723b7b
SHA512 c6249ccf9ecc9c0c814d85ac2bd9f0fa0d9ff231311f543c5be546fcbcb929a775d983a0695fb84746236f34efe969acf3736a28a3c933c4e91ea809d3c59988
SSDEEP 12288:apPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k2:ap8+AycCnrFlsZJbeWBpc8N
TLSH
T1BF4523DA78CEB2E0C396C13CE975795E3C385DEB16022EA463D4F62F4631B69910D70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 609b7c5f7195ff421756274ae2cde14d5b32a274bd4f0b4a4fc884433a8a546f
MD5 4037990d2bc35f84dafff9ffc81cc31a
SHA1 c1ac58b64db5bf6dc44486c7f8d76c570c8980e5
SHA512 a485e4552dc1146b061c4c1c5ece88c58f5ea93ac38a794b47360764a3b6c5c24966cc2df07fe9632d76dcff738c2be5e6420d610c84aa245de74ed5974fac65
SSDEEP 12288:dV0Ph2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kG:M8+AycCnrFlsZJbeWBpc8d
TLSH
T1904523DA398E71D0C2A6C13CD975B91E7C757CEA03226FAF53807A6F0E317949128B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0e5fec62f49d5ac05a827fee49d03af1d1d0deb85b678cadd1196650f40ef421
MD5 dfd36e04af0522371d6ef543836f2b46
SHA1 ad98e99377a3270b2a7c535f4eea0d4ade0267f8
SHA512 ddf5907a3baedfae67b04023ee3b92718683681e2e29d2a8f4e53d78b7f5da715814c5b9bcace503ad3abdb26addff4992bf6b19561ebf95f9b6d0786e1ccb5f
SSDEEP 12288:N8Ph2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kt:N88+AycCnrFlsZJbeWBpc8u
TLSH
T1664523DA78CEB2E0C396C13CE975795E3C385DEB12022EA463D4F62F4631B69910D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 145d7907bf46fe291e33ac8212a60b4b8859ada82c757590569f205b004357af
MD5 99f19535ada0b759bf04f033cb97d17c
SHA1 32bdd481ae80446988e9451cd89f5cc4deb7040c
SHA512 2f60e82f632d185c9a6a18e040ac0cbf1d9eeeae95bc70e98cd9017c693c18cb0de70fcf4b1006b6f8aca8c28c830bd6172aeab5def408e9e7e2e770aabe974c
SSDEEP 12288:nzPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k2:nz8+AycCnrFlsZJbeWBpc85
TLSH
T1F24523DA78CE72E0C396C13CE974B95E3C385DEB16022EA463D4F62F4631B69910D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 13b033a040c697219f77abd6c28641ef5abe41f0e54e516610431b075abb7832
MD5 a4618d3e0804a21d6923fe865a311745
SHA1 c8e580ca0b0c8b4410893b665f259abd2e3e7d50
SHA512 f234b50afe1ca0e9ae8b53f3e2fee162ccafe3c6d1b02af7ca3cff0985feb33d7bea43ba5bfafac3b9705500a103572ca41faab3e3588a90a7794cf36bb37920
SSDEEP 12288:w/Ph2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5ki:w/8+AycCnrFlsZJbeWBpc81
TLSH
T1834523DA788E72E0C396C13CE974B95E3C385DEB06062EA463D4F62F4631B69910D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 542e162a2d72d307bac70d1973320216cf3b9b5726b0310133539452bc6d1892
MD5 a58603be7d641cfaa1177afb62ccd73b
SHA1 51cbd9bdeeed8836c4b025856cdb7f0cd607df5d
SHA512 ec6d036bafddc430e05a1b0a11c57ec8de7c62ee724ab9c58fca9f0760e1e92175a549bc2bc7548ac99deb4fbe957d60105076cc06e9a2d6c82a63172d23a6b1
SSDEEP 12288:ZiZwbqzzFEoS2cPvy3Ph2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dN:cZMCzFVSO38+AycCnrFlsZJbeWBpc8N
TLSH
T179650295B39418F4DDA7813ECD25990AE5B27C6A0760CA1F13E4366B4F333A11C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9cfa203ad5d137baa35aedd0226c58c4cc80d9f45908624ccb457f7d05fb04d1
MD5 7c7e1fa6be75554a7bf5ea10bc254cca
SHA1 65386e1dd28925f56fa9dbd02517777906511f50
SHA512 60154a33e1ebd4f6ed41d1ec6814733271215e9a30fe57f50a91b4a139cc0a3b96787ffb71558c2d6ccfc4b6385a6ade1542eadabeb32795126556dea9ff2f5d
SSDEEP 12288:L+Ph2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kd:L+8+AycCnrFlsZJbeWBpc8u
TLSH
T1D44523DA788E72E0C396C13CE975B95E3C385DEF12022EA463D4F62F4631B69910D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b27552a4686a88ee8076166c406911f352687043cb348604a67bdb8601da0d63
MD5 9d51e75c2d9c41e46a247578e5927245
SHA1 eda8aea712be8f24465fab8f82cd74c61ef7448a
SHA512 d20262cdf3800ea18617acda70a4de1e29994b7d56bc409742c208b94932416c356780fa43305e6684b078abba973182049e10f71e71d875fd54255f9b07ac34
SSDEEP 12288:LSPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kS:LS8+AycCnrFlsZJbeWBpc8l
TLSH
T10D4523DA78CE72E0C396C13CE974B95E3C385EEB15022EA463D4F62F4631B69910D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 799692bceae70ee68563a82d8fd20509cd9af26aff1a14392e04009b1d85a4f1
MD5 b3a3c4be19e064c5715431322962b176
SHA1 c195722d4d9eb77eb232722ce3103adcd9de1ff2
SHA512 38aa86ed4c371cc597d06f87cd425c44ed6bd783b0f891cb1fdbbab5a2b85dab52281d758148ac4b1831ee746f08356f1bcca66f99a5293f5b2818c2c8b83efc
SSDEEP 12288:myPz5L8rPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kS:bzyr8+AycCnrFlsZJbeWBpc8l
TLSH
T1BC550257769930F8D1778238C9612A06BB75B87607209EAF13A0577B0F337A19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 461971c3a4de97f1427411ef048b2ba36c73aceee7d2bf40002809989226e0ec
MD5 dc59ec30caf4a66ea662b6ab2625e93f
SHA1 39d3d4bf1358dc61b682a395e1c8c8561432f66d
SHA512 acd76a3d61e20798447e8ef3650c3d2e438f76320549f84328401d4ff3a2b9ff48769d55735310383433a194e0701f1e0e16d522ca094ed25a3482e36121e4aa
SSDEEP 12288:2+Ph2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k6:2+8+AycCnrFlsZJbeWBpc8t
TLSH
T1C14523DA78CE72E0C396C13CE974B95E3C385DEF12022EA463D4F62E4631B69910D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8add6cbc2010cbf77a118a9853f57f65574e2baa7a4fa23c48a9cc53ce713d9a
MD5 d5da02df843b08696122e04bb835420c
SHA1 2db79f9b4571b07962e3389982ec7835b965664d
SHA512 d5c84051e0b3371bdf007977de02a2bbca672edc73baddff27e149096b303149a8b520e6dfda0786612e1d2f74754c18d56a6a45e2050c9bfcc974e0f4d338d3
SSDEEP 12288:r+Ph2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kh:r+8+AycCnrFlsZJbeWBpc8i
TLSH
T1EB4523DA788E72E0C396C13CE974B95E3C385DEF12062EA463D4F62F4631B69910D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6acfad5fef7e30fca108c15fc7fc2abd6f269b2cd0588224b59ccf9c887eb8bf
MD5 7a0e4d41a80c877e85797efdbbebc5a7
SHA1 a64fdc33f25d37f9511a60d3530da979e976eef8
SHA512 28981052a6585f363e2102270c98205d20b6f6273cd1b715f3131d6f92fff454f44eb49db40b47d3b2374e2e87f5c40e4d122a77c02fca17af4506ecb10351b8
SSDEEP 12288:7yPz5L8rPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kR:2zyr8+AycCnrFlsZJbeWBpc8a
TLSH
T1DE550257769930F8D1778238C9612A06BB75B87607209EAF13A0577B0F337A19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2d5d615e8b83a312cfdcc3b05f7166f1e023078177ed62306c92fe57efb38ba8
MD5 5724ea2fc0aa409a2e8f549a2a8601c8
SHA1 4fb06ae3cd2a4867f9df4e40c942410b6b08a0df
SHA512 e6dfe2f89a3c4ba663d37e407b0343eb18fde315203555f3331588318ae7d9228a5b06b751b99d8539b59990c55f87ab7d8e4769222b0722ef30db0a092b15a1
SSDEEP 24576:pcP4mcvIjkGOxhKP2l71SNKbrh/8KBm8+AycCnrFlsZJbeWBpc8Q:eP4m4IpOO67N8KIwCnrfsZgWBad
TLSH
T1D565AE2DABDC0096D0BB913885658A4AFAB1742E1F3286CB1160933D6F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c3690d577a9086b1a09269911eeb0e93240dadd06f67dfcb9b8cadcb0f0ba029
MD5 220a165ab9a05cff3cd429eb11f039fa
SHA1 2f448fc304a46f3c62c9efa6cac1d1440b47cb07
SHA512 40fded96d79a8ea43467d0c73288bef24bb50f0f31b810e3ff363589678b93d0a5111bca07a9a4a5b66a2f0761b818a58950b68193650268bde45b02909b2165
SSDEEP 12288:Y8sfuPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kb:Ou8+AycCnrFlsZJbeWBpc88
TLSH
T13F55015AE28812E4C1AE9139CB655A45B7337C6643E1D7CB53D0F53E0F326909DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 941fad34d2d0838ec20200fc5c724866f257d6ce1b654324fa183974f9e7f220
MD5 632a35a38e47d1c33db47efcf85e96a3
SHA1 483f5d5d81adb633623053ee9283c78822f5508d
SHA512 bd2af92caccf33655e93ac33dc31b76657025386df6c023b2a86277f23eca599a2026560fcd55d77d51e28b391e51831c68b2d524b6709c0e35809a7f2055dc3
SSDEEP 12288:wOPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k:wO8+AycCnrFlsZJbeWBpc8
TLSH
T12E4523DBA4CD7190D2F6C13CA935B82E3C3D79FA0B019D96A280B76E4530F65D52970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ee1dd47437b2792edb133158925b14a38f31617067cdd3cd953286a50170ea18
MD5 848c98bb8c7ade5f111cb8d492bb4515
SHA1 e9655864c0408d514bf0c5ce6b3b150abe6a7264
SHA512 fb4393af410460c76a1afaec2c21c887918857ffc85c3463f4e0cdb1e7916b93d34f1e06e51985e9aa43292bbaba87b426eec542a378844a71c6feb76ea99547
SSDEEP 49152:na0h2GEkuAe73q3pp46zwwQswCnrfsZgWBab:na0hNYG4Jwprsab
TLSH
T1FB85AF1E67DC82B5D0BAD278C9A6854BE6B2B4260B3156CF1190853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 70575dbce8931e796c5aac2f5d77cfb2b4abec222321d8a849801d4858370384
MD5 951c09a54cda939010e4844b541b642b
SHA1 2e0384e61f097ad471d098dd6159abc1d5d834c5
SHA512 2a1659d853721faee8d4c5d2cf3431bc996a6ed0cc8124adfc68c840e8a82f2ceb360f0f40382957599d8bc2d995f570a21cefc55e866b7ba6b86c91818108ff
SSDEEP 12288:LhbHjfXHPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k+:LhbHjPH8+AycCnrFlsZJbeWBpc8d
TLSH
T1455512BE269C30D4E2B2D17C9561950AEA31BC660711A7EF23D0927E4F37EE45C39B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c12b16df6c72e6d2dfc0085a9c86cd427ea51abce892bb51cfea161844167c99
MD5 4bb2614a3f4f5c1cac03d3ad4e90840b
SHA1 af0886b908be3eb9d7fae46058ca40c87b85d066
SHA512 4d3543b3710e426e5679807a4c6ae0f77960c175eb8675d45038f7ff3509522a9cf47c8492832038eaaf68071bb77c6c4b8dc7537c9c3a1e633c264f3fbdd46e
SSDEEP 24576:T3YgnJcRTk4yti+R5dpR/P8+AycCnrFlsZJbeWBpc8p:TIgnaTk46ppR/9wCnrfsZgWBaM
TLSH
T15D45BF2EF2B910B9D4A6D136450147B5BB71782D1F209ACB0170C638AF16EE89F39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5c3469d90f41aa108648c10f5d3c9e09a60917523fced1c9361c13e1d7339d84
MD5 4751894bb52cc0d69135267453c2ba8f
SHA1 6eb5b29bf4d29431608fe06e054515b990d5819e
SHA512 2a46a33f2b5b9769ce6473c14b25c9cc8ff72871bbf99e50c9290bd293528722233a46b5a1a44f3f324938c9b087390d798f8b6a2984701eb7ddedfef136efa9
SSDEEP 12288:XiPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5ks:Xi8+AycCnrFlsZJbeWBpc8L
TLSH
T1C64523DA748E71D0C396C13CA975B91E3C345AEA03022EE762D4F66F4631FEA9139706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 a1a58b0a7b7863af8b7cdc6762a98fc0e1cba3da35afa8bcc9b83480addd284c
MD5 d6b6594721954c1f626cfd41df3f03ae
SHA1 2b6602e41a894ad3fc4ba3b8a79af2f370bcaab4
SHA512 2b9053cd2533683fc7882a44a94103ef0fffc0ff10bc55fb1e3e636c40785d5ce490e557e624cb88f24d4dab7ede5f0e28bab54099767d54271d68b62df3d336
SSDEEP 12288:oObZA4LWOsvAYFTNPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpZ:FtL3UTN8+AycCnrFlsZJbeWBpc8R
TLSH
T13C750155F69910F4E96BC13CC9729916E672789D0324EBDF03A88B6A0F237E14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 33ef2e70d82852eeeca1e47e0d1f3b7b8e67c38239add1d3619aff55ce6d1be9
MD5 aee1a3b84b2ac5918cb6e05f1beb3937
SHA1 832b565c2d391ee04a9ed343ff7829a02e88da53
SHA512 96d50ae6ee5e22cfc08b25cd519dc1454f25a8aadd7a5129722adee195b56bbd95ad74822e98ff2df87095c62125e3d2f1c2fe15b2de29b4d4a31e146ec0a186
SSDEEP 12288:jpFteOxPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kj:AOx8+AycCnrFlsZJbeWBpc8A
TLSH
T14D55025A36DD20E0D176913C9992960DE771B8A607125BEF02D0917E4F73FF8AC3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a1634184727716ba6a919b3df1bd508575998b9cf2b89eba66cdde97db603069
MD5 6886b98b3a118f013fd23dea1bce87d7
SHA1 0f1e165007f576f7ca03903971c9f8eb11353518
SHA512 eaf4ed92629eb6893dc234b5da4c9a24b466fbe179b8d008a48d98f9f36471c9ba827346a064d1a49bfd069ac5812e1f974947a04a88597820a6fa9e22a0568b
SSDEEP 24576:U7NM9YmZqmWMUkPjZM48Mv6bEhs+8+AycCnrFlsZJbeWBpc8l:U7cBWMpPjN8DbEhFwCnrfsZgWBas
TLSH
T1CD65AE6E6BEC81E5D577C13DC9A28206F6B1B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b07a2bcac12eae45f67650e4bf12224d87728cb4826faea944d85f373d969521
MD5 69128ef1786c306a41ae2d2e040b2a58
SHA1 bf1e13b4e73ef9914ae64019205162746180db66
SHA512 eff7a40d38752a84521f398f9945c708c18421f832facfb5da189721907a09665e63f83c9ddfa6b8fdd744da5b73598bfe7d00663a6df5b3b6d4a716daa755e0
SSDEEP 49152:RF2YuHNETovcvNYf8kmuwCnrfsZgWBae:U6tCf8kLrsae
TLSH
T100858E6A27ED80A4E0BBD27D45B7D246F9B2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8bb24f5f58afd49699584586f0200e5fba2ae5bc383cc7b63dc2f219e41ea2a7
MD5 4d6ff4d1482e55a8b87008447b8cf1ad
SHA1 a1317c4b0c2ee1aa6680b46531a64d0522fdba06
SHA512 906ebabb235abf7867a3acbf9f3146011b4ba35fc8859d6082fb04158d2bbcf148646e28e38d076328a63eadc9c466b7d1a951a0ebacde14a7fbd99815a3c53d
SSDEEP 24576:SAFs06+OmlfQNXEbToF8+AycCnrFlsZJbeWBpc8N:LFs060lcXuMwCnrfsZgWBaM
TLSH
T1EE65AF2F62EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 1723aec4cd6f98cd3d1cadd8522b4aecb9bfcafba009366d4cf9fdd8678f1261
MD5 86d2b6d41b542d951d78b61f18f19548
SHA1 7ceb3ac7de70b0d2605589c2888ce7b1536b8a18
SHA512 35eb904da2b7bdada3fcd88be22a0c1ea5928ce2b7e45b066ae068f732c211131220d8985abf21be63e53b28bcfd0db11f1c03954b6b0c69e6aae953beb4e6c4
SSDEEP 12288:3CJnJ5D3VkrDzxePh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzD:SJnJ5D3WXc8+AycCnrFlsZJbeWBpc8H
TLSH
T14675D02DD2A820E4D4B7C278815A2B56BE72387D2F226EC724B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 44d29fee1faea4caed9d8e52f734f93198683bbde3860386615692e965b771f5
MD5 5467131272aa23353bd15e2d0bd6aa10
SHA1 21fea76661a82e1650268a027870d94640227f74
SHA512 bcbad26d0c66140db97912397c5bf659610febb0de7f8baa6a8539fcf1019aa36cbfbb49587d6033ced25e7dd475859daa57294e41a607afa2b8184ee485a4d1
SSDEEP 49152:xo06DIKdwc+eQnSt65aVywCnrfsZgWBa3:mErsa3
TLSH
T1D8956C16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d8c576d92fda9bd1a33a7b47159333374f5523eba5ebf8b2ca7e33d003eb97d3
MD5 bd0e525374438c5baf9ef67d77dd2698
SHA1 2078a674f5db4fe48f6c820991e4c9d205d28d0d
SHA512 c517165856ed92ebc1f1d4fb51c7b3afb557f92a57cc20e866fdc4ce7429c7386d2ae4f687062352af40a2c226badc3e4b96f7158152c0b5de7ba85b78bccf15
SSDEEP 12288:TEP3RlwPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kU:Ylw8+AycCnrFlsZJbeWBpc8P
TLSH
T1225512AE3A9D70E4D266D03C95A18509E772F4B517122BEF12D0D23E4E33AE96D3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 d64765677b5013fa3e34b4f3f3f1c42aa909b86ed6cc3918fd1e67c44f56bf43
MD5 daf70037ae774fd35f5be9872ec236f0
SHA1 ac3f325c1b2f39226faea08f0ed22c2182f6d36d
SHA512 c84145de521b88ff3d2daee825e9e0753a016181dbc558607d3398a5eba37243837001bfa50b3bab0a840bbbfedcabd709bb24225d0e2b8847f6dd1c133b9006
SSDEEP 12288:SjkyXPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5kC:SIyX8+AycCnrFlsZJbeWBpc8t
TLSH
T118551289628C70D0D2B6823CD97295996D35BC711B116BEF61D0F73F4E32BE4A838B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 143d1ddc1f5f3e6b9ae4814e3cb5a59f8dcd7c2ed0ec501b1811060bdc4c33aa
MD5 2d28032c0cf933c5312191dc65d07d19
SHA1 67d61d3dff76bd6f50e7d39e4f89cc875d016939
SHA512 a3b07fab53655c1ef1b97004b467585b05e2a4b802f942f89a8795b756dc0de3f7252384eb6300e01da933ce9fefb82585b4713d98321a8f9ef9bd80da3d9ccd
SSDEEP 12288:GaBPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k5:bB8+AycCnrFlsZJbeWBpc8a
TLSH
T1674523DE248E71E0D296C13CA9357D5E2C3479BA07052EFB22D0F67E8A31BD59139B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 56924100bd3ee6fd2926364167df74433ddefc46d6ec9878d4252d5efe0622bc
MD5 9ea5e23123ca10e34d113a8d04d21270
SHA1 8fd6be508cace4c2d8a6f04c4cee9f75ace4ba26
SHA512 cc36f01b784da8d9f285a83e58a9dcf281e2fdfc89acc74bdee1fa795c82466e12ce2864c14185c0b0d49c0988af99248720442fe0f3e4c8a16b30ad071942f9
SSDEEP 24576:eQ9MxZKdcz97w3W8+AycCnrFlsZJbeWBpc8s:eVKX2wCnrfsZgWBaJ
TLSH
T1D9558D2DABE91599E177D239D5A250C3A633B4311B31D6CF2448D03D4D7BEE8AA38F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9d4ad2f52eb56f7e9684e6acbe619d0d56fbe9bcc375e29470583f27046b8c85
MD5 04de383d852f416faf7daeff00ee7370
SHA1 82b7fc167cce12a0bdec931c446fba182c88083c
SHA512 40c8dc41f9fa97e8d97e07e262d3bb1b9b07f44a45aeb79c5307fbafb7ae1adeca39c586353740e96f25a4fc84dcc3d76514a7dab91705dd9af3ecde9db89eed
SSDEEP 12288:7yoKo29Rple9pbPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzAp:7yocfApb8+AycCnrFlsZJbeWBpc8c
TLSH
T18F65E05FBBAE40E1D176813C89858649EB73B0751B1257DB5291C33E4E33AE9BD38B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9809c5e06bd8abe4b72328cde5180e4baba26e89ad0ebdfa56f2f1821382bb0a
MD5 5712fd1af8fc443802793b6d3efedac0
SHA1 aa2b550feb38ace1d329ab4917a392a030695f6d
SHA512 a559444a18ff94b4bff2ac1f50031be5de3997dbee431bce961f6425c1d55c950f828d5eb6bb09e1db3c357646f6d9dad33e221b5c935a3667c093af7edff673
SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKRwCnrfsZgWBar:30zuNIlrsar
TLSH
T1E9A57B3DA2AC00A8D9AAC379C5451366EE71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c16d0772caae1c3e65612f743ee2684ec05acbbb97f192f25f87352c3c2cf816
MD5 cde6e41eed6da8a71bb031b152de3fed
SHA1 bc06f0ee9237285a6bb7be70866b3aabfc5d60b3
SHA512 431d65328fe8d4858d6b8a66344f2391619083f3fccc6bde9cb800bb48d4dd5d0062bb0c45c8d04dff1218e7692ebb99432811659d0f993a41a10d452c07d26d
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYsjMqbw8+AycCnrFlsZJbeWBpc8I:OTDxR+N5YzTujMHwCnrfsZgWBaZ
TLSH
T1EF55B02EA7F815E9D1BEC5789A23C516FA727861033193CB42A0C17E0E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 e4062bcea50a8b38dcea5c44b670b43db6eb04f33bbb86d5a55121fb6426d234
MD5 678bd4084cec98ea614509a0ae41fadd
SHA1 cfb574b028fea51efe8003246dcb4bb2217a9dd6
SHA512 54186e66411a91880960ea4de3b6e856b15f38ab90c658f7fa054cdeec6bc123987fedc15be1ffa7cfe66ceaf8cee223ff9e00d7fc9b11e04729d4be151888c2
SSDEEP 24576:uTMdOz0FFS+jmSL08+AycCnrFlsZJbeWBpc8d:a0K+jmSLUwCnrfsZgWBaI
TLSH
T15365E17EA39D14E4E57BC17CDA53990AE972346203226ADB06D0C17A2F67FE4793DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 17dcf36e2a932c43190812df63818ec225ee7210f6cb911c93c7729f79fc3867
MD5 6d54d83082c3e9735558ceb14dfef075
SHA1 d5c3e4280c18945aafb8d3cd078dc67a9547009e
SHA512 8d9d20d16bf56e448b17286d139e516341edc801f32f8663d54ffb0140cf34f57a2922453c488312edbc8b90e60b1bf73aff33db5abc76094c69016265a88365
SSDEEP 12288:449NPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/Fl/3sFp4Emi0dJpzA8j5k3:hN8+AycCnrFlsZJbeWBpc8M
TLSH
T13055129E26DD30E0E1B2C138DA36551A6930BCB613156AFF32D0E67E4F32BD49539B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-375-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1860-397-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1860-257-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1860-476-0x000000000D240000-0x000000000D95D000-memory.dmp

Download

memory/1860-291-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1860-473-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1860-273-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1860-247-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1860-241-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2148-372-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2148-100-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2148-106-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2156-183-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2156-386-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2156-177-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2172-162-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2172-156-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2172-379-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2800-167-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2800-173-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2800-380-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3136-89-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3136-95-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3136-398-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/3200-116-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3200-110-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3200-374-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3372-462-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-467-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-469-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-464-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-461-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-470-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-468-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-466-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-457-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-463-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-465-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-458-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-459-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-460-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-455-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3372-456-0x00000199DF4A0000-0x00000199DF4B0000-memory.dmp

Download

memory/3388-471-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3388-52-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3388-61-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3388-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4056-0-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4056-9-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4056-1-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4056-72-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4180-388-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4180-206-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4180-200-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4192-198-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4192-187-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4192-196-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4192-193-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4220-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4220-34-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4220-35-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4220-451-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4564-125-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4564-376-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/4564-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4584-85-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4584-87-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4584-75-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4584-81-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4656-472-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4656-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4656-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4656-371-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4684-396-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4684-230-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4684-236-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4816-437-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4816-19-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4816-21-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4816-13-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-454-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4960-452-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4960-377-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4960-141-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4960-135-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4972-226-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4972-390-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5032-152-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5032-146-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5032-378-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/5068-210-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5068-389-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5068-216-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5072-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5072-40-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5072-47-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5072-49-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5072-58-0x0000000140000000-0x0000000140135000-memory.dmp

Download