ac2b2f9de943c226acf7877ef7924fa48947452350d10480c12660c13f6dda17

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Size 3.6MB
Sample260823-elndhaself
SHA256 ac2b2f9de943c226acf7877ef7924fa48947452350d10480c12660c13f6dda17
MD5 9c5a701e15b6581f92fccf267beb6f4d
SHA1 152a96a760f28d8a3eb77ea8cf76d31f97199e2e
SHA512 52d5821c3d59b806d24400a645c12b13d6974fb8060990568c7b71b90fcc6014f2cccca2652c4f9c11f7f4c0c6b8c7b1cff00d57212289a4eb0286f7f970f161
SSDEEP 49152:Ma7bBtysaI+4TiVq5oJVqpLOhg588FPop13kjF6p1nKdpIIUwmL3MnVRrCj4yuGb:1sr8Hmp118XCj4yuMIC4Lm
TLSH
T1BB067B127A5BACBCD15BC874830A4A631A2134DB1B26BFEF41C856353F6ABF45F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1036	alg.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
2140	fxssvc.exe
1796	elevation_service.exe
2860	elevation_service.exe
4236	maintenanceservice.exe
4768	msdtc.exe
2008	OSE.EXE
564	PerceptionSimulationService.exe
1724	perfhost.exe
740	locator.exe
2456	SensorDataService.exe
5064	snmptrap.exe
4756	spectrum.exe
3820	ssh-agent.exe
1632	TieringEngineService.exe
4812	AgentService.exe
2100	vds.exe
1848	vssvc.exe
368	wbengine.exe
3816	WmiApSrv.exe
3092	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3eca7e2f68b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095994b2bb432dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000575e502bb432dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e8cdb2ab432dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa3ccd2ab432dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001113042bb432dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a855642ab432dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039e14e2ab432dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000aa9c2bb432dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeAuditPrivilege	2140	fxssvc.exe
Token: SeRestorePrivilege	1632	TieringEngineService.exe
Token: SeManageVolumePrivilege	1632	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4812	AgentService.exe
Token: SeBackupPrivilege	1848	vssvc.exe
Token: SeRestorePrivilege	1848	vssvc.exe
Token: SeAuditPrivilege	1848	vssvc.exe
Token: SeBackupPrivilege	368	wbengine.exe
Token: SeRestorePrivilege	368	wbengine.exe
Token: SeSecurityPrivilege	368	wbengine.exe
Token: 33	3092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeDebugPrivilege	1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	1748	2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
Token: SeDebugPrivilege	1992	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2708	3092	SearchIndexer.exe	111
PID 3092 wrote to memory of 4660	3092	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_9c5a701e15b6581f92fccf267beb6f4d_akira_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2500

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2860

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1724

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5064

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4756

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3356

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2708
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c8f6d776e0c951d7cbf2d616619d33ea57e6143bee5a210416a990e6dcf66c01
MD5 ca64e27a004f3356dc5d61855238396a
SHA1 d8ccdb0328708159f708a528b5c3c297f09b3933
SHA512 d692423551d04b957bf9bdc240e77a4f66932a5913431dafe225311c99a9214edf6db714e78a9fa07b638b00f44b40932fc3eafaff393d220f184fdc1390e6dc
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnkQ/lFTjN4:03q6HjBsLm
TLSH
T166D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 56086c18f667532ae27d7f27c48474e455b85ad7915a0511c71a269466894fa1
MD5 270de9659af970132be8d4f554a5de9f
SHA1 e255569975a58fa39f2251c58fb66ee264d00b65
SHA512 1769d2b2167a7742ddf991d66d40964bd359b7bf6a02ce29c1e66942e751433618d7315dff1aa7826fb05d7d12f01193e7f964c1fa6459e86315e54cd1b7b01b
SSDEEP 12288:Y1XLsswWkxy2lRq2czAzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:eXYfDtczAjnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1C165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 51b0139a402c5a8f291b069f9f0d74e6cca65afca6fe0f2ca9deca07d8f5e0e1
MD5 60053bfa44400f3d006799d3a98adac3
SHA1 1c762f5b815a32a70d4485ecbb9dd8d94e173efe
SHA512 24eea7f6b515a0aa86576f227195ea5a4844fe713a91dd08965d10ded02eb256899aa0739bc0c4d4d2fabbb60effd6a699d03d52a9652e0a2212a3bf44790abc
SSDEEP 24576:U0Le5ji0hmxLrMcnQ/tbw/2Mkjy6Fr7g0ot:UPji0Al9Q/lFTjN4
TLSH
T15B859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dd6b7064644201e21f6368d181f4ef27723cff3e81f2fe4df460c09dfa7463c7
MD5 af7a838064591efffc55557aa14da03e
SHA1 8f51326b89491676540f839e4b60b602781cb6e9
SHA512 179140507497398336ccd1c50ccc07f8010fa8c50ef71d8f038a19fd9339e9b4b5d967c02badd85bc36549009d310d38948cbc54f298df628b63d47103b58975
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuinQ/tbw/2Mkjy6Fr7g0ox:D/ezSC6vUzPvxHjyJQ/lFTjN4
TLSH
T14A755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4b669a766fcafef3e8113492c09323fd2c299e829a0b6c1ede63169e7a360a00
MD5 0a96364d685b40622be0c5c3221e70fb
SHA1 06da694985994883ad1530ec7215002c913f15de
SHA512 19333afa101abd08f9d02823595b42f1226ebf2ff3ec7bb26583beddab0d422f157dd9c0e466a0414a0a8aafbc367ebd5a3a04303ca084c5ebd4e25d931e46d1
SSDEEP 24576:IVbqPb88hv/l+6XnQ/tbw/2Mkjy6Fr7g0oU:IVO88hXl+IQ/lFTjN4
TLSH
T148559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 56b5e92bb1be066c63fb63b3f69e08a599ef358d010712169afe898eae1bda9d
MD5 268e3757aa8645e3b18b4d23647d8670
SHA1 a22f8b58c0473883c1f2bcca9345ace559167a48
SHA512 041e88b8821e97d4e62cfad6a8466a7a594ab8aad262e2265d55e855412c63d149a04639adeb03b7f374b206fac48d966db1c3926d98d52124330cdd1984ab25
SSDEEP 12288:OzQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:OzwnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1E75523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7356b2b152d769d9830db241dd75ad2d3e2ccdda121013997eb9dff107421ddf
MD5 c84dd1c147d7c9b292372db1cef5ded6
SHA1 d4654271fbdf41c1b752fa72dbb980dca57315c3
SHA512 b2e97b4eb22008945afac3ea4899894e222f9ad9d3f10fd1628b07a1982b1481acf3eb4ae457ef88368515a522789c306626db21e3bd2a3a80eed593fc4becae
SSDEEP 12288:ZeBNUbTVO86UPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:ZJIUvnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1A275CF3BEE28FCD2C67E4DB85A918640D77278704F61A3CBD164820EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3a747da8277f5d1061ad4ee0098967d1541703a959cc8c8dbac079125b78c1d7
MD5 00905bb8d7da648f6e1dddb43d0d160b
SHA1 750b335d4bac56fdd0b9c8ac16037c5b8144113f
SHA512 0160c2cc37a57766825f66ffb47fb55bf977c07804dd104e407d2f55ca2cac0f9596c771ac113f6be4ebb9d0428f8644ec91991cf1f6fb3028583c1fdff9dfe5
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:gQvGAdlCEL8c/yRNw5C9Lm
TLSH
T176267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3d927d32756b122869b3e830d9c00747a58d472513199f60519c1d15e20aedec
MD5 57e9f2a6937fb090f3d8baeb1c028b3a
SHA1 d320d0b963b628827de74916ac9372d87c5e7917
SHA512 081ba74df531b43f29355f5a34e32e3e4fef5144dbc7946c879b443658772136bfed0e4c6d1d217f2598906317c2d2206ab2c1629a2cb718d502b9b68f28cf18
SSDEEP 12288:zAwSfxL/2Dc39DLLmt0LDQewsAjtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgB:sQewsAjNnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T19675E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A88A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 369d7c62af818c8505941d3168998bd55745308129bb7dab6623f869ccb52d76
MD5 e9acb109f2d8eef378373cbdea063b4c
SHA1 8a1659d0610250c1c1cb19e4688d3656b92f92d8
SHA512 a75f9bea0a97aad745e7bf532a1fa2abe7de0352d624619d2944397952398e74c893c2e167b33955b79dbce575a62023d6c39ca1b94501972b7cf263a321584f
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHaL:jUEtQevvqc2W1cpV2EI32
TLSH
T1E5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e79d0c7186b32f9408b19089a64473e67a6eff74384608ae6b003684bfc2c6b5
MD5 b91981ca88ebb06d3f15c4622d6a69c8
SHA1 dc963055a0299a5ffe2e45508accc7cc45ce7fb4
SHA512 a9daf0dbdfeacb4e171058ded4ee337de5b0a13103e6da486e39c0faedafc48f7446bd07c2ceb67d7cdb4174a8dbe33a6013713a89fd28e29f4c203f7de2b166
SSDEEP 49152:oCbRquA/m2yL5zQfFiV+XenmE3/ztQ/lFTjN4:BoqtVjnmpLm
TLSH
T1C9D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d95b76232702a84cfc466facb0cfe57ad75a8ef24c7e79fbe0a46fdda2b7e81a
MD5 0cde83701660c42189787e546a0af916
SHA1 e25727f221efc994ec46d52cce875cc51ac67fbb
SHA512 669bd754a5fbeb0fc7727ab14c6d32533757793a230e1767765a4a19b2758c8194814d6c84a8e2f41498957d0cf84da898e1b4772e8448d51d1e9430820286d1
SSDEEP 24576:TAhGLJIFoiwtA5l7S53unQ/tbw/2Mkjy6Fr7g0o5:TAMyFoiq5eQ/lFTjN4
TLSH
T1BF35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 be06cea717d38fc69c80c8bcf0b513f328edbae08105e11bc18350ade1a059d6
MD5 8763e05a4a1303912e0e192876798ba5
SHA1 a0bea234229c67f80e3c7d53736001665278ef32
SHA512 14a4c285a4cdc6edfb45d069308beef4bf75740f7360eca028d26f1fa8ff44b4190258a71a1913a369fc6714523b9df03ce638bf3f8ef83f7cc34300841dc829
SSDEEP 12288:Amw5HEjsChN2BFgl0WDm+CCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMZ:dwuHOWpnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1F065F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 137a4b138836545964e40881743f97ccc5889c69b307ef68dfcf2d2429397f34
MD5 05e301681cc3dc38870a45c395574b09
SHA1 690db11ec7c0a8a4005c4c311244b82019603072
SHA512 fbca79d8b95d9418fec780a6cc7f60a26410924e5ff15323b6c778b5a0c530d934f8675aa35f7a5652a39e504215f836bf97d32e22d2c48cb3c31fd4b44176a7
SSDEEP 12288:tXZ1Iy9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:dZu0nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T13355126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 21abc4681f9af86e845f6bedbc8e852e90958011e86ef689faa16afe88099d59
MD5 c541fb4ed354efd3da1ac78095a96ce5
SHA1 4eb61abcfb530a14ced2c0c3f81bd297cd862424
SHA512 805c0d184c40fc89bb6ca079f8774a699826ea21b08a1f3ee4dc89b37032a64a1f8a0d8dc918eab32154e449988ff6410f0684b4cc28c65146c54b5906cc8364
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:WQRQyi36YOcPQLvw2gAf+PN3QLm
TLSH
T1DE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e5ae08e6fa530db5cfc6f7b67dd5351a70db844cc350bf57ae1301618d874cf0
MD5 620fff5dda493e528a5c82359dcd05e6
SHA1 b416add489a2f5bdcc0efebddd343677e331efbb
SHA512 040faab98e8b76429c8170cdc2f420ec6ee3a0a5941e72ea57474ffab8170f13f1c84f7ed88fc26508cafecbc2a9066a3e0e56a0802649d9babd2fdee79a1e97
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:EQRQyi36YOcPQLvw2gAf+PN3QLm
TLSH
T1EB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5d67a9a1056da99fc953d958a3a6a2e79a157e0a28c9510ce943bcd0ba7782f9
MD5 7796163dd95ceacab214117f1667d0d6
SHA1 137a11e88e6580562cb35505319bdfa52a92978c
SHA512 a0de6a8bd029d97768833511f0e0289c7fa7fe5483848bfa0e969a673d51090b5ff402bc156274f8bcc6aa0d0021ae6ea9be7706d01205ee01d7bdd847727d7e
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0knQ/tbw/2Mkjy6P:668Qg55nhheWu7PNU3/9Q/lFTjN4
TLSH
T138B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 be71334d0db14c8143cd353c291cfc054029f95bf43df1a8dc31d0d1d91f9da6
MD5 324a118a6e6c80a0e4246d4e48dfaa13
SHA1 3d7b672b2a5f9f9a844ac888863a2d476c535cc4
SHA512 8707f159a4c25fd91fb675bea86739b6a6459fe10971bda1332eaf266fc391d9e17ef18b954e66dc2d8b0a22b5e0f6825c7cd36938c755db9bb0479b85ae5a5f
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:1y5112gYy5azzVvL69nLKnhZDLm
TLSH
T1EF167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fd6675b9e88c31bbfc21ffc73efd61c0125e84342da19821e29ff8914f26d594
MD5 d3fa661aa399ebb263f7e4934e82aec4
SHA1 6aea461647449eafd8ee0905d55fe9d7399231f0
SHA512 4393cc2e4e5ae7e14f2b6a1fa39bca4e425852b9dc6abdb3b542f42897a3b78643ebd9ac91d1a4de85246652b6d3f7c564641e5f9a555cc9c22f3640a99c7901
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTQ/lFTjN4:Hu6JmVxd2d4Lm
TLSH
T138D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3ffeb07d202ee2354b3370739a2063707a16d566529150a6463b5c3623a5fbd9
MD5 73d0c8b6dc56d53e3b631e15a5b74abc
SHA1 be311ba788519fd8a45ebb2f857fa37fb79e9881
SHA512 f103a3322881c48c4acc7f9c47d896303abd061ebffb077f614ca7850547a79118174f61c2f863b818be7a6412ad910d45be2138dc0e9fe92fc3b33074f01e94
SSDEEP 49152:K1hpsNoJpF1A6UU44CwH7R4xPQ/lFTjN4:KmifPbRpLm
TLSH
T181B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6377a6634bf77c0ff10918d576ef753b412208ed1a41e3a45247bf839968b7fa
MD5 7cd094a4535425597f6633b10ea51f60
SHA1 da17bba76b0f50194044c90025b991106687272c
SHA512 9726051c5746dafd73d3490b3dabe616906d419efca0cbd705b5eff800f01135466e5b022b9f318f5b0cd91128ed90f3cb6b612b4cadabddc4d07881a98c7f72
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHq0Q/lFTjN4:T5dKTi61nLm
TLSH
T124C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e4b97dec620458e03f8c04402ffcdb6931b19a322c2c9468ae150e243db3171f
MD5 d8bb013e0f4c5155205ea30748066a8d
SHA1 25371de500e6af66a9bbdb4e0c9b248584ae72f6
SHA512 9975b3b47a25b20a55241f486e70622ed9cc2a2ff55c2f9ce985da38683c2fafaf7796e8e517b8d0850815c6aab9b9c0a5847f6b5c70ce2e6cd1ef2d2c82e36b
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wjQ/lFTjN4:3X2iyphVLm
TLSH
T12D95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 969a983e4ff5320e4ef3151323e1b85fe020c7ee724261c2a7faa6c30f28d2d8
MD5 6a260870b00b92ffeb0f2963fffa63cc
SHA1 8282fcbd994e337ce4c6789e6d265f25a631f9c6
SHA512 441b626e33fd37c4652068dda5e3e895f0ddc7409d83fd5765fd87549be2f4890e1bb0b3aecfbf04f3672dbb4fd42111aca34f2ff5264b2f8d922c76234b5997
SSDEEP 12288:PIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:PInQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1BF5523697954F98BFA1706F18C828182A77F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1acd4eb1e3a743f80b1febcc96f903e2ae49f760f541e39fc791c8258a6e45b9
MD5 fe037bb590894fe0019b8a4f4759b1d7
SHA1 417dc9c26c61c15d433328b4bdc87d98d34754b0
SHA512 a8a91e2ee6bf9a33b9941c2a77c80ebaba03a0a321eb0fc25a7db4c456224378a1843f670fd2444c218aa9f314e7db43c0f9907239c87e104e9a9f105db682f7
SSDEEP 12288:2hGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:2xnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1F85523697965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 791df40fe6954d581841c144c9c31e88795b35d9b86989324292977b2e2973b0
MD5 0d3db6b666f91a27eab9082a88acc019
SHA1 3cfec1ddbb141cdd572c2ef80d13423b12d29bc8
SHA512 22aa0c9ba9fb31b8d83ef756f30e9c7183595430eb0f97cf879a3030fb3245146c34683917c712f701554f9fd9ee7747f894f9815e5d27728bd393310a9b2728
SSDEEP 12288:VnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:VHnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1B55523687965F88BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6199d1733d35016d94e1d2fd6fe5659efa3b46a6b33a04f8c7389bae5425539c
MD5 975bb4de51a53d1e3477a5162cc3dcad
SHA1 ff41afbfdfd302bf438c087da6be132fc02774c8
SHA512 6fe77e47c34634f0b7d8c169d06c3009d6cf37d71623413671be2b26cb4fb9937945649884b8a5b60f368b105e035be517f86069b39d9a14eb78489c251f21b1
SSDEEP 12288:9VOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:GnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1DE5523693A69F4C7F92742B4CC928142E77B3DC6BBB1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1fd75ac7caa8db26ce3c8cb0fa71ebdfa03045e9801539a7ade5b1905324aa23
MD5 d092df9d048636ef5e64f6fb8d03f317
SHA1 18b0eb6f3c3fb17dfe4e767b4459135f886d649f
SHA512 490afd9fdc53b9f2c2c5c2f80931856b5852c35dd0c52233c5da433b63f7ba189b9c023a5fd40d1f7e5c5fb4a6202cef54e818dd6636b6a75c34c5fb3fe15a10
SSDEEP 12288:y2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:yWnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1C45523697965F98BFA1706F14C838182973B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f201eaf83b6868e5e1b4ab3a30e1dbada6ca6daba251219641db9de4cead86af
MD5 f6594e27fbae86b79fa3ea8f2c7f8675
SHA1 3174c80d013ac790d2025d0eeafd5dac8fde8660
SHA512 0b187d8d74f6a0fbb422d1de248d8c32cf4a3e1d3ea2fa2eefe583cb9a599fafdc25e8f625eebe00c7b3369a038973395653c1e28deeb293d1318cda25ac3620
SSDEEP 12288:2lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:2FnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1B25523697965F98BFA2706F14C828182973F0EC7BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c02246c10aff4ad8876a9f9c244486e55e2fb9360ebd074b9ee2edd39e7e6890
MD5 312fd17352e4a9bda10b25726c995118
SHA1 4e77b1c5c6c3a3409d9fbeb7aafc82a7f8e35c82
SHA512 b13eb59207010f4a28493cd1eaac2ec609672bd407907ec019d2578056e6ba8f5430be4b62aa4e1a943f22a43d12a25d601dcbb8920f7ff10a2e057b3954d360
SSDEEP 12288:NJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:NZnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1D95523797965F98BFA2706F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 edf88258e1047f30f099c95df37f6b110af3ca0de7ea39ca8b212e4b1dce6806
MD5 05543059eff1a9b1744e20470c1dea6c
SHA1 e1128a4ffcfe054bf02422265c22d141837a6523
SHA512 0cfd827fed432bd3338714abf282a6757f108236b9be62fe4a277e52cf99113587949e91d2568a4de7845e31d95e6c49712360e0dd666aacf2f64ffbc368d812
SSDEEP 12288:tiZwbDzzFEoS2cPvyBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:wZM3zFVSORnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1387501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 da86d1f3ac45c079dea027b9355a4e7b55da2bfe8318af86811b9cb4938d5b6f
MD5 61aae45184795fc483dc53f75719bcd9
SHA1 e22148314bbf61921afd9f4e202c3eef9322ace1
SHA512 921c42d6c53442edd356f382c373f8838806b5a642eadf33c683c4ac7a5cd1403b926a1d7b2823dbbab55f6ea48536f9d8445c36182ea59c504c6c08e8a1ec2e
SSDEEP 12288:JkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:JEnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1E45523697964F98BFA1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b71a6c385cba75a59d03602e16fcf499cca9143553810104b3baa3a6de971317
MD5 1844b0f7be5aae6346a77a93e1632d4d
SHA1 e5ce0bc060ab550684ca2bbb6b37f1673cad0f7b
SHA512 9cf646be2a2b45ca6160fcaeaba86db1b7636beefa38747b8fa12e7fd8ec6224838e0159ecf602115044c87e9c85b551e6d9f4421f037ffd0479e190f94c0cf1
SSDEEP 12288:8gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:8AnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1FC5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d6b40467e8232f2d5aa40bbd95af5e45d9816868ccb8c7ab743c904ceb223c9e
MD5 717fab34c57897b7beba777fb99fec04
SHA1 e1c95f8581a036eeba69bf04206b602e0504a9f3
SHA512 313ffdd91b084207b62fc5da18feff326dd0f36682ca0200e4e09dc94c84942b6dad6df7db015e47f5403d9c6e300eb12d8f426aec45d008adeb959ea6fa746b
SSDEEP 12288:NyPz5L89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:kzydnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1EF65021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e164c35af94ff2b4d2c4fdf34be01e33abbf0d1ad6c8bdc4ea961ff4bd263c47
MD5 3ce5e78000a0a90d37732265d23ed569
SHA1 abb636dabcbb7cb522f683a5ba8ca62592ca41eb
SHA512 10dd0a11a485c9e05f174d3ab3071caf3a7cdf9261ca5bc555be6c52aa56ed6325c16fc90e79dbffd0b2bcbd63af2d5859e03ace931eeed9e493c4d44fc7e5d8
SSDEEP 12288:akGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:aEnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T19C5523697964F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 babb39305938b9bed880d2a861cb8e6a9984f31243ad31fbcaebc50a394b87aa
MD5 379485e9b77c5d867070986d278e2793
SHA1 0196633913bbe3212016f515c6aff53ee568c5da
SHA512 693af76f995615bfa48dbef362e4a56684e131fc671e279e0d13eaf73f5b7567aa9dd7f25e5fcb9a101ab997a899d44302c67db1e9bffee8fe0f7d62bc9d8c81
SSDEEP 12288:6kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:6EnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T10F5523697964F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 08d192d231f8bff00cc271760a8b86e983622de766679dee38e2d8c8df14dc7a
MD5 ff8af4996da0e9fbb963e0ce32f37b06
SHA1 6deda3d32656634c3db31bd3bfb5af37a5701481
SHA512 f07297014ddabe882228eaccac05504a1abb07b3f45dfedbfd8ffd625c89b06e49d2688c4479b1e5cec1f9d8a83a5c43634626645640310ee63f3daef6a053c7
SSDEEP 12288:HyPz5L89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:qzydnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T18465021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 309b65f1ff8dfd7d699df2082d192cd3985253bf19170fcb9876e0e0adf0121c
MD5 54c60f267c072e58258e7ab80c8c2f80
SHA1 677cea89b05adbf41f54af8bd794e24f0eb33382
SHA512 dbb3ef0c9da77f6389f7b4e9bfbff4bb0895fca7f4d77cb915fe24a5fe9faeb3fc69266d8a0b788d1a4f382af803243756c3bcaa9c68b1cf842e644928cecb1b
SSDEEP 24576:ycP4mcvIjkGOxhKP2l71nNKbrh/8KBMnQ/tbw/2Mkjy6Fr7g0or:9P4m4IpOO67W8KyQ/lFTjN4
TLSH
T17165AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8949d104f89de0397e65b9794938ce35f19b9cf378268912e0e4c2bc9a7788de
MD5 60afc1ae18cf23f0d32af1a3a36041bb
SHA1 f9c78236193613c78ea63098c3c4424740c749c9
SHA512 7c97f684eec1ba20a106889b94a78da6a5f934d76e8f4f2a22efeb274329ff54f50d554f318fd1bed27b42a9a401ce69bdd519e8972957dd2840926f7c68650d
SSDEEP 12288:zssfUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:f0nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T11A65F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ebf7755f594ebd80d84e5fcf3cb9b95b6ce19e93edfb8a886160a36eaad3b198
MD5 459ba0ce8708b5dd5bd56da687ff7d35
SHA1 985b9f6db922e0ee61f0fdbcbf16508d1d38a523
SHA512 257a0963e9e0ae74bc164de3ddd235dc2b71a9a8f0bf7226c7dcc833c7b2e520cfebeac5cb961a6ee96c7054e566f637b2eff13dc7f2dd99030a4c1aca594da4
SSDEEP 12288:80GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:8UnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1445523296768F94BFA3B06B05882C151673F0EC5BF91D38FBB08222D957C3D40EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6bcd596a883f5869bd7411699fcfbb6ededfeaeeef039a03b6f0c6a520944700
MD5 21c6baf38f336d6efbc8774a228f9f2e
SHA1 ead27919becc0356445313d30387bd471b46d019
SHA512 26ae2764f414597217e34df52a4fa8c39cd48708d60eac2410bd6087e1dbd51edb07634961710e7f071c97b71e9a4dde83d1ccf79cd20338b138262f5979ae52
SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQWQ/lFTjN4:oa0hNYG4JwaLm
TLSH
T136859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d0fc9eeda27234d6c4379b1522f27454b7f463425f8d3cc1a2da0689bb3c95dc
MD5 921338a0736661840400d08b07ecb864
SHA1 93e4905fe75c877abf6b0d6f6812568d5749e2e8
SHA512 fd0decae5c7d942f3d9acca4318aa7b5e407ff1fcd8c18cce3b71c09e8a80add9dc1af385204682504d0d41fa18222f6ade17be16fde0fbbbbdab5858565726e
SSDEEP 12288:bhbHjfXRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:bhbHjPhnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T13855027D26AC30DAF63692BD88928546D7327C552B11A3DF2380823D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d43249b45c61762edb11663f31c9c0a1bd4daabc009ad9d779a6bd1ce99c81b6
MD5 25554a926fb0c78976af9e641538aa13
SHA1 92c0f44043eac2f0aaf0f7e3aedeb3abf129a487
SHA512 08e0686430fe47182350732e50dc6f6f365ab9fa45efa48124c577243a8e6f244bc3d1cbed8c16ba6190f8b46cf2987e1389035973057267b9d13dc835806357
SSDEEP 24576:T3YgnJcRTk4yti+R5dBR/pnQ/tbw/2Mkjy6Fr7g0om:TIgnaTk46pBR/pQ/lFTjN4
TLSH
T10D45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9429e9b28864e3bd8a0eb3b441d9558e534862831dd99ad4feaf0eacb7e9f1be
MD5 86d948084b0b4ccfbb7fdbe2d9edb0aa
SHA1 654c726b74daea4fee60bd2a587c4a9550704119
SHA512 da39508bd4882f597854962f284bd80a77aabe0c541a211af5958ab89d4cc47625875add8215dd8a9f55977f096ad5666bec9572e335c8c095085678ccb8e198
SSDEEP 12288:3wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:3QnQ/tbw/2Mkjy6Fr7g0of
TLSH
T16E5523686614F98BFA2B06F54C838546673B0EC17FA193CF7B482129967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 d52170f9e5fb6e95702dcedf4d4b0f7f1107efd17f802b76f1883dbfaee23c0b
MD5 a53c4032674d7273d3742a0b3ae50940
SHA1 ce945c71829dcbbf6f77236076c9d0a987e6322c
SHA512 47e84a78edf2a3e1a17a8125a3fdb87114470c65fabcb509ce9f643f5f246e0c7b965d6f3331c3b2a7d58cac36fc8ac2ac3cfc0de045a28487d0da3017d2dd7d
SSDEEP 12288:sOb4A4LWOsvAYFTzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:RwL3UTjnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1B375F155F7A450F9E92B813CC8A28A16E772789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 188f93cc748201d2f88719691b85f5b91836846e8f665037c62c5132930bec21
MD5 dfc8db7b0db6cd20d001f02c57370235
SHA1 6e0d8dd18644bc092d89b385383a293157a30c40
SHA512 afbdd3847d3488307c0390a6d787fc29d043b290c0410d30d22d19598da4a59ef30db1f29b597c0585f0a4af0a3c757e3c2510b58cd3da8b749df765640d32fc
SSDEEP 12288:tpFtCOvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:2OPnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1F955022D36EC60E6E536527C89838209D37278921B6253DF0780817E5F7BBF85C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fb0477e28414f98642872b1d87e9838d40f80c46649edfe6181cd30324bf954f
MD5 48be988ec1a772ab484eeab1d729a730
SHA1 4f404d35a7e98988d5fc9642ae7f1a8df096d622
SHA512 32ad3068ccb0a3eea18766a391077869a9defb4e34564f793d79185878387af1b1db283d379574d80c2a327686a86f00dc5ef187dc2c0fa6e9f50dda5919f130
SSDEEP 24576:27NM9YqZqmWMUkPjZM48Mv6bEhsEnQ/tbw/2Mkjy6Fr7g0o2:27cBWMpPjN8DbEhBQ/lFTjN4
TLSH
T15F659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 38035d3c799fd3a72e28b5373a3e3f69fa197adaabab5b31c6cf94dc1c9656d8
MD5 95c6e1874057102efba96d60baf35740
SHA1 b850510501cd62ae9a0edd5cbf297d165b566ed5
SHA512 50f221210d5499f6ac4c4204d510f80b47502a33f71d8f49da9ed27b5cab639c0c5d89e5570cdd091d492533970ee7abd1dbb4cc2c23b604afd23f6aecd33232
SSDEEP 24576:MW6BApg2YuyuNDYTabvcdvNYf8km1KnQ/tbw/2Mkjy6Fr7g0oi:MF2YuHNETovAvNYf8kmkQ/lFTjN4
TLSH
T1A6857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 171a91d802e978e00716b371dd2563d75cee59f93226d870297d3ee857160387
MD5 9001e0920a1c5535791d824f55fac43d
SHA1 8d8278b43a944ac2d6f24af042f78645b7e46d78
SHA512 30da376adb5fbe2dbd0008c7a5fb2ce31684b0ba5fc741eca9418c42bb54632b9db583b6550d2341922103e5c2030f63ad24e162c71ff6236244fce492b62d10
SSDEEP 24576:JAFs06+Omlf3NXEbTo7nQ/tbw/2Mkjy6Fr7g0ok:OFs060lVXu2Q/lFTjN4
TLSH
T1A865AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 59205ac494eacf24a4ac10ff5c4e37c369b015891060df6df0f1e06075ae2da7
MD5 69b082ee4ab19df21875651f666b8029
SHA1 a5551812553336f347c3c15fb73f984a65ca3e3b
SHA512 fcad4d2872c3b265d88d741414e12541ec352448bfd72541a36256e7f613f31434b937dd66e672cf82d5b1b15ceb6e2488202d2cb2664ef2c8be4d1233934b40
SSDEEP 12288:lCJnJ5D3VkrqzxEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:cJnJ5D3Wa2nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T15C75D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0762f65c24ad67e6f6e4c86a585005656f2185d3044aca42f574c02c31c67f98
MD5 6b9be406ded8aa0d9e9b11ef12258296
SHA1 15eb93a603b96f724045bd4f1c64222ba0888bac
SHA512 324241e5c4911ea131f26cf4182c3be9409f02da7e83c62f4ba440430b648347ba553540dd715edf25e1858e9ed9ed2bf73fe94d9d867b5dd90a8710d8465a81
SSDEEP 24576:MEPghm6/7IIXdwcXrif7qQncjlP65i3VupnQ/tbw/2Mkjy6Fr7g0oM:Tg06DIKdwc+eQnSt65aVIQ/lFTjN4
TLSH
T147955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 66c2748625f31e1863ba7f59b9c6fd08b14f9b36369cc8810af1af76877fdd27
MD5 d4a89689d58efd4ee337d0d47423862b
SHA1 87b0c92d2445a74b66b7b5c87f40b25da7f71b44
SHA512 d13e83979afabe027485f159adfa2918d1c16ebc8d1a597ee6a7773fc5f117db19342e853a3ccc8ca79a716cd5d278513b83129a726323ed270ed0c7306a2447
SSDEEP 12288:8EP3RSCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:3SCnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T17055126D37ACB0EAE52A517D84918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 e8385d6f8aed5b934cbc16a9fe5363795363ad742122215c15aaadd9972d09d6
MD5 1ea1e7add908233d8ed0cb668db60a4e
SHA1 cc8e39016d5f742a0c8eaece6fc7c77a825b6824
SHA512 aefeafea9d69042fa663d8f3f041b0e559dcb0e5c7f7b80de982c0e20d3be110e0507b4051cc942a15cc9700fcc4b5c4bfef64b23e92aa6cab0f1986f0cbb53c
SSDEEP 12288:ijkyhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:iIyxnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1BB6512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 9c8780e58a3fb065a875dd062c60fdb535363fe986f5147d13174e8762da4870
MD5 3c673094efe5699f551519a37725de1b
SHA1 0528ecc9ba2eb30cffe05d01ca1d333973f584d1
SHA512 1e4032dcafddacb88fe05b460244eff8ec29d89533c55194ff191d76eb25c7f3231b94bfd7f57b80214326f660863c7af79680a4aa995a46b1d3f44a930df3fc
SSDEEP 12288:z0/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:AfnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1BC55236C2665F89BFE2706F448928542973B09C17F9163EF36886239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6ba70bfa3c831a37909d26d1f8dbee833e6065a7fb0807ab2b26e998910c1ef9
MD5 98044b8b1f4712ab1e7730d527fa8017
SHA1 dab52ee6ccbd7df3f7747873ff13d12c7e44b255
SHA512 dbaada1ffd8b90a8a07c4a424def7de0701e20578fef9ff8472a611f9ea6c9633ff07c025aa15e8f5a00e052a2c3095c8d55938b4ad2b767dc9bb80740116cce
SSDEEP 24576:SQ9MxZKdcz9dw38nQ/tbw/2Mkjy6Fr7g0oq:SVKZ8Q/lFTjN4
TLSH
T17C558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 7b62a3c0f44c398c3ab2390bd7af694d94be944702e3a541b382c91b83f47222
MD5 3f53de574bf91e58b6b1d0cb71572f05
SHA1 a9b9a7ea3d9de4e1736a8e1b931b3ddf96e069c6
SHA512 ffc3488826062d2073b0b69a6925832d5c7819092c917966b41a114a4caffd96f50b74070606cccac7d385ecf3926814ef17590591997eae6c859a5b70d20d5f
SSDEEP 12288:3yoKo20Rple9ptGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:3yocSApNnQ/tbw/2Mkjy6Fr7g0od
TLSH
T10765E01FBB6990E2E136813C88818645E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b1f80fbd3edf30453bfbfebb7fd70aa8910950a5d5210cfbdc0b77056ec59fd5
MD5 ffa630fd29e2cb76e3c84fcb8471e5b7
SHA1 20294d61fb41e62693c84b2063970a2d22df6370
SHA512 e3cee6e4ddbafea51b3696848e10ddb21b8919e70c1f541d4153c068f75f51562168a4634febffe502ef13515f85433c044b1790e29a70ce854d5bad323d62d6
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKNQ/lFTjN4:W0zuNIILm
TLSH
T1DAA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a15b91eb244f2147667a13791f99c41f52a7e884c4bc7037e3b5b171f48947f6
MD5 ef9f27ca13e4a2b1fded6e7ebf57a852
SHA1 c28dd024864680942f9f81b68cc8aebc50ac022d
SHA512 5382dacaf571f54adb826f7f76824b1488120ba6f4b55847e8d0cff18ac845abe16b718f6d3cfdc583e63d2af322a1f8d814f675167a5512593c557af444591f
SSDEEP 24576:01QT7EcpfxR+N5AWAz3ooiYtjMqbCnQ/tbw/2Mkjy6Fr7g0oX:JTDxR+N5YzTfjMvQ/lFTjN4
TLSH
T10E55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 af4be4cacdbc08ecfc6b4fc5019a7cda82e772d673252064c537c140f3b64232
MD5 4641501faf17be4100be91ec189a32fc
SHA1 f6832f1bbb4090380f23efe64d946c073c0bf2cf
SHA512 f41e22f83f9aa7e825eca181c67b4b0413f2e73baa7aa38155231be1849d2fc68e75c67e5850a3c6c51bfae1d764b34c76b8a0f4b63eeee6497797205650f3ef
SSDEEP 24576:HTMdOz0FFS+1mSLOnQ/tbw/2Mkjy6Fr7g0ot:10K+1mSLOQ/lFTjN4
TLSH
T19775E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 86e49091d2fc1b8b354424571b59f637bafc3b7bcd0c49cdbceabdcc846d4839
MD5 cae0ebbbd3c7b566aaf4fd308ac8d49b
SHA1 3a59c4b46516185a73ad7f02287de0ec756f4353
SHA512 f5187f069730ca9616e67296156570a91d3925d2d7ab2035b7478ae172f7938b3b4d3cba7b3a70ac0ef0c8b8854a3b2cf51289b5d6abf938755c65257b25999c
SSDEEP 12288:b4TzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:mjnQ/tbw/2Mkjy6Fr7g0os
TLSH
T17B55122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-307-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/564-96-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/564-374-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/564-97-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/564-90-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/740-310-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1036-198-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1036-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1632-302-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1724-101-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/1724-106-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/1724-293-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1748-0-0x0000000140000000-0x00000001403A0000-memory.dmp

Download

memory/1748-1-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1748-9-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1748-85-0x0000000140000000-0x00000001403A0000-memory.dmp

Download

memory/1796-39-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1796-353-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1796-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1796-33-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1848-305-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1992-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1992-25-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1992-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1992-200-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2008-373-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2008-86-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2008-81-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2008-75-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2100-303-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2140-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2140-42-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2456-294-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2456-356-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2860-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2860-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2860-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2860-354-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3092-176-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3092-408-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3092-351-0x000000000C9C0000-0x000000000C9C8000-memory.dmp

Download

memory/3092-309-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3092-160-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3092-193-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3816-308-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3816-407-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3820-301-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3820-128-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/3820-134-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4236-56-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4236-69-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4236-67-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4236-63-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4236-57-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4660-357-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-388-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-397-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-396-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-395-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-394-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-393-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-392-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-391-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-399-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-375-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-376-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-377-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-378-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-379-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-380-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-381-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-382-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-383-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-384-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-385-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-386-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-387-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-398-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-389-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-390-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-363-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-364-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-365-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-366-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-368-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-369-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-372-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-371-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-370-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-367-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-362-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-361-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-360-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-359-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4660-358-0x0000015796EE0000-0x0000015796EF0000-memory.dmp

Download

memory/4756-298-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4756-117-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/4756-123-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/4768-355-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4768-71-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4812-141-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5064-296-0x0000000140000000-0x0000000140141000-memory.dmp

Download