362d84bb6494b1b24d3e24f71c0606aba0abed699c4124550e310a0e22f3bf16

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/09/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Size 18.3MB
Sample260923-xmlkeaab62
SHA256 362d84bb6494b1b24d3e24f71c0606aba0abed699c4124550e310a0e22f3bf16
MD5 af4002584bbcfa4097ac49236f31d4ca
SHA1 8048dd175ce89301af40dd764e452bb8be7204d8
SHA512 5dbb7edbd1a2a0c10c220ac0059481bd4488bab63813137acbd6d6e613d2c8f3862b4c132c1ab654253b5a1b7e7151a131af3982c46ae2fa1b7c4bbd3b0196d1
SSDEEP 196608:fn3ppTcLbxEtAkNMHe8//aZq+TPJDVQBWG:fP4I/N+ec/aZqIP0B
TLSH
T1E21729157A6B98ACC59BC87083478A734E2130DF0A36BDBF44C456393F79BF46B29258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1868	alg.exe
5068	DiagnosticsHub.StandardCollector.Service.exe
5024	fxssvc.exe
2552	elevation_service.exe
4864	elevation_service.exe
1028	maintenanceservice.exe
208	msdtc.exe
3912	OSE.EXE
2720	PerceptionSimulationService.exe
4580	perfhost.exe
4116	locator.exe
4756	SensorDataService.exe
3384	snmptrap.exe
1836	spectrum.exe
3736	ssh-agent.exe
436	TieringEngineService.exe
3496	AgentService.exe
1572	vds.exe
4740	vssvc.exe
3804	wbengine.exe
4668	WmiApSrv.exe
228	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1b2545769b11239b.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-sl.hyb	msedgewebview2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-uk.hyb	msedgewebview2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-eu.hyb	msedgewebview2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-ml.hyb	msedgewebview2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\manifest.json	msedgewebview2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed1bcb938d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4e01d9d8d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b830fb938d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000855447948d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0cd0a9d8d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000817124948d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346635328172573"	msedgewebview2.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071e1b0938d4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000641caa928d4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
5740	msedgewebview2.exe
5740	msedgewebview2.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3344	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeAuditPrivilege	5024	fxssvc.exe
Token: SeRestorePrivilege	436	TieringEngineService.exe
Token: SeManageVolumePrivilege	436	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3496	AgentService.exe
Token: SeBackupPrivilege	4740	vssvc.exe
Token: SeRestorePrivilege	4740	vssvc.exe
Token: SeAuditPrivilege	4740	vssvc.exe
Token: SeBackupPrivilege	3804	wbengine.exe
Token: SeRestorePrivilege	3804	wbengine.exe
Token: SeSecurityPrivilege	3804	wbengine.exe
Token: 33	228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	228	SearchIndexer.exe
Token: SeDebugPrivilege	808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	1868	alg.exe
Token: SeDebugPrivilege	1868	alg.exe
Token: SeDebugPrivilege	1868	alg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 3344	808	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe	86
PID 3344 wrote to memory of 5092	3344	msedgewebview2.exe	88
PID 3344 wrote to memory of 212	3344	msedgewebview2.exe	112
PID 3344 wrote to memory of 212	3344	msedgewebview2.exe	112
PID 3344 wrote to memory of 212	3344	msedgewebview2.exe	112
PID 3344 wrote to memory of 952	3344	msedgewebview2.exe	113
PID 3344 wrote to memory of 3444	3344	msedgewebview2.exe	114
PID 3344 wrote to memory of 3444	3344	msedgewebview2.exe	114
PID 3344 wrote to memory of 4616	3344	msedgewebview2.exe	115
PID 3344 wrote to memory of 4616	3344	msedgewebview2.exe	115
PID 3344 wrote to memory of 4616	3344	msedgewebview2.exe	115
PID 228 wrote to memory of 4576	228	SearchIndexer.exe	116
PID 228 wrote to memory of 2072	228	SearchIndexer.exe	117
PID 3344 wrote to memory of 1956	3344	msedgewebview2.exe	142
PID 3344 wrote to memory of 1956	3344	msedgewebview2.exe	142
PID 3344 wrote to memory of 5160	3344	msedgewebview2.exe	145
PID 3344 wrote to memory of 5160	3344	msedgewebview2.exe	145
PID 3344 wrote to memory of 5740	3344	msedgewebview2.exe	147
PID 3344 wrote to memory of 6044	3344	msedgewebview2.exe	148
PID 3344 wrote to memory of 6044	3344	msedgewebview2.exe	148

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=808.2196.9578024176575312567
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa14f5b078,0x7ffa14f5b084,0x7ffa14f5b090
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,1011997704686957938,15532099642449280188,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2008,i,1011997704686957938,15532099642449280188,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,1011997704686957938,15532099642449280188,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3464,i,1011997704686957938,15532099642449280188,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4464,i,1011997704686957938,15532099642449280188,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:8
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3720,i,1011997704686957938,15532099642449280188,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3656,i,1011997704686957938,15532099642449280188,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4488,i,1011997704686957938,15532099642449280188,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    PID:6044

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3568

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1028

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4756

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3384

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4576
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3c4296a180422ed6310e5ae383485adafb0ed477110d4d3e5750ea99155b822c
MD5 630dd083fe027e049f756f51c844f9af
SHA1 aa6733d6f410a086ba4d3ac6d0039997a82b185d
SHA512 ad142c331e5b50401b665be35c2dc5cdbf894bd0be96a542ac25461856493e8c9f5b85902f13734fe2d30a6b3c35aad982bfeee211ea5cd104f1d852f8f12f9c
SSDEEP 49152:Yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnFDmg27RnWGj:y3q6sjBaD527BWG
TLSH
T17CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4b84edcb1d711e959a26011310ba8b44b8686abebbedafaa1a5b96f222c54f82
MD5 d24374ba09013b0927dbf15347ce1de0
SHA1 2a934813c2220a070f24686c425605f8ffd4b583
SHA512 a8dcb745f0b0bb6efa18307f8f64c40a6ca503100015b763ceba45d7851a5fa791c8da9333aa10090322b2a52bfc45a4eda7b8a35709143ce2b18005c7a611f6
SSDEEP 24576:zXYfDtczAisqjnhMgeiCl7G0nehbGZpbD:WtcTDmg27RnWGj
TLSH
T179650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 179a659a9d852442ac31653cceea68f76c708c4702838b54a2fa614244d8503a
MD5 a8fe53f5d6fc8193869ba859cbf152b5
SHA1 8f4086bde4f56a1ad36b5c6ff7e92decd7643440
SHA512 8f1e867109275a2431ab2b468b2a2f61993dd24b413ec26b9dee75f2fbaea1b23d8ba4aa4f8eb6fe0beb085dc297929b1b01eb0fd94836a04a381aba902dc0ea
SSDEEP 24576:50Le5ji0hmxxrMpsqjnhMgeiCl7G0nehbGZpbD:5Pji0AjIDmg27RnWGj
TLSH
T196859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2f73a4152c681f30b8e1a841ef9974bfbd502ab96279a75cf66ad378ffd925d8
MD5 145d6dcefbc0b2ca64f5c7e9a186700c
SHA1 32d4a85d6cf4f8221fd37c7941e06f3d2231b6f1
SHA512 c7a89b3e2f30297eac37abe8b6128152a06f169fd6fd2bc87805a564ec82da818d34532179a681288b62bf040091526e10ca31edee66b72ab0e63f434a00449b
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyu/sqjnhMgeiCl7G0nehbGZpbD:E/ezSC6vUzPveHjy0Dmg27RnWGj
TLSH
T139755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 19757324d05b28696b5f8c5459e6e11c934f9fd76c8ed4c5b1744cbacfa99f4d
MD5 dddafacc31047e8f8b4622f4a4dc6336
SHA1 18a29c369654c9aaae8835bc3e85df3e56ac7024
SHA512 cbf2a355a619152fd147173cb8b6e5b7d528530ba8fbf55e77b75a65c6c83aa2b78413d9836cc044e324e13caf34e29c176ce9c43eed628cef7dc08636ae6e19
SSDEEP 24576:xVbqPb88hv/l+YmsqjnhMgeiCl7G0nehbGZpbD:xVO88hXl+bDmg27RnWGj
TLSH
T145559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 143a28dfa91ba48fcf83e334b070f1e009776eb10c44da08294eac2d6ae9adab
MD5 9129eb353165de7895242b5f93d310cb
SHA1 8557bbe2cf4f9ca2b6d405eca900d12790628f95
SHA512 8e1987903b6f635ded672298219b684fa7a7e601787d3dea5e7eda8a102a012dbe275e9bed1a59c100bc9f7419d64ba234f7dbd97d11b36ec12888db5bd2d09b
SSDEEP 12288:dLNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dLNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BF864C50CAEB7608B5C3E9F11EAC137E56982008536AA37DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3382612701c56ea7d5631fd3d92c11c910737cc61bf1f5f08f365a3df80d4657
MD5 b710ba5efb7b22a33e5f9f3b6f304df2
SHA1 ae1a9f1e043e41b59349ffeb0da1dae0774e7e8d
SHA512 a5101735c23ded8b38aa3719266fbd4306ec1f375e80cd91cf85200e7ed80b3e9c1080bff219538e7769ab2f3edcc610b3c694502f63e2f6227fa1fd3620f530
SSDEEP 12288:SeBNUbTVO86UeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:SJIUesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F265CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1e450455271cba7c1d4d68e07d18911d75beaed0bb6f6d9d51fa22ec19840820
MD5 084531cc19efb2b3d31b07be8c307437
SHA1 eb895f069c2015c091afb4a959ed99b502f959e6
SHA512 16923fcf934b29ca1152b74933c7a1682baf86677f20dde686f0f6ccec02ff4cbcbcc6547f36de4ecd00b02ad77f6ed00f4451528b356cc0c52311c76221aed7
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH5:QQvGAdlCEL8c/DRNw5CzD527BWG
TLSH
T1C7266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 51f8868f63e20416581def77b84521ec5cda22342282494619f58ce4bb19d981
MD5 acb3c630e82678a6f72cffb06ad6989e
SHA1 da8ed577496337c4b9956b6de4c1542d77229cd3
SHA512 59d9ea8ea79a9def9da93fdec4f8a42c8c11258a2bd94bd54484ad4a47c98e3df62e404a627079f64783a1d11c2329bab082204f8766be1379822db6c0615cf2
SSDEEP 12288:2AwSfxL/2Dc3RDLLmt0LDQewsAjsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:L0ewsAjssqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ff4ddcf5e65a84a5580f76487006e27f2e8c5910307f51f20c199f78c73ae20c
MD5 3fa8dcd427964cdb555e3fd1e2a11c76
SHA1 2aa12d8dddc24573bd6ec667c253e2f0d3af7f5c
SHA512 023f0cf67b82ae8243fb15a37142cef2430aff0e5f6d4bc82632c839c64209745ae6a51ab607935c8b617fa16bd3c62ee1efc7c4d402378742be61da2af3ef12
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQVQBWG:TUEtQevvqc2W1cpV2tI32XB
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 058bda110268e7f8007b9aa0964c5c4556f2918d8adbd7e192c0a7b2195e7235
MD5 ec429dd2cd9ec7c5f664bf4f99f4872c
SHA1 4cbcade2b30c9fc5f26a1ce475872208626292ed
SHA512 9a6c04e8bb386a95405f1500c9da432da12b5059a287a1e6f181734042081a4ee487697606e0cb3f05a3a727356d8ea605efa0940997d2fbcdb332718264d1cb
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/z4Dmg27RnWGj:JoquVjnmPD527BWG
TLSH
T1C6D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 07105f61e47a9c4adb9c39097ea60cd1a483bfce2211fb369975c87be41aa300
MD5 fb1ffae3c3f9fe1509bb7d8bfba2d1a3
SHA1 89802081cbca411bf11a4eb3a3cc98993ab0952d
SHA512 6bf1284f8de23955d09f223ad8c4d0f1840e9753bb2f231e82a55a80e957b8f08a3d0532b005073b5641850d819c3f2ee0a9bef26aa1ee9bb3e42ca8139b4f00
SSDEEP 24576:DAhGL3IFoiwtA5l7S537sqjnhMgeiCl7G0nehbGZpbD:DAMUFoiq5fDmg27RnWGj
TLSH
T15B359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8fb9fabd4ccf6e37b3e56aee059be3460cf7ba221defa9b68d18d7548fff50d2
MD5 2ad98392340898cb8f35289151f06079
SHA1 fa594fd1c0fd13767964e8ac65a17ef61d370c71
SHA512 4c85857b3c51108e6681c003146e334273a1d8318d2b4765d0c8cb3f7e028d66d71a7071dc0f4113538f6e77a70f3b66b1988a7b18a827b38a367ee192c744ec
SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:9wu4OWosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE65F14A76A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ec1bf761fd7aa1d2f98a2feebd137f6ca8cd91753983cdf463445b68d45a8072
MD5 93ff3558f91029c103a7da62c1a961f6
SHA1 46e967e90a325b33c20884cf9e76ac62e80b1e18
SHA512 5ad12ebe0faa4361b74f3a127e40e33e3f72f311667540fab5c23fcd9401105aa81c6fbf28ed05766382852462868b406572525838415d7d7dd68efcb28ae35a
SSDEEP 12288:teZ1Iy8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IZuBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B75512AA239820FAE163417CC5E5D609E7337C62673043CF166659AA6F73AC44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 af384ffe8b4ef4d1c7ecdc9ef7eb2761151d57c6bebf7beaf7b4126dca0c9417
MD5 4ac1eb8ea8b1386afefe7cff6403b21b
SHA1 9459f16548e2b59f5cf82aa1670b7f590f610c14
SHA512 d042d2818b02f72fda093849f9770d098cc7a27b8f3b9d81efbfe993395b9dd7a02d9e5a4442786796e297b2c62b8d43db682940e63149f9fca007ad8d19276a
SSDEEP 98304:cQRQyi36YOcPbLvw2gAf+PN3OD527BWG:DQyiKa/X+PN+VQBWG
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3c216d5416cc5a0046d613369640cf6b6679f7740ece947638aefc9f4edb287a
MD5 085a2c6235aad48d07dc8c621d1938cf
SHA1 f693b9cb430f5ecf496898c1be2b022e6d9af637
SHA512 0943047b99ed0233ba4ea9b49138a56df999fd1eab460f14c93d6691b1d71efaf193ea4043c068a9e9258e9c462b66a7b6456315e7e96b3c9fe2147e573093e2
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN3OD527BWG:TQyiKa/X+PN+VQBWG
TLSH
T1A8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7c6fc82d0c30221568a8734bbebda8a236eee8ba071471238c10c3562ca53e3a
MD5 e9c68b100badbfbc205e1b64dccf5077
SHA1 7e31aa6ed6b2363d2aef626f156d5f17bfaf0268
SHA512 2fb09a543fcf7dd54ba383a47999c70e367b58dbdcff5f46b4a15b9da9ed5c22392687d15308e905f817d5ecfbbb46fb7c819d62395ef517243f977c1ea0da9c
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0xsqjnhMgeiCl7Ge:D68Qg55nhceWu7PNU3/IDmg27RnWGj
TLSH
T10DB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5eb89d73c0259d032bd8b96c6e0cd074c17dba77612425663af8471495234060
MD5 9d5013c160df7111846661a0c79e424f
SHA1 23550d622d6f1c4f38bb7b2491d943bb25187643
SHA512 7a8666fa9730fb3fd3b2d8088b1dff2ea06c44edad619b9374e0c205474d07e60d10651b3366795b08782cc83e2a7e8c781f69c85a71fe7e534494981b4fc661
SSDEEP 98304:Gy5112gYy5azzVvt69nLKnhZxD527BWG:3LIHEWhnVQBWG
TLSH
T1C7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1b8422cb116b013342d28cfd71ba7534708074104b2aed38ebe94e06523d7528
MD5 35f31bcd10c4612332736ac831639ba2
SHA1 9b78c3f7033efcaaea9e6b4185264899349a3ba9
SHA512 8f6d7ba8e4e58ad15653dccc9757ec2802beff347a477d925c81621adafd2b211eb0dbe2365ea1206f28fa6b804013dd1a47c3f5ff663903a4e74fdfd8c06709
SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glWDmg27RnWGj:Iu6Jmdxd2dWD527BWG
TLSH
T17DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 677677dc11ae73ced99eb2153025baea05db6cdbb6efd8c6dec89baaed76a6b3
MD5 dff8c304c0bf20120b5c3dd126b34f67
SHA1 ec7ea9b86a09cb3c1fd5a1c6c59a1d1a07efd232
SHA512 6fd92beaaefffa6b0de21c7ed26f67ad70ae6b17963043c7fc5e198420c9084e32eea15edfbe7adc548b11063e053cdb6794581f8d38d6194a27626cbacdce63
SSDEEP 49152:x1hpsNoJpF1A63U44CwH7R4xSDmg27RnWGj:xmifPWRPD527BWG
TLSH
T15BB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ac7f1fb34f4a6cb4881e641fd15633759fdeff7fd3f4425b98e2981bfc64607d
MD5 176ff7c645437cf8ae4605974ef36f88
SHA1 d3182c405b11da2c661ab598fe9ab1e56143cec8
SHA512 1cc3b4fd673b0ffd483c43409b197ca79817ce7ad0393ab1e98d9be8d7426dc98996121b35e06e8339b9636d638a3798f50c05db521405ae1b11f4a0989eb4f0
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqVDmg27RnWGj:B5dKii61VD527BWG
TLSH
T1DBC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 17a669c642bcc2e396ca2427204c91946dbcc01bc1e299b9d224d5c85c88088a
MD5 55a778699bfc0e8075b03193a6a66312
SHA1 95faa192843baf05ce205f6ab9eea40949c93a5b
SHA512 0cf0265c5ddaee27a65f04a29aa8718aceec6724cc1834f872d4c36ae376b07e33c43f16a0611ed3bd80d98c44a39e1fce3b1e82fa882eeae6a3f9fc5544c81f
SSDEEP 49152:/htSn8EApI0fig3giDn0AP5wmDmg27RnWGj:uX2imphrD527BWG
TLSH
T1DA95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4ee5e9c213b77774d02e37d582ac4ec7d8561c14fde5e3e6766678975e6c0a96
MD5 a67f2f154fe3b9ba5f326f307136e00f
SHA1 c546f6649d0aad84e604cd79713ce71db16de14d
SHA512 75df6d705d8f99cfcc0f1f0a76f028b59dc57eb90665a8290577bd01448f4a4ddbcf2f0f08155be24965e54eac44e9fa3feaf2dde402c6bf2e7b99c440b9f753
SSDEEP 12288:HFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3249ce1a9c573701b8f2d2c23daacde609f9b8d6b0facb887fad48343d3a9c37
MD5 251dd3ab820f5b40ce80fd1110b773bc
SHA1 b95e572c845af93402b549e7761ca869f372411a
SHA512 8dd323bd74768dfeea05321723b6ba3fae3455911917f364562370782ec05cb9cb19cc8bc26ab8f98e498657514d6fb928150246b6cabe6a37eda27cce197bec
SSDEEP 12288:CQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BE964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7f88fcd0e70f42bdf0581489020087a99de39af9f69da587bf772efa5aae1686
MD5 947dded7f1891e20c80050542a23040e
SHA1 6466dc7f28b772996b383a04cfd04629fb0cbd7a
SHA512 6171cde1b15d16bb1163013556ae861c22315cd7bfc7d78be1338918c94f9403f8cbd2b317553e85be1e6866a5e3fba1f30e4545fa1ba6b1de8d703cce6910b5
SSDEEP 12288:hWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BE964C41CAE52648B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e1fcc25be7300211f913a4c68b21dfc277d3bb3bf0615c711f76c5bbde8bfc8a
MD5 109cbe28c371a7afc73ddd35192cb1a4
SHA1 3a6bf68adec6e3d0fbbb8c3d26da5bf1b4bd9e27
SHA512 0459d7f63bd8d1aed5b69e799aad9a77a8a5229c8370063b61c3f8a74d7f886d6585a0094c58f4056b1cfe12432267b2e90255df1d20ad5edb67d6fe949e00f2
SSDEEP 12288:OVbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13145236F575C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bc3495c03c160452649d3695a6032f156fd6259b7a2aad22a8313ef0a79856a5
MD5 1aec6113a03c334ea01c5eb808c5a194
SHA1 a0de6848eae0f46364329102b1bf99e4b17adcf6
SHA512 e005b16330a92819277654551d19b597a47c2baaaa7abbda313882fc34ac045e3ef51346edc47228d376be071a2877fb93ca2abd0b0ba4bba0c92b9d5fd92473
SSDEEP 12288:uDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BE964C41CAE52648B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7706a42f43a8b570d25f5729c29f733ac5dd56d52829691fe0017d07cc3eef7e
MD5 fa78aeb536251777d9cd62a76b3157ec
SHA1 a10925182afa2ece98d52abfdf19cdb335898f43
SHA512 a4b143cc1ba25a2c6bd590cb112644eac6b02db3070c5b68935c5afb3b80d279ee4d70eac19dd9726b516fe176a3209282f7629ff01d61e89970532127e7bf30
SSDEEP 12288:zEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BE964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5cf815f12ac7e4341b673990a451d88f844e03bf49d6790baa2b1e10f2ba747e
MD5 fd4dcb91bc17b74c47efebe15108fc29
SHA1 342f1d9c40e5bcd505cb3da171dc92581e09aa1a
SHA512 c2e35cc9528cf9783ee34618ae25b619dc2b8c6dfd3a8f12ac848101aee5c5b08c9fb16dbb281112a42fe16c73c31a35fe7c2351c1fa0052f9a4b161411dd7ac
SSDEEP 12288:SYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1244523BE964C41CAE52644B5C3E5F11DAC073E5BE9200493BA9B7CBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a6c68b130df80fe5614fe3e117a42d70d340d8ba0ce48697d1b1c58a331b212d
MD5 10d08dea54605283b10f1ce291528dbd
SHA1 c583ab3a9983e07fe28ed34519dbeb3e814783ad
SHA512 b5f9ee36260bfffccf31455bb54a3eede268626b78ed39cd76b0179e9da4387d71437ff04e36e293f1967ce69dfee35f1281613a0a3dbc953611235907a56b74
SSDEEP 24576:8ZMRzFVSOwsqjnhMgeiCl7G0nehbGZpbD:8ZMRzfwDmg27RnWGj
TLSH
T1ED6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 41e3d4a04dcbf4a829f1702705ccab180cb912a6811542cb49990b9e29fc0821
MD5 873cc4091f2fed614fa48ca7683e085d
SHA1 c69669d50c1953e08ee783af5738db70c81dd1eb
SHA512 4ec5e93a30947e09572cc2af091201742ca86b35e81e4d6aaebbb4767635d378b1efc349802134c5442bfaeeb00d3dc23e2c73702dbffaf41bb70a0ed0bd9126
SSDEEP 24576:CcP4mcvIjkGOxhKP2l71SNKbrh/8KBZsqjnhMgeiCl7G0nehbGZpbD:tP4m4IpOO67N8KzDmg27RnWGj
TLSH
T18F65BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3344_1829746549\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3344_743825218\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3344_743825218\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3344_856114895\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7234bc190e82be5ac6fb75e6919d92e9ff5214e726a13b4ae4f7f4a861c5e254
MD5 fc6f4e779d3f95cb6d75284f78cdd16d
SHA1 8161f67b2567c5a155fca0e09bf29b6a60227e5e
SHA512 28081341b960f27d5f32ecbb75e9ece76a7a34b3c4b4c9fc50a72c4439d3f36771a1b226f793d84ca51cb53be058dcac467f65e3383d9d3e73136432259a288e
SSDEEP 12288:zbsfBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E055011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3e799cb16d918b2881e47e850b76d9f57506003d029103a713d32ce2811a3f4e
MD5 da5d8d869dec58ef6b90a8ffc0636c1e
SHA1 5366e99b8c6f25d3c57f31b97511e3cef97d3ac8
SHA512 eba9f2c0ba572ff70ed6e0d67720811038de126d93b8979499775a8dc487f166b7dc85e52221c668dbcb664d342fbbdbf0b1bc480d0c04559c3f5c390f0ded8f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e79e1d3b284a8e1264acb4f74348db8faedb06b8f3aa1cc92bbefacb50c445fe
MD5 5708053752c39901c784c3bf9429bc66
SHA1 44ee76abd3d5e736c89843a351e30e123c902d43
SHA512 fc105e8339f078e5ee6529947f57084fa1cd5ffff6875e1dc4a1da5f4050faa02253f4f6e1ece643739f2d5b33deab674b96e65f2ae44eb8b50f3c6e4118ca26
TLSH
T1DBD012127B0101B4C43034330102A1080900C70B80498244683DD95D1B048600907842
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 13da76e3a6ee24901b8ccca25f2b9dc2f0e6ad7ad4816e514f024d1ecbff7462
MD5 96b38dcac3df1fe82a39d1af4b88f627
SHA1 c1b5df832cc5cfcf2750d8a8ba54e31656c162be
SHA512 44b700945f42e330864cd3d4335c7067a021ab0f5ad5391428652359da8f1a436a6eff5a9b86ab132ef4b29c2c58e89f53a1c19ec354e42d28ec2de0f2e0ab5e
TLSH
T145A002144B910117D661B7F314E501507632DC5806235B93C0F591B8DC633C15111446
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596fa8.TMP

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596fa8.TMP
Size 48B
SHA256 7d39fea8b1147b7bfd87dcf349e398c9142380586ff2248444eb024e73e2397c
MD5 b67e1c4886fde93b687080cbaa465fda
SHA1 b42635fb0b8566b0e7d611a090d5664932276b4e
SHA512 27d70529191d4aa8a5d5ce57da5b76ef49a7be506c65e545a4e5177f00b0b602940b1e0c9f19cb175be12aa2e55120febdf4008c5e5d4aa6209e27f989a991b1
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\Network Persistent State
Size 570B
SHA256 ee1ae661e640d8a5947223efe4ab17a3f51c0f47e2a5d1b799b55e73ac9a3032
MD5 7d211e5d20a9ac81ec66229ec0ecc3d5
SHA1 4caf4d8d69116c37f29cdaca3b10ca9eb79c49d1
SHA512 8ec06c08c569d7775385cff4703048b0ce0d9b689c476bcd3081b07780be0aaee0bfe62253d1dea0c8edc16feb899c788002f94ee0253e98879d964b3c7daae3
TLSH
T118F08192C2E4C6BE4B5517E01A357913C92E080E92282D26DDDAF7AE57D2075D12150F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a34fc.TMP

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a34fc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 27f1c03408917264426ef7d06b47fdbe920d1ae05c14db0c971c9398b7945114
MD5 721e379415ec850872740d3a5c702634
SHA1 bbc76b6147edb395bd089d38c2334d3511043c41
SHA512 e23b09d053a4249de40f631cab0c2e5f41f6e003f3199f351139e3a0b7d6235b1219df02fc7653ddd4a04d32a888c6e6a99b01e1e61b56d467c78dec4db4a056
SSDEEP 192:st607/DiZfcZ8pa76/S+WiT9Swd+Ss9MC:stP7bgbN/VowRxC
TLSH
T176E1C8065E28A9775CC7F6097A35FF12E2F6106265C50E88EBFC862C09E66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59aee4.TMP

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Preferences~RFe59aee4.TMP
Size 6KB
SHA256 4b8c7eee4bffeea60d7ade7fe06b48b764c6528b2f870044618e7f3db2a4c3cb
MD5 f5cf5181d01b30d8d0d1ba06e5825021
SHA1 ca82c83af8177d267e14bc2a626a6d5dbee9e0bd
SHA512 b43d0c0341d8fcbfd83dde5807f79e74c6a33b5242a21961dff291b53663b5db65b731c7ea99c71263acdfc1b8cbbaf6f9a1cb7190dbaf1be87abaeb417b6a1b
SSDEEP 96:st605l42DHi2b9GffqLZ8i0vhEwktrm/7qx+WVHMSm+uecJ9S1idQj/+gZlfMEB:st607/DinfcZ8pa76/S+WiT9Swd+H9M8
TLSH
T157D1B7065F28A9774CC7E6197F35FF06D2FA106265D51E88EBFC862C08E66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State
Size 1KB
SHA256 dbdb373a1ecfc1e121408533f62a93a7e0430bddb9336b674a75b1c9ec6e2ba7
MD5 09a0354ee4f748f8de114a576218b6f8
SHA1 3b90a3eaaeee88fadc8c37d03244d2332400a0c3
SHA512 e0bb461fa184e1c714b7ae4ac36ef4e93dda4e027f4e69449e0d6c6bdf99ef148556eb0109626137e4bcca2722be528862c306c65982259ccae936302a412f5b
TLSH
T1233185B3A8807B32ACC59645B2456F4B6E31003AC1508E84F1EE432E15F71DCE926D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State
Size 2KB
SHA256 44cdd50a7c04e725ec7aa192111a1f3c91323afb64c2a25cec6b1da67f06953c
MD5 0c00679e19e74a14d61002add0751bd0
SHA1 c04d06cd435a687e759757160e9558610c1e268e
SHA512 dbff85de312d1cb612308dd6ffa522096dd99a275b3ee4511e7912b1f565df7f886f2074a8caeb0db83c16bdedd5c62add3a0a8e9f5c82b3a7cfd6f95a7e809a
TLSH
T12E51B8B3BC44BB3799D69A44B6493F13AE351165C9912F50E5DD0B2D01EB1DC6702C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State
Size 3KB
SHA256 db254b3111369b4f49102214b1d2ea7fa79564ee65df2ee91aece416829df92d
MD5 a87e16d5a09f0c4feef149413e8f1683
SHA1 8f23af2f0da0bf99e94d09f0752e05b018dad1ff
SHA512 7bc19f5ca12ab7ba7b7f0a70dab17b4c55fa2c4a0a15a68528e8486d925572c1613aee4765a55b18501621cdebd7d20b3388cdd3aeba7ed05547d58ee58a2fa9
TLSH
T17E71B477A8A4AA374EE29E44B5852F06BA750137D4C43FA4D6EC0F1D01EB2DC2302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State
Size 16KB
SHA256 4a8b2a61992babc665f373522b8223f01f0d5b28d82610460e268ef739d78e50
MD5 6d4770a3e892c710c4491f6b6c478eb2
SHA1 3a6a1896920a27c364a7fa3fa3080982ccf5cb99
SHA512 1d39a9025ec0e5098e5c3cc9741a9fbd2388cc7314bd3f94f2857a038c51f6db17de2b2df09ebd4c1be26c2ca7d7ec5ad9154a9cf50b1fa8b052898151762d26
SSDEEP 384:zR+aQikB+z/xvxjg/qhEwNb5tWPblLfNCLCQ9zH:I/UxvxjgC+g4b9fNCLCQFH
TLSH
T17972AF2B65597E2395F7A900B54D0B4FDAB984B280C17EB889FD0F0E06E72D81743D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590fd5.TMP

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State~RFe590fd5.TMP
Size 1KB
SHA256 971cad8eacdf7b47234a21989621691fe2d70e98b62e39a33fc52ed4872e67f0
MD5 06cade71b26f3636b1e4cd2f879e3ad8
SHA1 5051adc836a9daeba5740e1149064bc591f044db
SHA512 0d275805117d2219d8f319fee25f8c42bb594f7d0cbd5c0f85994eea5f22f7d617c3da0b83b3f47340d75549833315087749fe90c60ccc0c8cbbec2482d3e5d5
TLSH
T13F2140B3D884BB32B9894944B245AB4B2D20013AC1548E48F1DE432E26FB5ECDA26D77
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1aa61caf11f495d4fa3ddff39afc0c1278fe1ef3780e69f392fb84265ad3c88c
MD5 ca06be2c8e62c6e3fc9a0f397b29f831
SHA1 1865e38b43110cd305a7e64ce23f255d941e86de
SHA512 1aed1e1d301966766b2af649b6c09f589a5c3e3bd4a3788a6100c3f8c0e82c57571b10e1a46078cdd0cc2a7bfbeafd077f6ce2849bb59d70399c4d06451fdd15
SSDEEP 12288:MhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA45237FD34C518BE57649B082E9E12D780B3E769E204483BA4778FDB6B18948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 355c3ed012505426fbf22476fb221371431197d88191547c102617a021f4547f
MD5 910402915ed839269d19471bf479e44d
SHA1 787eafaff46977d71e656b954e90960e0b0a0596
SHA512 8d3f557b0f52da1ab7257a8889501680d6964c3216c14a75c50b96a471a43fedb182fb5b13176dd166073d8886106a8201c2ac3aee126881596a8a7be4db014f
SSDEEP 49152:6a0h2GEkuAe73q3pp46zwwQHDmg27RnWGj:6a0hNYG4JwQD527BWG
TLSH
T17185AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 44dd4104625e116b3ecb8d9be2bb5a18f66b7d33071479a78e37442713d4c553
MD5 939521d78e61cf759e4fadb3826ec9e9
SHA1 e582a5d13f6be6e8e7e73980a8daa2e30fb111a9
SHA512 bbc8dd1c5c052fb97e1b7bd72eb4f9bd01ffa0dc459841212f7de89da6c917e3f7507eb56482eebbed7bbdf1ca5ef736d1836e0187d975e4ce7bde9db1c338e5
SSDEEP 12288:mhbHjfXAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mhbHjPAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19555127E16AC20C9E572A1BD8296D10AD632BC26172053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 29830fef8371b39b5c2ca24169c1f98749aa87e62829017f4ae97d6bbe472337
MD5 0da1d861f971fcd1d0d0b1326b1ab612
SHA1 8caddeb6b805377aba588b62ee63f793744c3382
SHA512 4312846acd92f1a0c9ab9861a8e052df60d8c8c19239aecfb19aaa8d7f79daf3e77cd583546b1e89aa0132b6dafe57dc27fe62f8975ca399fe0173cc4dc30d21
SSDEEP 24576:e3YgnJcRTk4yti+R5dpR/osqjnhMgeiCl7G0nehbGZpbD:eIgnaTk46ppR/UDmg27RnWGj
TLSH
T1E245BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 24ac51cb7087daed0f50ee806203c2dc9da660f083fe066a56138ef2ec539404
MD5 73e3082d3b5eaa369c3df90e90af034d
SHA1 a0ef3856c71a746db945d18791d3e3f9b80efb48
SHA512 6802089b2fcc5775aab39074b1de8d129064602357f438c00e6ef1db8964f121e6cb017065cb2c8f4301c6e490b2a5a1bfd2cbfadb5ed0a3d057493636592a50
SSDEEP 12288:UtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1094523BE924C51CAD53649F583E5E11DA8073E56AB2008D379977CFEE7B18E84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 cbbd8963e53e844f8a7adce4ac4437903d0744b579a617b10732ba6b9885585f
MD5 68b25a2da2bf306662d8062fee35df96
SHA1 52bae050e949e3f81e699ddd292eed57a89adc6e
SHA512 c0e8994e200ec93c1a32623650cdde3d1c330d57d74a1b40ccb3b373322082da33d677707b585e16c892280680c1b452780be008bd857a9228b08d602d31ddda
SSDEEP 12288:jObfA4LWOsvAYFTiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:MbL3UTisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D6750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 df79f94c7c7899d6d6becb0bc48e01851f95850a8d86a52f823f76eb1b5ae3cb
MD5 929b612561f2bcca0a2e9fb69f28d708
SHA1 04b29feda730ce0513dbb3ae75d0371d4e3b19ca
SHA512 8c6f2e2ede154f1ca6041dbdd0121532448bdb0ead1820ba94a58246d5565a4060335e1ebb10a0b82c022622e9dc958afdb063a69b69650e75662f8072fd3e5e
SSDEEP 12288:spFtIO+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nO+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A55022E33DC10E9E536917C8692D20DD632BC661B2117DF06D184BE5FA3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 07c4e38937b1bb0468b594006848d4d380d541c1fdb45ed5c95a854e6509de83
MD5 dc5d810ead7c8745fef33f82f4de6502
SHA1 de77aada61961ba165b87dd0fb718621fa300ec9
SHA512 a73809eb8070520bf880e05bd38bae8c3265fe4672bdf37be77681dfe2288b428d8ff46ba277d5017a26ae7a9119af91dfe840577786f889fc82de8d7cdfc143
SSDEEP 24576:b7NM9YmZqmWMUkPjZM48Mv6bEhsRsqjnhMgeiCl7G0nehbGZpbD:b7cBWMpPjN8DbEhcDmg27RnWGj
TLSH
T167659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 26292ce802ff22fd48d65b3e7efaf56ef6f0650cd8d52bdb49bf6b894b6a697b
MD5 05dc8427249bdea55d45ccb82de20aa9
SHA1 843d230d3ecb21f1b1ca60c28cb4373e7ad2f356
SHA512 1a08dbe8149a11d53d4bbba883df57d8a1731cfae3e0709c48590e6a74042d83d84b832f9cbe3becaaa9fa3b5b2585217511ce3ae4c8d8a3a94ce6c44128433b
SSDEEP 24576:SW6BApg2YuyuNDYTabvcRvNYf8km1HsqjnhMgeiCl7G0nehbGZpbD:SF2YuHNETovcvNYf8kmFDmg27RnWGj
TLSH
T1E1857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 12d2ed6773ee0ab0108adbe65e53b300a2f56ebf1fa27531cafdedadb6859ce3
MD5 9318a8c633ae8b558eef25db3e29191b
SHA1 21920606c6dcc76537bb57f055c6d97a6c1823df
SHA512 e6a32073074cf8fa58d391af50a710ed91b3a4e62e5710a642a4a0e0e02b6f60f8fb9be04e078a43816132f5699f0ea89d5795ac6e3d62218cd6df3daa6237dd
SSDEEP 24576:qAFs06+OmlfkNXEbToasqjnhMgeiCl7G0nehbGZpbD:zFs060lwXunDmg27RnWGj
TLSH
T10365AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8a4b9a348c1513c6193fb4be2e3ffae8ab997afcc19035ca59e4b7a140949aed
MD5 d1cd60d29af6127bb241e7827fa441e5
SHA1 4cf6dbb9d292fb7d40ad9afa8d7270b997147bf1
SHA512 08e7f07a277ac88cb0ac5bbef744db60967e0cd5ef021ea35ddf2afc2edf711e5ea04f750b0cfce3f4b3e8299cbb7ebbd7e396da6ffbdd99b795499922bcb041
SSDEEP 24576:EJnJ5D3WtjsqjnhMgeiCl7G0nehbGZpbD:EJnJ5DGtnDmg27RnWGj
TLSH
T19C75E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 26f85fff60b6ba9327158d4397b5cf61cc13b5685a800d8e7ec8b47d43875a66
MD5 34c5e8409af1e5b10d03ad5d72eeff73
SHA1 6f1c114b54943d8408766f9687b3bc06c23f8ac0
SHA512 beacb0ddfe788228a727da6a6d87db3e3779022d37bc3ba5dded86a6a7125c678a6fc7261f4bb538d0e824787b846f9fe85db885d42498dbe814c417ea788f37
SSDEEP 24576:nEPohm6/7IIXdwcXrif7qQncjlP65i3VuosqjnhMgeiCl7G0nehbGZpbD:Ao06DIKdwc+eQnSt65aV5Dmg27RnWGj
TLSH
T1B0955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e8e533ea573fc2f75e0b861dec99d41f287d8bed965adafa22ae568946d8dc11
MD5 6e98ac18ba2a492b63b0372566d1d930
SHA1 086fba3c0027381340df88015158511ccf938da2
SHA512 0872483dfe34a0b311e4c88fd87afaa048178860cf8cc0d3ea215ceb0ea5930fb79bf81120aa5d642930c478f33b64bb7997a5460a3162da549de3a7a662809e
SSDEEP 12288:wEP3RrfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LrfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F355126E679C60DAD136907D82A1C209D733F4716B2127EF2692D57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 6f333e9f5c67b99f579d8b31486fbb6ccb9f76b7f54f209694cae59d277e42f3
MD5 ee10d0f0c4aadc4ad00f96ad799117cd
SHA1 d2696b61e1f0899b2a4ea81decd596ffb7d1435d
SHA512 c7ea329347cd44e6fb33e9dad5e50be14718b9f74a0628caaca6c3d5dfc12c6064aadf74754725841b56c82d4a8562e2e08badaba09a0eb46fb4ca95efdeb7ea
SSDEEP 12288:5jkyQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5IyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF551219639C60C9E9760578C6B3D1589C32BC31AF2046DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 06f18a56102e87fb58e52df11cb48c5c4dc442766073b2177938f1e195b53b93
MD5 9369caa1869449faac32cf526f535d95
SHA1 7ffdeb6ababbcfd2c55ba6383fb0f3e0622b0de0
SHA512 b7aed7927324527acca9f9138d5e4bebba3ddadec8869a9f5418a4389d13c39aa4db57ebef08e565b434740f429d59437add7d2581f4f59308ebf7b60d84b080
SSDEEP 12288:vFOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC45237E525C60CAE93645B8C3A5E10DA8133D366B2018E779E7BCBDEBB24D44739813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3b2e7bfab8626a6e0b817b73b49642f7f4c0cff367d57d7cfffb2b5d4b3e5500
MD5 ec507fb33dadf43c410d1bc83fec5f7b
SHA1 b9c3e230a061ccdd1c207d6cf2578bf1566707d9
SHA512 c3684bb7ba82b69b0b201306682e7f6386ecd4d9b89463e0a5f38848f14e282ea0332ab2e272b72cc9819d85374e10a445e7820b6706089ba06f66f850c6348f
SSDEEP 24576:ZQ9MxZKdcz97w3JsqjnhMgeiCl7G0nehbGZpbD:ZVKXNDmg27RnWGj
TLSH
T140558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 2658d9ece1862dee42de90383a07d8a20eb936a9fbcb1c16d1e8e98a57928d51
MD5 3ee2b72fcbe1d7df868293c83b2a47da
SHA1 fcc59f1dd258ddfd025269a7726c83165fb4bf6d
SHA512 68429dbecf9f37bdc6ec4c85cf761e93112ab426ba7f47f2267c07e6fe7ab98a0d38eb11a9c9a2b2b91031c627271053851eb257b8a2e1a6553ecf0ca9e409de
SSDEEP 12288:MyoKo2HRple9psXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:MyocxApssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF65E01FB76D40E2E176813C8985C249E673B4305B6257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d31faf2855b19560e45c25398b2a983c6674165e52571d34f24f6f6803a5d63b
MD5 6a120a4c751cc34fa7978285a4b3f2e0
SHA1 592fe5e5315e2feaf808cab954283ff203eea07e
SHA512 bcc471be9fdfd9bd98a9354bd1fba31687cf8d2a73f4176dea1935d9e2d19b2beb7503eda2ff1093b383b10df2b77b237531ccf7293cd2138bf3b34f8073bd36
SSDEEP 49152:FWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKYDmg27RnWGj:10zuNIkD527BWG
TLSH
T134A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 677aceb951812e4267310949861e2d68305c9dd2a59e817a33bf82218d55104b
MD5 193f72e987bb9a05b027503a308bca53
SHA1 6df550061a25294ff7cc07dfbd8a0e8e5ee8cb47
SHA512 56704ef726e7fbab89e47681ff859f04e1f19a5bde5022d9032f6415507d9cb82c9d98195adb6fd27dd1e54aca8d6e225676b002571d5693e355ede7b02e67f3
SSDEEP 24576:D1QT7EcpfxR+N5AWAz3ooiYujMqbfsqjnhMgeiCl7G0nehbGZpbD:eTDxR+N5YzT4jMyDmg27RnWGj
TLSH
T16855B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 3d40c1c0da7cf59c76a0702f95786d5ec965cad1cf582b39eb86141dfa037584
MD5 f7c2a59d3014c2f4484b45ca0c854db1
SHA1 5c05fdadd08e12e079c09e43efbadb7bca717946
SHA512 dfd869d749a4764ee42365f0eef673466a5920d86259e7e39c1e0d333347a850b1d4a5e41c4afbafb68da23c9855513f1c11bcc8bf4bfa6cb45683703ecea481
SSDEEP 24576:uTMdOz0FFS+bmSLbsqjnhMgeiCl7G0nehbGZpbD:a0K+bmSLPDmg27RnWGj
TLSH
T1E575E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B93FA7EE46A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 cbfcf476e4c91d9be1124bd4c5859ade5adfe8b37860186de4c0b865da834438
MD5 b63336866662886c2e6a87f7d1325a80
SHA1 8f2f2f918918c84ed99bb37854b1fef0fe027a57
SHA512 7ebbc8aff55cd76b2c193841a009d2bcbe4661356c8294b5e6807ee80bd11de91c4be5409607e6d327f08e9609b2bb525da9a778699b8a5f751b2a50a55f083d
SSDEEP 12288:M47iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF55126E63DC30C9E4329574C2B6D1099432BC36672019FF39E1D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-98-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/208-92-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/208-101-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/212-462-0x00007FFA311F0000-0x00007FFA311F1000-memory.dmp

Download

memory/228-321-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/228-745-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/228-710-0x000000000BDE0000-0x000000000BDE8000-memory.dmp

Download

memory/228-337-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/228-274-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/228-380-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/228-277-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/436-627-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/436-203-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/436-200-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/808-113-0x0000000140000000-0x000000014124E000-memory.dmp

Download

memory/808-1-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/808-6-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/808-22-0x0000000140000000-0x000000014124E000-memory.dmp

Download

memory/1028-80-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/1028-87-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1028-74-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/1028-82-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1028-85-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/1572-709-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1572-219-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/1572-229-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1572-225-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/1836-175-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1836-178-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1836-169-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1836-437-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1868-23-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1868-125-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1868-17-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1868-11-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2072-735-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-733-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-739-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-736-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-732-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-730-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-729-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-737-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-734-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-738-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2072-731-0x000002141F700000-0x000002141F710000-memory.dmp

Download

memory/2552-177-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2552-52-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2552-58-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2552-61-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2720-116-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2720-126-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2720-122-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2720-239-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3384-164-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3384-167-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3384-158-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3384-403-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3444-533-0x00007FFA2FD60000-0x00007FFA2FD61000-memory.dmp

Download

memory/3444-532-0x00007FFA2FC70000-0x00007FFA2FC71000-memory.dmp

Download

memory/3496-217-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3496-215-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3496-213-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3496-211-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3496-205-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3736-188-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3736-182-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3736-192-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3736-556-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3804-723-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3804-253-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3804-243-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3804-249-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3912-110-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3912-104-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3912-114-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3912-228-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4116-141-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4116-144-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4116-264-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4580-133-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4580-252-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4616-555-0x00007FFA311F0000-0x00007FFA311F1000-memory.dmp

Download

memory/4668-255-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4668-728-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4668-265-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4668-261-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4740-715-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4740-231-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4740-240-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4740-237-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4756-581-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4756-618-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4756-152-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4756-146-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4756-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4756-155-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4864-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4864-69-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4864-72-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4864-191-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5024-91-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5024-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5024-48-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5024-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5024-42-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5068-132-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/5068-31-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5068-33-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/5068-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download