ad658bd6bf7082a1ab430541fe30ea1e158082fc31f39a5ba6da2fec45f100e4

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
Size 5.9MB
Sample260706-l19nlsds71
SHA256 ad658bd6bf7082a1ab430541fe30ea1e158082fc31f39a5ba6da2fec45f100e4
MD5 f622d85576fd883020c398ae8d1911cb
SHA1 36d2bfcc5f0a84efe2e4b27f5870e30b6f0faac1
SHA512 fc3ef19ed418428ca45ed879dc9084dcbbfcc4120ebd301e708cf07d266f6ec0afa87f9328d54229bc34595d97b2997f8a4ce4940b80bfdccb82cf3b3d9c00cd
SSDEEP 49152:gcVCSDYtq5SE0v7Lut0MSw8XYbOUpkjj+typAVT/IDh5uwUqqOUZ9s1ztpPLeUii:KCq40eVYqOr+FNbldE8xOngOqwDv6V
TLSH
T18B5629117AABA8ECC199C8B5834A46731E2174CB1B36B9FF44C446353FA9AB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5052	elevation_service.exe
4420	elevation_service.exe
3064	maintenanceservice.exe
1484	OSE.EXE
1180	PerceptionSimulationService.exe
4832	perfhost.exe
1444	ReFsDedupSvc.exe
6036	SensorDataService.exe
2376	ssh-agent.exe
4464	AgentService.exe
4104	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\61331a4e118c7e83.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110781\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003af4cf6b2e0ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036000b6f2e0ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e08984702e0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfc1c66e2e0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d482b66f2e0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1544	2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
Token: SeTakeOwnershipPrivilege	5052	elevation_service.exe
Token: SeBackupPrivilege	1444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1444	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4464	AgentService.exe
Token: 33	4104	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4104	SearchIndexer.exe
Token: SeDebugPrivilege	5052	elevation_service.exe
Token: SeDebugPrivilege	4420	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 2460	4104	SearchIndexer.exe	101
PID 4104 wrote to memory of 1352	4104	SearchIndexer.exe	102
PID 4104 wrote to memory of 4060	4104	SearchIndexer.exe	103
PID 4104 wrote to memory of 5512	4104	SearchIndexer.exe	104
PID 4104 wrote to memory of 4496	4104	SearchIndexer.exe	106
PID 4104 wrote to memory of 2084	4104	SearchIndexer.exe	107
PID 4104 wrote to memory of 5840	4104	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f622d85576fd883020c398ae8d1911cb_akira_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4832

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6036

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2848 1760 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2848 1760 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2388aee8d62559bb847df71954e79c03e91a6d1371b7f639efb2124ce5954792
MD5 b868992865c0b7239e924a762d784e51
SHA1 53ddb97faeb44e1213db283d104889ba145881a5
SHA512 ea4be51b5369ce11228fff5597a22dd6e12006ebc817149cf2518e63855bbab16c5b47f545b3fd69e69fa3ad38d2335f90c50ec6bf2715cf37677491030e263c
SSDEEP 49152:db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxDv66mG:j3q6sjB+Dv6V
TLSH
T18CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7322814fa55e63c45bb5f93cd22627aae288810d42114ed97c1a7c263c3773fe
MD5 323ef8fd13d9e8c425ad539ac665cbc5
SHA1 937c0eb1890fe7a4d9ef413b81ecceee9216ed76
SHA512 1de504d9bb70945d36b93f68dbfdaecf8c14b6cc293183ece8a4d8d2a30c683fe6ec8dcdef920c0a7ba6a7f04ca4280649a3d689af84d014fbe896ad2203c0a9
SSDEEP 12288:i1XLsswWkxy2lRq2czAGXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:oXYfDtczAB743TvRk6NwG
TLSH
T1B065F12873E408FDED77827DC8A28512E673B85547A0EBCF03A499651F232D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ae8e2b81fc0e85440cc270ee318fe82aedb5c66a7974079fd72682d42b244876
MD5 4d9ef4c4dc8a632826e2b8315f1b45f8
SHA1 ca34353d73711de1c25c4e0b4f801f7a9d113b30
SHA512 39ce386554c6ef682b910db1442cad73936cc79069298d41816c69a4ab51bc88e58b7d4a6fe4002f5417df766d222ce0234f6e934f37bf747773223e7e7aa4a4
SSDEEP 12288:LXZNYVLeyUji0h90ZD0wxpGZIVuCrHsNXI7vgbrWVQhTCYHvRktx/aICF9flefu2:N0Le5ji0hmxxrMW743TvRk6NwG
TLSH
T1F785AE16F6748335D073C0B9C5D2A68EE97230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3125c9ce33408100b23d9a80f25f8b6750108d0341d1f8fe0164ebf51a993e07
MD5 2d8c792f4028f6b05a98db32ecee31ed
SHA1 a19ebb3e2a0a676e01b51866c16a0b900697479a
SHA512 f2d71de1f989394d8f5384cd8c93baa9e19a8d0610ff1ba3c2413516b9a7053614bc6bd42ac57796178dc348a477c7ae77a3bec2879fe0531f8b733e9c1be70b
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyuU743TvRk6NwG:J/ezSC6vUzPveHjyWDv66mG
TLSH
T1D5755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 54b9334e10f5e3181efddd039b10c4b0cd05c12015f5df406e882c55bab7a806
MD5 866914f0d4d130a96cc53863ace5cc65
SHA1 06f7e5879e8d59b1f480495dc6efa9b296a5c38c
SHA512 8bdcce871b9bc40e645730879140aacd240be04a759ad2be2a0089fcdf9d8db2a9255e19deb63ac4f8c76f2684264aadf1154e1739ed212fc13dbfd72985d395
SSDEEP 12288:hVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98wXI7vgbrWVQhTCYHvRktx/aICFu:hVbqPb88hv/l+Yr743TvRk6NwG
TLSH
T1E8559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1918df7e3ada0d3d7a766924d4e48b2cea1beddbba18a2ea4966583e6f4e13af
MD5 2313d4ba08e27c3bebe880e8dd662118
SHA1 b829839071b7ca2c587effcc96385c0caef24062
SHA512 d4e0307f0a8055046577ef7e3bfe3d56c49729dfe1cbc4796fd2644767cdc61336392bffb5d258d524299fd8cfcfb0828af8b16af2b8217efb438a2bd8e98667
SSDEEP 12288:tLhXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:tLq743TvRk6NwG
TLSH
T10C4523087394010DE7B3BDBAE889E0C390A3BF6499C59CCED269FDA558BC1D0E75570A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 407b10e4e50fff327ccb8ea3780636ae8df901932fdeeb22d55468c9c2c5f36e
MD5 1ae209825662ae452e1a834b9aed18b8
SHA1 78716787f30de7f5015cde325bbb895d424bbce4
SHA512 75730766499bc546a94685c823029a1f4242fcc3039c190bfd5bef8b754a9959d6e043c0849c0c56da4045782edc32328b166c1fb162e95dd1e31a33780119ee
SSDEEP 12288:CeBNUbTVO86U4XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:CJIUD743TvRk6NwG
TLSH
T1F265CF3BEE28ECD2C27A9DB95A91C240D77278304F52A3CBD165C20EDE235E05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 df74d647f7022665546fc1905404aaa07334af83ca3fc4a9129b5d0609713213
MD5 d05096cad447e0807390889ccd950225
SHA1 8b10e5d78a579c0dd6c6e25380cec3d083d79af5
SHA512 5571c44777d0eaa5801bb15f1fe6ff17e6f234e9e25f1593c99433c5dd0a74d7cd2085c5c12d47bf332b5b344293097207bfd7c7ab0b1ae43f688d105ecc16ad
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:kQvGAdlCEL8c/DRNw5C5Dv6V
TLSH
T13C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9b270012f886e3246c61e3c5a485b487b92ac0c21b16617f5ff280d1c17a6ee8
MD5 0db98da15daef4e7b01ecd92c0917bc1
SHA1 9370024a0960773f761efd65afc334ed55427578
SHA512 de99202749043425eb3ce6e88fe2d09b2090a46ed7ccedeb370f31815b98c4c55a7a90252e54e881a6a514f33053fae0866b1f1999eeb630966bb047b69569fb
SSDEEP 12288:xAwSfxL/2Dc3RDLLmt0LDQewsAj+XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0Q:S0ewsAjp743TvRk6NwG
TLSH
T19775E030FB74D036C3BB0DB61B26C716546DBA204B911AC3E3A89E9D59742D22376F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 97e8f26678799a684cb7a7b907d6f68166d9e83f6aa0798a181df2de26136708
MD5 61112854317bcffc6ad43b390fa93240
SHA1 1a2f64f29c18b73a32f83bf991ce2f4fc9d4ec7a
SHA512 87e99ce34e0771e5716857cf0e0a149032974a56da8be48d1b89461489065a41cd1993e8fe1c5832f5c7aec3e6c6d38095b3be20395ea79a1ffd57d27d2f6fd3
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHaD6:tUEtQevvqc2W1cpV2tI32
TLSH
T1C2474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5f18253aecf90e1deff0d78e75f18cdfe003571b96fe973957e3c70dfdeca6c3
MD5 c7d3f2755957eb7e8ab11dc1ec5ced75
SHA1 6e10fdbb2eab26572dff739da68ff7ae029a387e
SHA512 9f6bdc15b9b3428d1a6fcddde8da21f9dccb7e5fca1f014ad22e905b5befa81d54e3a87d4cc2a861bcdd01de94e9f6237b98519e19052c8a04fed766c120ca66
SSDEEP 49152:9CbRquA/m2yL5zifFiV+XenmE3/zSDv66mG:6oqHVjnmdDv6V
TLSH
T129D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f938b04ad8efc36dad63cb77626e0ae695d09bc10546e8be2f4892a77cf34510
MD5 9bcd72f1859a68ec2906e30e8cdaea5c
SHA1 5e923ce264bc35fcffdd69cf4d9da861a3c1d973
SHA512 eb9c531fe77ee22368e138f949c1bf6691087f869c705f5607f99551d64793cf5220ba970f782512790eecabc594140d047131c6be1e354dd7870b32198ec51a
SSDEEP 12288:+AZ/GL3IFoiwtA5qy97S9uaYFLq3OkXI7vgbrWVQhTCYHvRktx/aICF9flefuKaM:+AhGL3IFoiwtA5l7S53g743TvRk6NwG
TLSH
T1D3359D80E7F945D4F5F3AAB899B69171EA76BCA65E31C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 37eaefda318789e300d27ba44fd3a0894f0d949cb61ae8826e748bf79be45d8d
MD5 5b3e053a423557d2008b408285570f28
SHA1 f48548532d9b808761b3c298a75f7ba36fa3d7b6
SHA512 fc8b27d26c079b90a39480843241916363c3a4e9f127af3387f764f7d974160fbfc1399990aac581841c35d7da0e4b6fa70a1eb335e774ddcc4908ad4b95c858
SSDEEP 12288:hmw5HEjsChNVBFgl0WDm+CTXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:8wu4OWV743TvRk6NwG
TLSH
T1B965F14973A40CF9E9B39639C597C132E7F2B8112A61DB1F1760C65B5F37260AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 26b360ba1f2604ffb55a7727fa82eb5591d5c848c894f03cfec95ee7c9429094
MD5 7079c51faa5036030789bd228e509f43
SHA1 d33fb3559bc8515cf43ffd196829f158a00dbec9
SHA512 bcab4cdc0edb0301913442684121dac7b302f46ef3b30938aa09c7dbb0e8f33d873c5ef903c50bfae53e8dc8efdd1491aed41b79c5d95b896389cf84d8459438
SSDEEP 12288:GeZ1IyOXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:bZuu743TvRk6NwG
TLSH
T1D355235933E410FDE2B3A67DCCE59282D3B37862677287CF122486A51F766C05E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 66be4d5b19dc5ed9bcb1a3e42bc12e9486ffb49a15d331520faed53b0829ce90
MD5 3b7de6dd7ad97076d8c9f3c946a02cc9
SHA1 a9dc833677aca4b7c3fc25d4f09fc80dd32d8e36
SHA512 9f3e0d02357abc7a2c8b6e7a17d8991006f761ce062d3cd7a1c5ad1172ae138259062a49d8e4b04abd7eaac40d21f4c4fb482119683ce56468ced30dcae8698a
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:7QRQyi36YOcPbLvw2gAf+PN3MDv6V
TLSH
T1D8667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 747807411a64e072249e3437820694fa3566ae6dd329e78e7bee4cc4501e747e
MD5 6b50d1d376776c29d99e00bc9dd0cccb
SHA1 d7dca0402577c138bff91458f133ec6f5ded8173
SHA512 56e49e956b4c1e5ff13965fa4336267e47279fa054726a8aa96678557e93a547f65d9d57905657bc459e2ec479fff48b1b5169e29a6f6069783c3eb18ee89685
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:xQRQyi36YOcPbLvw2gAf+PN3MDv6V
TLSH
T168667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d377da6355641ba9980a56fa59229025ce891f77882ab16e82340070f6a1c293
MD5 e93ec731e4fbf098563b448c8f2844f7
SHA1 0f952b7502f9a858ab6fb3d83225e0a9382aaed9
SHA512 87af8d42fab84c8330624e16dca04aefc64a11ba3240f6778632f5daea093d7d5c9b40407dad6ed16f1edd66ae0fa640ac9e4aaae95be77a5a56dd5fcd8e3445
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0+743TvRk6NwG:A68Qg55nhceWu7PNU3/CDv66mG
TLSH
T1EEB55933B2F200A9C45DE1769F4A873196D27C758FE0E7DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bc0f196fc6480f408c83000b59224ab11a33c97ac2b05d14ff7976efdbba7402
MD5 793781dfbb4fdd185d7ff3d79346ea8e
SHA1 6e0a6d3b30be7d12292aec16e9e3902c7433912c
SHA512 b1fcd028a78a8b75728b82d735a449012b2672775768ca327e4405dfcfcdcd677e997618ce96493d9b9844b4365f0dd9cf35cac9085ea7c84e05a8d1f5535763
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:7y5112gYy5azzVvt69nLKnhZDDv6V
TLSH
T1CC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 743ad63fb5f5a105754f6cdb54c98f293c0dcb64f38b93adac8234b8087694f0
MD5 f05229daf965bb41e689b3552b1aa4b2
SHA1 05ec278c98bbfa1d5e18242bc8e04a06d68dec9f
SHA512 9d756faac548db0b3b0017d4cd6646cb85ed3e15f9a5b5c53075c52b9d3b1cbb08b04014b8ad7c22c7ddbf84f3136e03bd0729965883969ee4fa40c72a48e4d3
SSDEEP 49152:WB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl6Dv66mG:ku6Jmdxd2d6Dv6V
TLSH
T133D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f1a0fa71bf74daae91019aabca636813d59325befedbedd938093ce3892e0c6b
MD5 49ee71c5bb4dbff42f931b04e17cc3c6
SHA1 4cf749e8d8c72cc8f8689fa7cb36c231a3386878
SHA512 59e82b7a32e78c03f3b79d03b047da8be73a067806e52be9069a5e990a4fd7cb4cfe38c4d05542166ad0592e68a93711679f99d0452c945ffacbb40ec67eb477
SSDEEP 24576:lhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3T743TvRk6NwG:v1hpsNoJpF1A63U44CwH7R4xYDv66mG
TLSH
T1FAB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f69d041d0729159697679e2aa99c862744467f3f637baf2a2d2d8713d2bbda85
MD5 92dbad7748233605e4b30549ca89c173
SHA1 0068df9502c705becb107127a6baf3e1fc4032b8
SHA512 2c30f4f7d41cc55582a610e10660c98c390070bff74cd39d2efd759d6c5a54a88098eb3fc61eaf627232d612b43e1431aa8285d8be141b60fd0357ec1d978544
SSDEEP 49152:ZSuZQIY0Be2KcRVtOnks6NMHqPDv66mG:35dKii61PDv6V
TLSH
T1A3C5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 482bb8c7d1192b0b394505f696a0ac613396e44830c3656a7bef34b754e0a89f
MD5 9f905db4d0fdf0c0de8d25f5bcc80a9e
SHA1 3cde876230b907c6708124385d098f61afaaad0a
SHA512 b1c45f4ecbaf806f726977079addd5130dd109dcc3f7645109640ad93c7f4582ab94d207c84d0744e8a4eae27271efe774096111dcd43db5529fd2c12d1eaff0
SSDEEP 24576:HhiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QLT743TvRk6NwG:HhtSn8EApI0fig3giDn0AP5wUDv66mG
TLSH
T1BD95BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 011cebf8a6b6e75b10372c0fc7c269cb6c05df1aaf539173375188b7b44a6883
MD5 d2334288a357e73f5b75af2cbddaceb8
SHA1 5cb4242e65dbd66b7a95721cd7e90f0fabd35a1b
SHA512 66fe32f172e1b45d72c497151b881f56d2938cbf10c5e5ec1a07a31da2c6ef9e63e33880bf07e7a211c8d7564f090925b8488b149b1e3194427b727f6b4a6f93
SSDEEP 12288:1JXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:1i743TvRk6NwG
TLSH
T1D94523087396020DE273B9FAD88991C39093BB66FAC65CDEE36DEC2159BC1D06755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6f3c9e4cf1fe96a0a5f80fece0cc974fc1bf461367ccee8188ea9300b1156474
MD5 9b16398a112f0ab8cf27414b053a037c
SHA1 01033788e15a006550781a581e0504c465ac6bdf
SHA512 c3f193a43fed1a3f8a625afccb5355b9c3a27bdfd3437b309c0172f22a0a94659218ea41ab211fa778c517846d8c0c285b1117f4547838c136227d3829d77924
SSDEEP 12288:kyXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:k9743TvRk6NwG
TLSH
T1534523087396020ED273B9FAD88991C2D093BF66BAC25CDEA76DEC2159BC1D06755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cb563dcb88d17adae9031cf12a6e99cc6e8a783dd4e9e96839f7192dd152b372
MD5 fb549af36191c16957c94c35aa456404
SHA1 a4d3e9cbadbb3955c61b214bb9a61246deed7bf3
SHA512 cde418ded6ab66c337f562ce86b727b6d8ae39c7fb46c57e7b81ce83d92d4b832e943fc9681611d404502b22a54bd94008e62c6c7803b337218934d1ba6cacf0
SSDEEP 12288:vgXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:v7743TvRk6NwG
TLSH
T1204533087396010DD2B3B9FAD48991C2D093BB66BAC65CCFE75EEC2059BC1D06755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d97bbe11674f1eab857137816f8ba93b2e8fec7d84d698816a69e36bd43a19b5
MD5 c6953841f563597526c0a856e877bfac
SHA1 22b02fd1ea26d8dc0bd7032b70e2cd52b8be64ff
SHA512 b86841d556dd0b9dc7fc733a4d6f96c61f1d985f7a68b34a53af160fc227377b0d23d3bac85c1a3de8de48905238821729a00f24b02b89c7618160020417990d
SSDEEP 12288:BVfXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:E743TvRk6NwG
TLSH
T1B845230433A9018DD4B3F6B9C89591C2D1B3BFA5EBA29EDF97149C650DB83D06A34F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d41668f31753bc0f78f2807d334e8f700f1c09cfd1632f1f0e07226c867cc3e7
MD5 275d3f28acf15efd8a86fa38b773f1f7
SHA1 0f3cbb9c56d0d814ba3c5076cbe9f1823b8fda73
SHA512 e4dea2efe0c0df5dc59520f57f46e5c4fc6bbc2266ca5483bdbebe4e65bbdc0e60b2ccffed54fd0046ac93640e4f453d087d7cdf44b8acb7270170b3e55e0105
SSDEEP 12288:yXXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:yo743TvRk6NwG
TLSH
T11C4533087396020DD273B9FAC88991C2D093BB66BAC65CDFE75EEC2059BC1D06759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d28a6b06a4cdf30cfc636cece2fe8b2c07b4f67e07883ca43977ea1b88a0d4bb
MD5 0213d978934d13983005f554d69c14ab
SHA1 f210bf29c4d728675d7489d623acadb7a6f372b5
SHA512 62424378dad865d48a6d280a7e2c785cc0dc382349e389a769f18a7a1d082957ddbdbedb6cea74411d4ca66bca5d270e99eb4e752e61e3b121dfa22af8dc27b7
SSDEEP 12288:qmXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:qh743TvRk6NwG
TLSH
T17A4533087396020DD273B9FAC88891C2D093BF66BAC25CDFA75EEC2159BC1D06755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 466a18e897f525dca95fd22f15a6ed25dd2dc2186b5ddca7acff1fe1d8c26294
MD5 d74fbcadf492748967b5854470c141ba
SHA1 65266b1d308a54962307c9e283fef4001666592f
SHA512 f0035bfc88ed6d1cc686b9f29243700a159f627177a4787fb3810ae78e5c81accab6d836d2b16a7cbc003ec7ccbfa4d776c12fb049d0749d32dbb6d7e9a5b68b
SSDEEP 12288:aKXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:al743TvRk6NwG
TLSH
T1034523187396020DD273B9FAD88891C28093BF66EAC65CDFE76DEC2069BC1D06755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8a0ee37032bb99339f4889e687132289703b057af719031801c1dac969ba0f02
MD5 0ce4411b65fe9f13b559211ad7e741da
SHA1 52b5758ef2f5903e2b8b02a179292c7136c88ec5
SHA512 ad2cc35594957607279b7a572c9f32dc6ae94d182dd3e52246df9fc76d164f190a2d6a62a0d162203c894b88c90b4836bc2f1f906342591b77f03d31ab3fbf77
SSDEEP 12288:2iZwbVzzFEoS2cPvySXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:5ZMRzFVSOd743TvRk6NwG
TLSH
T16A650194B39008F8EC73817EC8558946D2B27C5A4BA0CA5F13B836665F773A01D3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 75cb847b8c322e1d16301282c8849386d5edee60fdd1325c6da7ded8f7a25a78
MD5 e7d69b48095dd948d1180df87f72c80e
SHA1 afb4f557612ddd077afa38984418e7a6861a9a4d
SHA512 17fa7e5ec0165b1c8772efab38a41aff20d81a04f37d7108127aac1d19e0812e3737008f8da59688a6bb517335442a8d8d9e853f69787448094fac79ca815117
SSDEEP 12288:YlXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Ye743TvRk6NwG
TLSH
T1314523087396010DE273B9FAD48991C28093BF6ABAC65CDFE75EEC2059BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7ccfd456c703e9f906f150414707ea1da8dda77b11dcc06f277d07acab57d42f
MD5 c4b29718dccaf09ed18a482d560f089f
SHA1 91bf2f9f30cbefe9bc5b14c37289d96c84c5f759
SHA512 ac72ffdca4ae5c34e83efbb18692ee72b17a26ba9b36ed4155f0cae9ca53a7e30d9da0f58c2601c1e3d04a73022d1cfec88e7011ecdbe799b637752f280dd342
SSDEEP 12288:WxXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Wa743TvRk6NwG
TLSH
T1A84523187396020DD273B9FAD48891C28093BB66BAC65CCFE76DEC2169BC1D06755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ffeb7e6bb3686fc1a55d3a5d976dbd756a30b6705ce1773f7ac0055eb3b99e6a
MD5 c020259a14d5e70ac62396755a8d376b
SHA1 134e6181357d2c2902658a65e7185403304d0e3c
SHA512 c973d8e121efca1ee957d76d18ad98e971455136c45c6c8cb22cbfa768303ded416ca4233ad04515907409f06a6fb68aaaf9e17c1df5c0182e385ec24e07f697
SSDEEP 12288:WyPz5L8OXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:rzyZ743TvRk6NwG
TLSH
T1FA55020773A520FDD1739279C8925682F372B8365B608EEF536446762E772D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e6b8a6adb1e3220ed1d9425057b6293083aaad7f5bd44f1ca0cc5f1456c48cfb
MD5 56e24590bb170a6387328ba834d5f986
SHA1 034fb227e7c91529fc8c05b90e23197d4e1df731
SHA512 4c1b64ef54d3ba288341f29c09ae66552385ae487e90a661c9a95bd13fad7ed3e562177dcc1bf6ab000ad39c9b8e86ce3909124939f89ba69bbbc3832598aaec
SSDEEP 12288:rlXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:re743TvRk6NwG
TLSH
T1A24523087396010DD273B9FAD88991C2C093BB66BAC65CCFE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 166b5d4fb3dfea57b58d38fc4c5cded913e583e4bba19274246565de5a19aae4
MD5 6cfbedc91c0ef819d7ee5285683f6c8f
SHA1 6e30b482a5a53ca0c42d303147c891f33627af1e
SHA512 40b6205d40420055cebd295bacc3d62f96922172d7a11ef6b28c54d04a553782f29128af669160cd8bb8465620e9726ffd5ed83f0861f60f06479148ddaa1d63
SSDEEP 12288:ClXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Ce743TvRk6NwG
TLSH
T1074523087396010DD273B9FAD88991C2C093BB6ABAC65CCEE75EEC2059BC1D46759B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 471c222898b25ea3e76ffd644d02e398fee30ff7a09412b3112e01de5c6796bb
MD5 e104c68eca7c17d3f891a5d04cb52a46
SHA1 73b28e5954626876924c51ec52735180a81ea57e
SHA512 06ede5f96814b022c8e9459399c5ed961947b3cd62b55a052d4b4a39a282294ec4e98c03f36ae438a7c05fee1aa754cedb6d7b7085b818eb3c6b7cb569330896
SSDEEP 12288:SyPz5L8OXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:PzyZ743TvRk6NwG
TLSH
T12855020773A520FDD1739279C8925682F372B83657608EEF53A446762E772D09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 685a41ef23ef7a9c05fd9df54589c6cd44fcc5eab7e02bdd31c1af1e4599128f
MD5 75c0929d1c3e137743da0af24a3d03aa
SHA1 93e3ef13848a85a3d093321e0507401744022ca2
SHA512 58ad48e17da74560a3615eadda2520785aac50b12800062f3324765b11ea1824f4343bcfb59f9b1c629f6dc71b849e0f0b4af4b6e307467e16b46d5c19405c2d
SSDEEP 12288:XCd9CWYoaLHF3z0z04PDvhQXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:STDaLl3z0zDL743TvRk6NwG
TLSH
T155650194B39008F8EC73857ECC558946D2B27C6A0BA0CA5F13A836665F773A01D3EF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 297cd31998acd9695b2927b7ef58522592d1d0f9f276074923b2fbce70e97c3f
MD5 52ac29aa61c7c854c8e306c686836300
SHA1 d2e497e1fcf7a3e55e18788b213a10b8be3ca210
SHA512 49507c5d6b8330ef8409ec7b1e3716e0435842f8acc1aa251f9d5e5e0551347370831063fae6e4068a3fd715e88dd3d88607c7be4d91394d28ddcf8ccba74cbc
SSDEEP 12288:si4e7KRdTfgwCHKy7GLbbdIvrXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:s3vd9CHKy7GZf743TvRk6NwG
TLSH
T15275CF90F3E410E8F0B39A35C8765512DAB67C5A5B61DE8F03A8651A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ab26a8bf17015ce5582f65ffab021936b7326ff714ea673a5f3d2069e24dacea
MD5 63604ec083e49419b09d24252c49d134
SHA1 6f46231d79f5a5269093f9eb140417d79d19a7f2
SHA512 4c5bf70332fbae5070b852ae86405902fd5b87f8b3dc0d00cf44c9b59300dd43a983ed10e59464a8711ef2fdc7603814022e5fb70317b83c2b5a7d7e2c73ede2
SSDEEP 12288:vAXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:vb743TvRk6NwG
TLSH
T1404533087396010DD273B9FAC88991C2D093BB66BAC65CDFE75EEC2059BC1D06755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 398a84fe41badc0d348777a7b80174a58bc82748a23f52dd51bbe5a6f569dc1e
MD5 f320fa6ef268e9b0b7ec62469f379102
SHA1 e9b5591137901efe7b80458bdeb7fd46628f1a25
SHA512 d05f2711564ccdb4fd8d5c8c633dbf8512211730cec74bbfe743621c2d5ab0b5598dd5f805d54e5157ecb122d5e698143e901ee42aa167a718c25661dd0b6c98
SSDEEP 12288:3uXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:35743TvRk6NwG
TLSH
T12F4533187396010DE273B9FAD88991C39093BF66EAC25CCEE76EEC2059BC1D06755B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5a72c1653fe34a6da9f5c9a70e64bd449c16e203e06471e9820b3b9ed833ce5c
MD5 c8858ad6458b2676370bb2e3a979c6de
SHA1 72fc075552eb0533858d0cfd0cf81347e9b502b5
SHA512 2aad43ecc880b05e67ad9101cfff53aa67a7aad6fcb09e709eac6ec16cbd04e0458202e26cfaf91fbec3401ecc18f9f3d6083c9fec54a5f70089ee1e3923ed5f
SSDEEP 12288:ErXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Ec743TvRk6NwG
TLSH
T1124523087396010DD273B9FAD48991C2D093BB6ABAC65CCFE75EEC2069BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 97f84debc95a083c73de6c089d9077766795741f550a47d180e63ded0f1b1486
MD5 98cd515c6ccbbba12efaa4349e927323
SHA1 ba51015081f2b6c25f276d25a818e2fa92a5c857
SHA512 ad23c3bd4b464e10f92efe52a8aaf641d22975f387d053e54f94e35a3f0a238ef87cf958cb150e411b81665c8060688fac7bc618a52620c8e9cc3818a13e8f39
SSDEEP 12288:hlXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:he743TvRk6NwG
TLSH
T1954523187396010DD273B9FAD48991C28093BB6ABAC65CCFE75EEC2059BC1D46759B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 43dd893f1982e75df0eafbcb0f75cc6caab3a71091bf1240add41ffe064a0585
MD5 9c928c82f01d54591fb8fc29e7829b6f
SHA1 7d083f8d340be31f223b42f06bcbc89f147100b7
SHA512 ccb9c2bb8780950d7ca6f2c4d4f04fe79d7ad623386897e0af8fc2273b020b0aec96d4f197ab80a6b54ffd4861ecf5b68c3f9a4d865c7efb3863b57db489669e
SSDEEP 12288:fAXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:fb743TvRk6NwG
TLSH
T1A24533087396010ED273B9FAD88991C2D093BB66BAC65CCFE76EEC2059BC1D06755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a398c752538623087094a34452228c3ee15530cbe767da3ceb525d7e4bbc0044
MD5 eeb7ea898dc02e0158d64c10cee6738d
SHA1 53af4b97d5baf6ed9738799099f48939b35946e9
SHA512 2ad9ae71590bebba32f000c6fda45e8eed3d355999a7fc75d586390df3fa34ded8c6cd34ae94c833408566ec20dfa69cf846a3e5d2ac3505fa7a8e5dbdbda807
SSDEEP 12288:Q9XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Qm743TvRk6NwG
TLSH
T1664523087396020DD273B9FAD88991C28097BF66BAC65CCEE76EEC2059BC1D46755B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 261d509ce2b572d32865e2cb942eff12b5a6e084cd9a63f3b2117fb2bfbbae24
MD5 5504cad70c90a51fdc2bf797ea4004ae
SHA1 18fa705125425ddc5b4645ea3a2e7ae0003cc295
SHA512 1b98ae3cd67cd1a0aeb9304402b96892f1cbf2edde1d9d4c232351e1870eb9e856cf916c1873d855eee76bb3351ae06815871613321f94118dae8b8c396b7a1c
SSDEEP 12288:1XXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:1o743TvRk6NwG
TLSH
T1464533087396020DD273B9FAC88991C2D093BB66BAC65CDFE76EEC2059BC1D06755B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e7c2a4d4322b508a296c28564917cfc569c10cc0fe7f390912c34a1bbceb5eeb
MD5 c6ee06884b4f60e43780708cd4a02bf2
SHA1 494f4902e08f64bbc3c5b7c20969b0511196dc7d
SHA512 ad2d34879d18b33dad88fa74c32ec1b5719885281830d2a0c192dc37facc2299c8d2f3407ab10a84ef6ad2d4ea0417ad4c81cd4f9337e00a006ab6bf32b9f47e
SSDEEP 12288:+fwvD5ur64Lk3tRX69qkyAI5DXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:+fwvUk9RX6wkyAIK743TvRk6NwG
TLSH
T1A585D029EBDC04E5E1B7923C89B7464AF2B178691B31C6CF029A536D0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 353bb2d0d3b996d71e05a3fab6f5d85732b317f827e3e99aa9fd0182192cfb95
MD5 b5176343c29c00c887c4c4b45e2e5e07
SHA1 5073ce2731be7f4f2f6627c025dcba01e5155366
SHA512 268dfcf3bd13718bfcdce336263239f1bb9984457d63518b95786baafc1892bd84f8f9aa1072c0acc12628722039634d13089888159195c782448716e67f745a
SSDEEP 49152:vYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Dv66mG:6ySzPsDv6V
TLSH
T1B8066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fda44406ea49b35052dcb798b263c924ddb4e39ceb4b9b5cae980b53c7dc90a7
MD5 c02cb6cbafdb6c9cbb358c42bfec96a1
SHA1 aec9af08784167c35c1b7457383ead8567254535
SHA512 788bfced10cdc1b977c5b710a88cbb841ba41349b20b92694b56eff0bcd751f5418e6a1d81cd4c156267e4008c145e1a780a000af37f3c5013475f800527130a
SSDEEP 24576:547Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYN743TvRk6NwG:547JUQjTirIhCnDHUPfF/kDv66mG
TLSH
T10C65AE1DA3EC01E5E1BA927885158A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 13ac0546d5844087189a71b0449ed7a0a24c83b6b6ef260eccc78c33c8e141d2
MD5 e9e90a2d83452a0d0e65d93d202edc12
SHA1 c769ec939eb8c80d0b87af8da42a0fc10a922485
SHA512 b1f61b3cc3044ae8772a827d90b2aa296065c6776486f81fe3fefc22a670d4f87182955c30226a20f658e942fb41ee424e9007773088249ebdaf3a59c0858967
SSDEEP 12288:xbsfVXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:Mu743TvRk6NwG
TLSH
T1B455F019E29802D8C06E6279CB458681B3737D2597E1D7CF52D0F93E1F792909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 51c1240d551d1a64f2a1e099618e3143d97ed8a0b33e66ce626402f793c4be48
MD5 cd114e5b72d3429f1d5750c966b144af
SHA1 e5837c66a57f8cd3fbc2bd5475c607440e2f5865
SHA512 2d00443f3154ced7d8a02cbb7d619fb0dc0f6275a695d1164845d2af437a1322768907c3b8f114d8e451fd176b0324eb35af7b2b37c9d78a9f3ac7a54c26f55f
SSDEEP 12288:YnyQimg9DU3fzoZMdozidyd/aHRen3RU0hlOQSGoGn//N35Bj3nmB:YnnimWDUPPqzidEUU6ClwGoK/V35BjX
TLSH
T127452700B626D78FC6A940321E76D6CCAB70BD41EE046F0773C9873FD476659B6B6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 ff2f9cb6aefcd4d8e55867642c9227bafda9253d26ccbd23b875b58987880ac0
MD5 514601131a4f461be0fe0b43efee1274
SHA1 0299f0597c67d9e29e9a372aff61e804c2a441d8
SHA512 05f63793919fad71ae33498a5937a362f8887b1217132b3fa883937e87a0b63b3442eab65a77abb1bdabbfa95fb8bea8f88afa2de1a14e1c699510ba79e01e77
SSDEEP 24576:dc6ZlKNhmsWhk8xPkV6h+nO3MSM1BgqXhgUs7+NvOU:/KNhmsWm8xPc0q1BzXhg5+NJ
TLSH
T1FA450A01F4A7E34FCA7A5077033686CDBB74AC03BB452B057385893C9467A5EB6E62D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b0b4d721ae51705d754e30e41798b8e575036cd7630f48c2b317c0cf65ec0b1f
MD5 0fd72af03e99b4821c0b1cbde6ca799a
SHA1 0daae9701f6b130a3ad0864c30ccd3c5d2bf184b
SHA512 25e13c5444e7381a67e6ab13c7be1876a81573e83a1f450670e57bb801e985800a0147168b3d389d9206ffe35c99c4d1e57c3c3ff101cab1b362d115314819af
SSDEEP 12288:9z7tXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:F2743TvRk6NwG
TLSH
T1524523147399050DE5B3BAB5C48DD1E2A01BBB759F809CCFE619E9A068BC1C0AF75B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 31d6f2c9f81eff6348f1524fc709b3356847fb6fb6f008d56ea58682c9a8f5b6
MD5 8c18b5f289c5d88bb368bec6ce35e8da
SHA1 986c9f48622a67155d9b3da57bc719c3e818c57a
SHA512 e5c375a503d2f757e5641d67cf99bd82ea001d13eec29d5fc55d1c58c667f21d057814c9f19704996b6c7cb3b8ea18b0ac8b7a93975a6def1eca74efc68693ac
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYU743TvRk6NwG:igb4mBIBhGFODv66mG
TLSH
T17765AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D6DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9013f72851835c69a30f6578e34b17d2c291e787c9dbc754d2f497843853a644
MD5 64a1d6a39419cb0d9a5890b78c332e11
SHA1 4d74f15587bb8c844a03307a460b2612276862f9
SHA512 6a0e8c201075144ba22f6c746ac1ee62a90f8b43a2416944cc5f217c819d9f310d523003b7532d20557a6edf00bb4b76839e174a0ab72345431e81a3d3bf7af8
SSDEEP 24576:QG88u8FpJqH1bzria7/md743TvRk6NwG:D7ZFPqVea7/xDv66mG
TLSH
T1A985F16577E102F4D477E138898646A3F6B2B8250364EFDF07AC8A511F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4982f6d1db072c151897d5c5c5d9ac51faf04fa12fc9a10174c85b6d0b8b8ecf
MD5 f4bc99b3fbdad9cc60698806cc8fc55a
SHA1 9f336b3d9af81c0c40ef7ea9b889495c36662a61
SHA512 85ca85e4c7ba10bdfb2b850fb2da103144c43ea2bde4de7d7d332e51f8c87a634492a4f238b546bd7024bd80ae77b839a4c868985a7d315bbc21f9fbd5b9c5d5
SSDEEP 12288:IHvUrBFrEjwaQ2XI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:IPUr+NQR743TvRk6NwG
TLSH
T13465E11E32ED08E9E677E17DC5868249E772B4621712D6CF02E0817E4E67AD8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 68aed8c4ed1700ea96a1331dc5ba10f459bd03c6a0f77d9ba69a9dc935afe1b5
MD5 d7970ca9cb216a56d2475529297f1751
SHA1 3381edc2b3d007eb54824ab77dfc5f59c9b75c32
SHA512 d541643b3a126d48c986c3cc8f288a0ca41e8379431405d880731aa4b66093336c664e3e123c7eee0d1ffc5e0689f8b02ad2d990683ad93d824c24abd897b698
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKDv66mG:DG05lO43brDv6V
TLSH
T1AFD5CF6E62EC01F9D1BBD17CD9C6860BEBB23415032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 47d3e9f47beba64b68751de0f71113564aeff868e29ee7b647fb0d442c7e2c9f
MD5 a4664e95b18fef1c45537cbd50ccce3c
SHA1 7be5ace77bf89377a26b6be98b7a600a4edbec7d
SHA512 65812e8bf4af51f90fa685a2be1f4aac779d89a246d79e179a493e01652eeceace97c98135d745f5414340ab373fb95fbdd25ca8fd27c827eb7f322fc3401de4
SSDEEP 24576:5fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnn743TvRk6NwG:pa5POZ3BJt2pasx2+mCDv66mG
TLSH
T13165AF5DA3FC01D5D5B9D17DC583861AE5B1342653329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bf8aab439220a3716d483be61f6f9377baf0bc5be22ad95c125609dc0e62632b
MD5 bc6fc589c3db4438be137e39f1ffb1cd
SHA1 8b3c8b33191ac70c9d752cd3273adb903de509e7
SHA512 e4ff47a64ef91544f4101bc8abbda9abfc5f4b4a759834ccc789a431fa6499177ffe919cef8ea34ddcce6b798290e9f6f0b448fde73b0685e36ae133e967ce03
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7Fk1743TvRk6NwG:3Nc/zEOVHFRDv66mG
TLSH
T150858B1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f5e00af8e68e9f9a4f0ad786758d880b8347d26373106aade8d5c725dbe7f360
MD5 0cc44dbabe04fab7754fd76c4083f626
SHA1 84f12a616d3f4c94085e64cbfd7aa61520410634
SHA512 c2d57e9059d181bec0ec463efd0d50e5eb6e1a8c603b76d280ee99645e790d41737a2a58c19eaccc28dcd0064aab15983b69ccf1b3795e2b6f3efc563498528d
SSDEEP 12288:EQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17AXI7vgbrWVQhTCh:ETkNvNnaFeYhJNtmZBmV743TvRk6NwG
TLSH
T1DD55AF2EB7B806E4D1FAC6B5CD238512E6727461173293CF5290C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cbb19bab4d9a40d5ca8a831bf8536164bb59a77c0670bff1e1860c403a98a4a2
MD5 1e6824126979dfe8a96949a79f64865d
SHA1 2d0ecf39e7c48bf12b0d32503529568748b96be8
SHA512 c61a925bc8d0af97a2c7b8dd079e1f0bc96170bc01098b23b94f34651e1d6cc380466c5350a3d8ab733071eb766d6fb0475d282a0a7f83f27e07bd96c9422cbb
SSDEEP 12288:sQcMxWDXN1Dp/fshBItT1IQgApXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:WD3FHshBIYQgAC743TvRk6NwG
TLSH
T10175E13DE79C04E4E57BD1BCDA538606E67238A9032269CB0294C1B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-77-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1180-298-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1180-71-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1180-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1444-332-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1444-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1444-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1444-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1444-93-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1444-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1484-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1484-283-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1484-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1484-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1544-45-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1544-7-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1544-0-0x0000000140000000-0x00000001405E5000-memory.dmp

Download

memory/1544-1-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1544-51-0x0000000140000000-0x00000001405E5000-memory.dmp

Download

memory/2376-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2376-125-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2376-119-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2376-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3064-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3064-39-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3064-54-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3064-49-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3064-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3064-48-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4104-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4104-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4104-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4104-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4420-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4420-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4420-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4464-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4464-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4464-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4464-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4464-136-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4832-82-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/4832-87-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/4832-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4832-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5052-22-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5052-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5052-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5052-14-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/6036-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6036-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6036-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6036-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6036-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6036-317-0x0000000000790000-0x00000000007F0000-memory.dmp

Download