8f3639561c60efb376d1939536c62b2b56dec03edd4189ea844c4dc9a4cda763

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe
Size 6.1MB
Sample260717-vmt6fab16x
SHA256 8f3639561c60efb376d1939536c62b2b56dec03edd4189ea844c4dc9a4cda763
MD5 50c2f7f796235599ba026c96cc3c9171
SHA1 6cf87272a6583cb2640ebda84e03095f582173d1
SHA512 6ffba6a70b195438549eb36d9bcdd086099e4ea4de267e22a6a1e440f53984d10e82c56a41a36f686447994a5fd51db37f46d0764631c256b11f40a7daee0c47
SSDEEP 49152:Fv4Pf5rdH/yEmm64ZA5xRnz9Fu6k8TtkVdmqn1EtwcPgPfxqSHNN0CGeF6E0osTg:MwkM4J3H3Yj2aMK9SPn0yU023W
TLSH
T11B5629167AABA8ECC199C874834A4A731E2170DB1727B9FF41C485353FA9AB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4448	elevation_service.exe
3232	elevation_service.exe
628	maintenanceservice.exe
1432	OSE.EXE
4700	PerceptionSimulationService.exe
4996	perfhost.exe
4788	ReFsDedupSvc.exe
1528	SensorDataService.exe
3240	ssh-agent.exe
1832	AgentService.exe
5184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\194086aec618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be2813fb0e16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000934cb2b80e16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074158efb0e16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a00d08b90e16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000721fe0b90e16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1348	2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe
Token: SeTakeOwnershipPrivilege	4448	elevation_service.exe
Token: SeBackupPrivilege	4788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4788	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1832	AgentService.exe
Token: 33	5184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5184	SearchIndexer.exe
Token: SeDebugPrivilege	4448	elevation_service.exe
Token: SeDebugPrivilege	3232	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 4536	5184	SearchIndexer.exe	101
PID 5184 wrote to memory of 5744	5184	SearchIndexer.exe	102
PID 5184 wrote to memory of 5020	5184	SearchIndexer.exe	103
PID 5184 wrote to memory of 5796	5184	SearchIndexer.exe	104
PID 5184 wrote to memory of 4228	5184	SearchIndexer.exe	106
PID 5184 wrote to memory of 2828	5184	SearchIndexer.exe	107
PID 5184 wrote to memory of 4116	5184	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_50c2f7f796235599ba026c96cc3c9171_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:628

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1528

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8d868ebbb0e6d716ea0832febe223c212891277f5a0cd0f75ce98d91cd5a579c
MD5 36979f5100392ea9f89a6aef8b62e84c
SHA1 98f1a31158a74da10c8fa45b4ec45a125c3e7667
SHA512 c34a953f926732122b8880a4b2e47025f91d8d91f788c4cbb3643a2384b7f093df4e23975a67a82e67dba56915a5e66b134a1f23fc24283ed273a9f8477e652f
SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnre30jaNf1TWbdz:t3q6sjB6U023W
TLSH
T10ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1a94ef5e29efb27cc64de916fa8c546bfbb7fe12f9f3effbddd36b6e2cf43db1
MD5 a3b15bbe5701b91b6f3e9a38ec59e4d4
SHA1 a31bf62a85baf88277893b066458d17e004847b6
SHA512 37b4fda88e9bac7360115f8d7beb742c5774604505898691b8173f4ca09f03964ff7aa57cf68f45ab040ab0f7bf13dc108d28e9b7926703cb390923217c68a2d
SSDEEP 24576:GXYfDtczAwgXe4i7ojhsP5Lgrk1TWb4AN5:ltcIe30jaNf1TWbdz
TLSH
T18665F12877D409F9ED678278C8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0b1c79291c05c875ceeaff69663b254b2b9678b84ba626c935c7d28a8303589d
MD5 9853aecfba0d0845e8567b021e6e1df2
SHA1 164d646921db0e51d59cc549597381f3be27cfb9
SHA512 9d26a14274c1da0395694ac6497a8d6c5f4ad65b97efebe58887e00a291359bd4afe33a4278f8a5d095c24b1a2acd0df00e5948e21fd4533618ecf09abdc4088
SSDEEP 24576:80Le5ji0hmxxrMTgXe4i7ojhsP5Lgrk1TWb4AN5:8Pji0Aj5e30jaNf1TWbdz
TLSH
T1A585AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0c30e57530bc714921e972ea0c7532bab584516f3e732dd45f8d02dd89289713
MD5 34dd603ad0df621fb517715ba977f577
SHA1 0789d279915eff4d048efbf69ebf603574727785
SHA512 76908f6d45e42738ca6c4ddce9e35679058203c7c4b52829b83637fed861c008a4ed8c04b7a80edcc1b68bba8dc6b0cb4d0e5510f00a157ab4f52a9238206ce3
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyu9gXe4i7ojhsP5Lgrk1TWb4AN5:a/ezSC6vUzPveHjy9e30jaNf1TWbdz
TLSH
T1C5756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dcbff801b88019fbe0afda3010c7282660088687ba3f2a5336e185e19ca14962
MD5 061261afc4603ee20103a9207aedaffe
SHA1 33f2138de518d590394a3e6341f8655f8001fa70
SHA512 84099aa3e3a4eb0f4fc0ee8af2b1c406966c7d8961c74d59d9e997d0fa3d1d01dfa937cdebedf47b9b25121cc8cf861f3ab215a57ac2c132119651e49baa3d6d
SSDEEP 24576:iVbqPb88hv/l+YsgXe4i7ojhsP5Lgrk1TWb4AN5:iVO88hXl+ge30jaNf1TWbdz
TLSH
T138559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e06c859e58a9c4cd991560134a0caad3826564d661548575d337cec0f4361006
MD5 9b5c757c47c468a4d0fe7941cb013c43
SHA1 3668f1fefd73e8003c32a97fd6f06de883c747c9
SHA512 46cd955ba55e4167018e8e7ca1bee88ba0575f351a80903da929896afe19561ec5ef75c668d8fcc023380c7ee4f090cc8d5f7ec112111454854996860a4bc127
SSDEEP 12288:ELm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EL/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1824523929F5449C6E38BC3F4A0F7CB91E9B11EC071444E6B47E0BE931CBC89ADAD8059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fdddc02c5f7e46694453ab2ab025622640e7a4778c49d5404326ffbe6ee3cee8
MD5 cea4f2216fde57a792d967049c0429ec
SHA1 08c8fefe4d54775167e2a01a8760e1fb23f61f69
SHA512 892c3de0af9b928e86fa3f0e2857013810f09b2c72d29eadcb5febcb82a4e540ee230cbf61d98afa1070a85a7142157e15079c7a39ccd7ccb1e98dfee957a249
SSDEEP 12288:reBNUbTVO86UH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rJIUUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19665CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 501f496f5154bb4fb0903a21259071e07ff70f9f411ca16e5300a681be213d96
MD5 10416bb021a971dc289a38e038638cbf
SHA1 b399e34fc0eaf6ad016601b569b82013f4e1791a
SHA512 8e16bd8844131193af40ffec349e8bd9755c9ed8a0ce5650e6fe213e47c446ead1181b5850bc051df2de2c4e62c9cafe279e3a650491b46a4a50aaf6da34e058
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:wQvGAdlCEL8c/DRNw5CoU023W
TLSH
T107267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e9b5ff6d04ec61eb4143f8fb9ddd73f8f91eec03424b878337cb0d9bd72270aa
MD5 8bb8b29b0ec60d7f7779474c35917860
SHA1 e2fdde134923f3ac15bd6c156e95e94200eaf8b4
SHA512 b24f6fee23e3dda89d30cc89513a973bf3bb3fe6d13bf943131418528d471fa7f76784e8b74a6422d529337b56366f620e6a3ca8d0219a4223b93c875c032669
SSDEEP 24576:60ewsAjGgXe4i7ojhsP5Lgrk1TWb4AN5:bljJe30jaNf1TWbdz
TLSH
T1B175E031FE74E032C3BB0DB21B76C706587C6A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4958e1d40fb1517c250a51f627321265e4b3450ff64b0843567c8eae72ba9728
MD5 d17b90b7d0f919f662d37cab641f1e1e
SHA1 56201f78c86408f8fbf913d4eccb12796e866189
SHA512 6d92af929072cfabcdbe7bf5e9edf69e7ce1a99457a75fee37db93450586651a9f20474c3a5e790da52e4ee3401f2cf3cb06555549a425ac04ce5d579c13f396
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHxp4W:CUEtQevvqc2W1cpV2tI32z4W
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7e7ff00ec92e5dde73fee62f324b1f30bad1db0e2ea0aae0df71e5ce00441b8f
MD5 c766ffa29c865b2c2ee6186c1a9e7aaf
SHA1 c17dbe9f26c6deca9366355f01f656955e91c5ce
SHA512 1dc3cf3619e074837c2efa87f192a04470c72fb93bd3a78036d646f625d15aa1809a207524af8467416385ba0371883759d7b4c11dc003a7d71251d684c9b002
SSDEEP 49152:+CbRquA/m2yL5zTfFiV+XenmE3/zpe30jaNf1TWbdz:zoquVjnmMU023W
TLSH
T154D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b2f2ed6914320cffef5562ae525b5ce6c067a63f4ad854e7fdd1a8e005b3d019
MD5 b065a1740e5d86309e5c06de81c25f96
SHA1 d5f38d23abd588b92e148384403eb176d90f1d05
SHA512 6513cd59bbbc81b280e99a7cef326451af32b610f01e679cd2ac42acb01e166b57811c58655b87bd854569bd99806be69666378af139d855d5987f32470fd9c9
SSDEEP 24576:fAhGL3IFoiwtA5l7S53RgXe4i7ojhsP5Lgrk1TWb4AN5:fAMUFoiq5ce30jaNf1TWbdz
TLSH
T165359D81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5e093194e142d37fa793f094a575d943b0889cec17adebf538f6b88b2d588657
MD5 76f659a18680e027c41e947b1bf62b8e
SHA1 4e8aad3ca23c8aac2513ecd6ec1328058ea569f2
SHA512 a2c032497a4cc405f3fadb184b79e01171df996fa06d47fc361db6ba5af621f3e3b6f046a6dfb8649367464aed9b760a015ca7416c1be04c402be87a27992d85
SSDEEP 12288:Bmw5HEjsChNVBFgl0WDm+Cc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:cwu4OWagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18A65F14676A40CF9E5A78278C597C636F7F2BC412A21CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fc5c132d03fab6d6c69620c0cfedb2a3c4ac956cf466753b948afeb2e0c9333d
MD5 ff81e75691e452c88ef9dc7cfb585112
SHA1 7653e920786e871f2f6bfa5b35cdd703498f279c
SHA512 d296720e674b5c5638750ccde695d33e8820f2aa54339a483fb22d27483125283eca88ffc46427e5857e2a64feebd8a28ba54a5483f3353a2eea66bcfe677f74
SSDEEP 12288:WeZ1Iyp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LZu7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18455129637E421F9E2978278D4F68741E7B23C82233147CF02A096A61F76DD65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4f3886b52e87385c625b8d7c8103e68547f2ca3dc3e4c119f3dfe32ff2972b5e
MD5 9966c8b536f986f649f9338b4ded2196
SHA1 a8835f339ebb6e6d8a180bf272e2eb834445f143
SHA512 be3876757851f13463f9df1a8ebdcaf230cdeffb9f0fe9bf338ffc69991ea46182b7ad70c8c860780c839cdbd4b92fa3a492a38c7b9934020bad4bca8b52425b
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:oQRQyi36YOcPbLvw2gAf+PN3vU023W
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e6b0d14d6a2e6a621386fa9d6f70a252e309708185ecec82fdf0222aaf43c745
MD5 4926efc1536b807a5d7358f01324a78c
SHA1 0897f508583307c68bffd8f8b94253e7e2cce7fd
SHA512 76b7a2c92d7a3e44dad26713fc6d284f9361980c008ea372b9ad756c75e32af64ebbe682b4ef2c54ced3bd1effb560f2c975207d6f96dea7eb75c7d41007fe56
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:QQRQyi36YOcPbLvw2gAf+PN3vU023W
TLSH
T1EC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1e7e81cd0f66201825af54882340e00aa156aadea7c5b2737b2ed7a6c25a3ebd
MD5 d35cd877f3dc5ac9fadef488e1db91e1
SHA1 7294a7426ab5d82b10fd102905bfeeba4160c024
SHA512 cb826ae84df78c99281de66cc3098ab7bd56fa239552910ae92f4963eb6f4f9079c3937e811bf6f3421453d45da481f69ae6a0e4f5a7f67c7826de5621e8ee99
SSDEEP 49152:s68Qg55nhceWu7PNU3/5e30jaNf1TWbdz:mthLRc/5U023W
TLSH
T175B55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1fd1139053b1e2b0798ce6e4c27f0c4b5d3e058c39109418b61430ec9eefabd1
MD5 893708a4e0b8f7e7a66011e61937f042
SHA1 989a62ee874523b6a0077943cf718bde508cfda2
SHA512 912bd7be76fddef67a0a262f6bccf68444270e9c50eec31bbe4cfa5008b4d398ea218e233fc990ebdbfa484cb4aa1b9436b35154c217138585d06d8f6fd62620
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99D:uy5112gYy5azzVvt69nLKnhZWU023W
TLSH
T1F3168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a727b59840ddc9fa172b5cc025f78a221c720c5a1efb54cccc51a329d78334b2
MD5 e8193c32fcc02b14d03d40f0e33f496c
SHA1 acaa84bf9635ac78d9fa077223bbca5e36608a8d
SHA512 b46e565ffbc29eb37667c10d5304ede0674e0eab471b6a39615fce04f8b9ec5019378b4231f3cfcab85f806ec36d184ed310f1633d092d7a2f2a1fc317255c16
SSDEEP 49152:nB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glWe30jaNf1TWbdz:pu6Jmdxd2dWU023W
TLSH
T13ED59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1295563c6da766043ca6400a69d344f04c41c06b2856bff6439b84e988fa5a6d
MD5 26547c9c8befbd7fa78ccf381a605c48
SHA1 51c3e0937ed1402a76ceb46632c03f44eb6908fe
SHA512 32da3f0baf8da179edf2a5354a881f8516da5b2656b99c73ef757a598725ae45b39968f00aae30ce0197cfc6a0a9f984ecf176c53dc53c8c75204acd129b61a6
SSDEEP 49152:71hpsNoJpF1A63U44CwH7R4x7e30jaNf1TWbdz:7mifPWRMU023W
TLSH
T15DB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cd7817c52643ce14e6d3de5e796430ae3340e2bdafd919ef1bf43ee88b5067fa
MD5 00476fcec953bc1096ecdbc524307ff5
SHA1 c67d0badfe90dadd7f314e8f65a25c1c43c824ff
SHA512 6c1e8c370aa91076f9e564c7ee818598fc0f611c66ae8b6c3067fa7a7619ac6c974dab7a7d98a0db51eae0895eb0a179514a495f65eb588cb94d737014a59ee8
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqie30jaNf1TWbdz:O5dKii61iU023W
TLSH
T1EBC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ee6e43b8c6f75034a9a955e1c8e85578a2014660ea20f4e7022d592247679a78
MD5 a46fc48996aa343904c6d1c11c1840ad
SHA1 e980e5e530ca0b9453565750260b15b888c6cb70
SHA512 005b4981a7a5d63e8aafa41acc75e1bf0a50dd635750a8fe0aa2e30f9aedb3843d6887ca981991971acd17e646e11714021e0186c61ad229a86022091b0a5e23
SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wXe30jaNf1TWbdz:4X2imphwU023W
TLSH
T1C395BE13F2D900E8D05ED178C7568632E962BC060B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5b63ef319e35883d13d0d4daeb2ad48e81dca7cac17ec45b02841c0f65b0ad25
MD5 319c193b113349fd8366c9e1998b6f7d
SHA1 0c23dd67311f6ad69424c1da055b1e70c5f482e9
SHA512 802d4684bd90ed0def05a7ce9bbffe3fd57b2e55551c9287887c3ebea629863f9938ba6737e8cd3007412a56b88915107f123bbeb71b6fa5de6822b690e1aad0
SSDEEP 12288:3u0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3HgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T135452392AE554AC6E34BC3F0D0F7C7C1E9A11FC272444D6B17E0F9531DBC8AA6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2053f9f6b65f0f8657827290800ddaa41a2d607622b6db09dee759bcb01850d9
MD5 a8cd74d5e96ac5c037d0f62d1c6971cb
SHA1 58064290ccd793bccc31d5337d4618d12dbf536e
SHA512 8d3af81149cde860f4287909424b307ffb1fea0bf240532cf83f8bd4f73c56e9eb5695409a8c4c829fc37aaf265e5de8ade2a4375b4be67057e1ab9a6587a404
SSDEEP 12288:Ml0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T167452392AE5549C6E34BC3F0D0F7C7D1E9A11FC272414E6B17E0F9531DBCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b62e037829069edd8c3127f68d8abea80f87359913592f2dd05af504e4494766
MD5 c0741020e4fd49092d7ef38f223197c8
SHA1 84b3b26053b4238548995ff3416b1074a603decd
SHA512 55689818a0ac3e20e07e809c0e924ccdf0d696ce8b2ab8ec473a7c743f827e4aaecd2d8eff18f2985be25436a899f297a7341114c7336a5ffafdf7f75bb233ca
SSDEEP 12288:av0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:a8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16D452392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404D6B57E0F9531DBCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3de69db8c01f66936c7daa6e8df7c403ba3ac9f7e58f377db2131cb78f857bc9
MD5 f47e445d62e76c01041b0eb1c79cbc65
SHA1 89d56c608bca27d3e50c48a982927186f397b9f5
SHA512 47c434dd01087b5aaa2b3e2d1e3dc1b44bed74134b76a800e3834bf805ce56c2283e30d3a2c58f4434c68359480733e43132a9d43d5e5c244e0d5edaae7e7fa6
SSDEEP 12288:mVQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1414523926F6505C6E18BC3F4C0F38791E6F13EC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 57cfa207a6373369ca2fd84c5189cd19d64db07c8305135b86a5401b7ab09e15
MD5 2fc0f408eff835845c987bf167717abd
SHA1 80238ccec64fcdb181ebff7d9f8ebf2b072496e2
SHA512 db98a4c58392c76042dd20ecbce90b9d635d87a6197a5c46af4cf0b91c472815b787054f14c0ef77cbc1e33c347b0b646a144c9a2008baa217d57b5db482b461
SSDEEP 12288:uo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:uJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T111452392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404D6B17E0F9531DBCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ab6a310a21cf1c1349910757d007b70a9284042598f11f240786977de728ceb5
MD5 58a145f270061d39834d1c0fbe724ba7
SHA1 6586512b2c0c350c350bac6a5e3fea3a5ebf5678
SHA512 d21c5775220cffae8bf5890eedf8c23f2545214d7aeff104a48f2050ce15fc0dd205de07038c5982c2c48e6b82a7763ba00400c7becf50eeb6f199fef5bc2383
SSDEEP 12288:Lh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T178452392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404E6B17E0F9531DBC8AA6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c67eb9b8dbe2bb27a645221b98608d685b0568c13ece129d2615cc49431dfedb
MD5 ade09bf678d796a7b9812460d0af2710
SHA1 8ad50c7faf88ce2b5f03e7d41bcc40f8db5ba687
SHA512 665f6da2beefe75787bd1a341119969bad606ba1ecfbca6b29ca23a8b284ad440a8d8d26d78363987f1857e33c66b31c081a2b4f5767e5a6f0c7030aa2d11cef
SSDEEP 12288:+90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+qgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B44523A2AE5549C6E34BC3F0D0E7C7D0E5A11FC272444E6F57E0F9531DFC8AA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 229df2a760866841ffb34621728d21be070e00b33b4d18f224ac54ea484e9e6d
MD5 f1708308972282c2723495f1d97e9c1c
SHA1 4eb5f75b6d70565e26f8897fa36cccd510eb6686
SHA512 95c07b69afa5b19a464bdcd0bfccbab1120194022f225299977764aa983da4fa009d0509f8ec60a5b9aa8cafeb97cdb6f8db71d1ce8b61ecf7f326a984901c55
SSDEEP 24576:QZMRzFVSOygXe4i7ojhsP5Lgrk1TWb4AN5:QZMRzfRe30jaNf1TWbdz
TLSH
T11A650195B3500CF8ED67827EC8A68A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5004f86eda864af24743d5716a9f187951ec4b1b86ef2345a34a16a0f0d52731
MD5 82eba2d711bc7ba0ac05a4b67e77ba59
SHA1 d5e1cf5658ac7bda6c96c0cc7100030a0cf5abe1
SHA512 e0c8893f8e320d45484b3172ea51151e12f98f01771402e523f6bcdc82a05bb3b127731f3c49e219d815f3374d1318bce2f5004205286921417353b95861d2ce
SSDEEP 12288:Oy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F1452392AE5549C6E34BC3F0D0E7C7D1E9A11FC672404E6B47E0F9531DBCC9A5A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4c69472e81763525d2e82c5e53707ecc7f4ee6b830d110a8972e684884995f7c
MD5 38acdc86481801c2a2e64e397b5baa86
SHA1 cd6a28db664ca66d8189de31bef5bab5f11fe49f
SHA512 36b0b39005663e4ba1ad9243a2cd2ddeaab1d2430b17880a7429c21726f279ee9a7e22f78eaedb19516ebe9720635d8685f587b13d6f806b6c54523fcb150199
SSDEEP 12288:l20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T136452392AE5549C6E34BC3F0D0E7C7D1E9A11FC272414E6B17E0F9531DBCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 816522c19ea937cb0de2139cdae0a554cf0cc5ca9046c77caf3d155abf548b89
MD5 bd07d9081750fc62cb77e12315ce159a
SHA1 e4d6ff84330f861796878988d65054450c2da880
SHA512 ad6679fc2d87daf5043827b094ad062efc2e09a911de66c4506f45b908fae6a144495a6cb53309d353ce484a2fe6733a65c0fff66f3902679e633905dfdb26bb
SSDEEP 12288:6yPz5L8p0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nzy2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13055025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a4d781c5461c8788f4c7b1cbdff07b1a83b0267f5fc4ec0b0f8b173579a454b7
MD5 f253611d8ca99415eea35c9a544144a9
SHA1 f617367564a6d1faaf650da249902baf93747624
SHA512 68ebc7db59c8e0650d6a0e82d159cc25c02ed2fb557ab97041b8131014ca632190d53cce9ad2e9210384a39c5fdc2512c4e4718620da9d5fc62f15c40d6476b0
SSDEEP 12288:4y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4rgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E5452392AE5549C6E34BC3F0D0E7C7D1E9A11FC272404E6B57E0F9531DBCCAA6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 af7f755fe31ae9928c88006fc37de8501e6eab7372ad57e52a8995ea02a7365e
MD5 8e23565520e9ce90bde888b30516b17b
SHA1 f02695d7e73907d140bd08a6d8237ad92b594f01
SHA512 9738fc4fb05bd1daad80d0425e4b36653da5399b322fa5c7b53ce411665fd4db4120ac2e86e695b57e8282802a95b2596b643e87b776b9daa266119a88919a6b
SSDEEP 12288:gy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:grgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T155452392AE5549C6E34BC3F0D0E7C7D1E9A11FC272404E6B57E0F9531DBCCAA5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5011e31ec5db9bb453233605a3416b4b2a9012b96be2ef750d7872abea2334b5
MD5 d70a491f6f1b8d5195de1049f7dad609
SHA1 13224f3dd30a430b8619f1a5c216d0a9d81a7649
SHA512 a2ca48e10834695d6fa730b928cc51e2df3d11df15957eaa96ed9f5cb688ae17e2e3523142e12eb3cee537edae23ce08d460cc9bbf6aa90283b6ce7f9015c8b6
SSDEEP 12288:GyPz5L8p0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7zy2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17755025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 557254181183cf3aa96819d20d40e179d8473d15ba836acdc21f0195d7845e06
MD5 c6175e0dc72809b3bb44cdc52a18ddae
SHA1 96ae5e90da666b61a58887f5a951135b46040c62
SHA512 eaa65246a7201004ee0e6772eef15aced46677773ef5a41f08acaa1894a869740baa8f7764b0864eeff21c3ea35c46b5e8b3dd4d057f25dc037d368872d035d2
SSDEEP 24576:MTDaLl3z0zDMgXe4i7ojhsP5Lgrk1TWb4AN5:MTuLljYe30jaNf1TWbdz
TLSH
T1E86502A5B3500CF8ED67827EC8A68A06D6B27C560760CA1F03F436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f436bd02ad5dedf065f3c559b8c2e9dc7fd6704741df4a44bf959ab108327a07
MD5 4f6efa0a80658a16ebf71a7e56015276
SHA1 444998e232209089bf7147cd8ee9b41a88e31417
SHA512 e0ab078b03af12013b40af735a44399c3c51b17f7e4a6e4b248610eb302f30bce1e62e631bd8773f9ade9cd63ef58e99038d9b1acd49974e7bcb8276b46adf78
SSDEEP 24576:b3vd9CHKy7GZ4gXe4i7ojhsP5Lgrk1TWb4AN5:7vd9CHKyaRe30jaNf1TWbdz
TLSH
T14675CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 90987e2004b3d3e426bdc7f9da1de7800c2061eb8c5fdf1562a09626daf51b70
MD5 3a57988a5f7b0ba9cbe57b5d34634b91
SHA1 cf19211a64fe981140a9557b2c7b5b073145a61d
SHA512 e0970805dfaa20637bb0fb23bf5f16b57547d115a025e208e6a044b57077ab5f0839c7f4246673f0f8f11e9db49b91996ccdf4d12d9a5ca5ae74f8b21ac90700
SSDEEP 12288:kP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A9452392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404D6B17E0F9531DBCCAA6A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7b14a096b948272538cc33bcaa9c3c5a9f4f9a5672de993fb815e90c9056264e
MD5 fa6a44b65f8f49d6adb1d8b5e03e3404
SHA1 88eae9788928e2305678f4b2b9ed5bf121ff4a94
SHA512 5ac22bb4f7b34674689809ce888df343d07e66d4c5171533ca5a9443e14edafb6bcde2e674377df728f4fe314a85749d3f8393ac53b80fe285cf7ce85edc5a2b
SSDEEP 12288:KJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1324523A1AE5549C6E34BC3F0E0F7C791E9A11FC272414E6B17E0F9531DFCC9A5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 66b9804804f5b7f75fd90bfad7185d31e7cd91534c8b6611833aa1b1f632e481
MD5 0d2a03753c5323b609097039d361af03
SHA1 953329d7f77dacd634ad023699af531cbd5cfc50
SHA512 65291bf7c966cd5a61b058201cfc46a79a35113f92028f21beb744bfc10ca65e099f432e58c8c17a1eca2ed03e8bc88795979205df5cb11ccdb2333113e41aa1
SSDEEP 12288:U00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A2452392AE5509C6E34BC3F0D0E7C7D1E9A11FC272404E6B57E0F9531DBCCAA6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7c2f7ecef485b48466f182506324c7129f0eb1dc7eb4e5759ff04f4236f459c0
MD5 81814f60dcccd09b0f12afbc020bf59f
SHA1 8f008c1cce5510f29c944989ec4f83cf17f15824
SHA512 77cfa0b366167d2d5682d2bdaa02b0d0c3403e74bad6184ee0091196099c1e9873eabcec2390922dcc9865ce743c6c5805e425ff71e61a9f277593ae6e97e567
SSDEEP 12288:Ly0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D94523A2AE5509C6E34BC3F0D0E7C7D1E9A11FC272404E6B47E0F9531DBCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bb0faa1825240596c317bf0eb0ba96df477443d72a9530d6d0452b3b3f375bd6
MD5 f09bffdcd510e5e014199eaab686b27d
SHA1 1ce27b7f3bdf6f1941927a1ba92000379de53645
SHA512 15a8ead472f6736e6b5de343448c6e50b8e13f1c446d886e1ddc48e848a946352100918c772983ea297f81ca9aed19a48e04e502025b57fc538e9563d0527731
SSDEEP 12288:MP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:McgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T103452392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404D6B57E0F9531DBC8AA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f075ce231d36007afeb9c6043053718e7fc3ef9462e078f4907ae0f7d4afb0dc
MD5 197ee7d7e21eedd236d5b3ecf52b5797
SHA1 0f185b67d721a4dca3c245da574ca4ecc222bdad
SHA512 0eeda2a9b47975627a7808f50e306998c6382d2ed29177fc12dca39f2f45d14a9bf3bb106947a49b42b6e059887d64e3e84ca0746688fd5ee4f6d71baddc9d01
SSDEEP 12288:sq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:sjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BA4523A2AE5509C6E34BC3F0D0E7C7D1E9E11FC171414E6B47E0FA531DBC8AA5A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5daef6a5111e3fc8dcdac46854f74d709774432dec3bfbaa717000e88c89615b
MD5 1aa147a229dcccb31bdab96bffb969ef
SHA1 925ba41f4e0d44fbddb50dd2e31fbf67d18556a3
SHA512 76f794207ed4501426c8f2e1cfbe6967b7d97a8967d94d4d3273c0566e2bdfabc5118a21ef4c706d89e16d4e234dc731c6006db924f746381a4024f2162061a0
SSDEEP 12288:Co0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T110452392AE5549C6E34BC3F0D0E7C7D1E9A11FC272404D6B07E0F9531DBCCAA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b0b3145d4b2ea9d368ae4cabac8a3c822a92e8d9aadfa984062ccc9836e62c3f
MD5 eb371ae24d0b3bbe0d5cd8d63a393164
SHA1 285631416102fcacf467601b58d6ccfbcbbc73a8
SHA512 351420a5adffdb532ccc6a91cf158cdf5d0b946d9434ccbb3f56602693ae5f1d4b83b0689b10be64fc286e250d7b55b960a5cf8cddff274037d2be109198b1c4
SSDEEP 24576:6fwvUk9RX6wkyAIfgXe4i7ojhsP5Lgrk1TWb4AN5:qMnYI2e30jaNf1TWbdz
TLSH
T10C85D029EBD804E5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bc96af9339ed0972d302be41885f868fc4c13624edc4b30a2c086b0843b10564
MD5 6204b5679cbe5f51233c37920feff7e9
SHA1 a3b4fae3b28210c3e366e0a6a34e470bf12115ff
SHA512 de52e98c04fb94c6ec12c18e1fa74253a8df6962ec4bff4e36e52db9eae24616ec20254a5444256780759195a3e528b33e4326e5eb2311cf407108d9f0a025d8
SSDEEP 49152:KYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03e30jaNf1TWbp:xySzPPU023W
TLSH
T1E7067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0581a34b8db5e6048967bf7b04788e1015ecf4141c3c076593fea2bb0f4ec8d9
MD5 7c09cf63f7e35e4f5694d91089b90398
SHA1 96820c33a4d55dce1c96d5016c627a7f84a40844
SHA512 10da6917aee5aa9b17a9abdde8688cd1a7f75aff18d78320940f50e9107cb9039a2d27bd65d996c8039a0dfa7203ba3e6294b7343b9bed608dbeebb440e24be1
SSDEEP 24576:j47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYigXe4i7ojhsP5Lgrk1TWb4AN5:j47JUQjTirIhCnDHUPfF/He30jaNf1Te
TLSH
T13C65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fd8bcc83cd831c10be726b3846b29a867db6e0067cb72d59aa2d054e99953799
MD5 c0546ac25ea78cb46cf861907197e465
SHA1 1d9a17acb4193bcc6c23664e8c476bdd045392f4
SHA512 b4f312a154a5f7a23993229deb7d1b6f507eb6cc5982e7957a15f81a2abb28298d3fb94f95a6957c9bc45c67633643475e9f39690bba8a6653cb7e69e70f4b88
SSDEEP 12288:ibsfi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Z7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17E55F15AD29802D8D06E92B5C3968A41F3733C9193E1C7CB13D0F93E1F796949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3a4604c00f5016ae05ca28045c1553a334d918fd77530ccf0c776dcf0d3f794e
MD5 95369993ee69b0cfc4403d6d3b91ca6d
SHA1 7bb450805ab5dd81de0ff12da0f776ecf285b9f7
SHA512 df8e7b367000591a620d53bac135919f129f239c3970e6abd732414f26bc7f3a7440d0c750fe4cd90907a64ecb7f1461cee1b6fc9d30eb1d96875306642c0474
SSDEEP 24576:1I+jPUPrNRGfulYlu1OGQB3bPaAEuMvyErkKkLRS7:tjPUjNRGfulYo1OGQB3bPahyErkKkLRy
TLSH
T197354941762BD75FC6A940321E32C2CDA7707D45FE04AB0772C8973FD476668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 553d52dad98f693e0edc92085bacd2cdf8f2d56b2010ecc994de931bb3d920be
MD5 84715b5c440f4bd6bd833a818bdddecb
SHA1 2faebcf6113c7876b2cd34183fad688c4108eb75
SHA512 6f529c9f2328f9f73376bf9d8b029ac72254a9197995ef1b4558d3947ceeacac9b5e019ff6ba3260ae73c51086d14ae86659859a8aa60069747d6dbc538268f1
SSDEEP 24576:lhZJK1OGQB3bn2OGQB3bZ1OGQBtwOGQB3bg1OGQB3bpNRGfulYCNRGfulYI1OGQS:e1OGQB3bn2OGQB3bZ1OGQBtwOGQB3bgi
TLSH
T12A55C5815537E3CFD1F76031072A9B4DAB64EC4673496F26A3C8093ED85AB21A4BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 84e6b7a835096e11911d8a9aac0f41d7ac3ba6bd2abf0a1e89f0ae846a23e6b6
MD5 2534f3e24cefaac980f1e050c78c2e2b
SHA1 eb60c228410b59b66f7d1ec4fa20589055f1ef12
SHA512 81797a4d5c1e5e548bad95efe469a810fb6fa620235ffd2c4efc7ab68e404ef00768fe877084523a07af399ac5280a0ba3c4591869dd666a19b974ae36a1ca1b
SSDEEP 12288:z07a0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4zgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13C4523629F584DC6F29BC3F090FBC760F5662EC0270089EB56D0BA9319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1e7f091663555a239bf7c23cda609c12cf45b0c9de7b7b2bb8e785df82b06819
MD5 9b360f300df4e9de041049ea95805dd1
SHA1 ef0dc9407ed9907101f90cbd49e6482e1587913d
SHA512 5b10138bff195a71a67fcb8154bfbb9ab2bc1320141ed5c94190a53cc7583007114198301766881ad74135d1f95f8c8b3992f52dcbc7305654b64cd39b1e512d
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bY9gXe4i7ojhsP5Lgrk1TWb4AN5:rgb4mBIBhGF1e30jaNf1TWbdz
TLSH
T14165AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 608c23a1c01c85e617f167ddfef2e4322bb8cfcdbc28e432e1c2263fb94720d0
MD5 12620d4933342f9374c8cebc4f247856
SHA1 b42f7cad3958f93d7358958e683c4fd46d20aaca
SHA512 239c912d8216c9302c63e5c6c046716d5c2a055d7ebe3c95eae7f9d14e0a6782074bb737d6c225cbee8b8d30203c01b7c2505fa163a90f199d9b049f7f03e269
SSDEEP 24576:CG88u8FpJqH1bzria7/mygXe4i7ojhsP5Lgrk1TWb4AN5:Z7ZFPqVea7/ge30jaNf1TWbdz
TLSH
T1CF85F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5ca85f90c27caaef0125c2185b8d3e5a1608d29792ccec6579d9d2c1c53c1190
MD5 6d44e8956a3148a46cd261dc1be77277
SHA1 3cc2e18aeb6dc51c04db3f4347269316083b70d3
SHA512 a596c0f83b2c9ae450e0cd5b2232b06c98e6f6da3f61981e54770f3b848a23a50df09826819d2be1a13f81e58c0649bb9be30670c8f5bf627fd2dfc7faa1afdf
SSDEEP 24576:vPUr+NQ+gXe4i7ojhsP5Lgrk1TWb4AN5:vJQRe30jaNf1TWbdz
TLSH
T1A565E12F66A81CE5E27AE17C85828719F7717852131196DF02E0817E4F67EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1fdb9b4fd54b941d8f21cccfa79b6e66f7de3fd5d105eb6ec6b3d035ac283c11
MD5 4e6b183ca8e6cd81a0ec23554f307960
SHA1 4c8797e22cd039582b891456914046534ee978aa
SHA512 294ce6a9262e2007030cb8c98f0e1ca6af5fea6b97bdb4d7aaf0b149336b1ff2c97f10fe0d7f426eba4779347a2057f6407bad92f92f2120e1168157a6f8ba9e
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBe30jaNf1TWbdz:SG05lO43b+U023W
TLSH
T1C4D5CF6A62EC11F9D1BBC17CD9C68A0BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6a360fbd41aaf58f8aa365fcecd477530dd49a6df2b44220dfa344b6faec2110
MD5 a8d3d1c9a73f9f9663eb13e3cc6a9012
SHA1 f05887f218cb1affe1c6049b7d9bcdf1ad807dda
SHA512 fc8fd5486a10fe224f4f01629df2b00b7215173207e08bf90bd3bfdd42533138ca8665eeb2ef759519fe6284f60162129e27972e014a4bfd51d24f2021d5ff8f
SSDEEP 24576:Bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnQgXe4i7ojhsP5Lgrk1TWb4AN5:Ba5POZ3BJt2pasx2+m5e30jaNf1TWbdz
TLSH
T1BA65AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0e82226253986711fd04019d08c857e373c36bf1912841bf671352d9dd32ac07
MD5 bce38e8b83eed9292bf64e0a3196cf67
SHA1 0caea28463370f4d623be771152b053fa168cde9
SHA512 d518f0a8e9e87e1d01e2b4b3b44b0c7748b849ec2b9ac2b6d92bc7708e6b830908b29ff90fd3496d0a1a34e860ce469deda5aeef82d950da5d6a3f5f1963a59e
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fk6gXe4i7ojhsP5Lgrk1TWb4AN5:HNc/zEOVHFAe30jaNf1TWbdz
TLSH
T164858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a4cd77192122c465602fdf4486f9ad21ea1f367e3ec5ade4f8b065def6fb49de
MD5 38a9f29c2eecc86883aab288d1078fb6
SHA1 34e7f2f7e649428d742d65d3751b9a9bad61e5b6
SHA512 9a800f7aab4aa60455c8737ccfae3c31df7b76a8cc5ce761809ddeac06af30ee419baa2d74c648d0169bd137e08bc6b56d4c65b2e8f7a3750fb50233a240b45b
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmrgXe4i7ojhsP5Lgrk1TWb4AN5:9TMwBtOmye30jaNf1TWbdz
TLSH
T18B55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f5f0eb8a409e4706eb2374eacaff9461fd7284d7eb6bfb1fa6aa9442a1b30ed8
MD5 e93f70053116af3f73472ec68293a58f
SHA1 44d6606a93b3bb90f20490a2d3e96bf195afb597
SHA512 24a1cb445882a38839a660de02fc45982d95a256da11b0ab61e9748c81e681dfd9d786f6ae18eb7dddbff85fd014c4e88709632731980cd49c0acae2d4e12982
SSDEEP 24576:WD3FHshBIYQgAngXe4i7ojhsP5Lgrk1TWb4AN5:WDVHeBIAAOe30jaNf1TWbdz
TLSH
T12375E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-55-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/628-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/628-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/628-50-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/628-49-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/628-43-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1348-0-0x0000000140000000-0x000000014061C000-memory.dmp

Download

memory/1348-53-0x0000000140000000-0x000000014061C000-memory.dmp

Download

memory/1348-37-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1348-9-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1348-1-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1432-167-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1432-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1432-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1432-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1528-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-309-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1528-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1528-106-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1832-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1832-132-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1832-124-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1832-131-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1832-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3232-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3232-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3232-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3232-86-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3232-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3240-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3240-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3240-113-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3240-119-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4448-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4448-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4448-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4448-16-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4448-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4700-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4700-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4700-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4700-78-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4788-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4788-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4788-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4788-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4788-324-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4788-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4996-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5184-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5184-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5184-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5184-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download