7cef6fe10271f695ac0e2bab783b472f28b01939e0f2dcbb0674fc9e6cf706e5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe
Size 6.1MB
Sample260718-r6ptaady3q
SHA256 7cef6fe10271f695ac0e2bab783b472f28b01939e0f2dcbb0674fc9e6cf706e5
MD5 388ea666fa64df394f2eda81131db4ae
SHA1 a95afd47b4d37e96bac591fdce4007dd546c971c
SHA512 2f3cddaefb33879431c02dcc44c837a9f0c3ca72f5373b6e2d96763184265d64a8055ce8b1ad5dcef5d3733e2612740eda3d820f023f72acb4ae7f1175850251
SSDEEP 49152:Nv4Pf5rdH/yEmm64ZA5xRnz9Fu6k8TtkVdmqn1EtwcPgPfxqSHNN0CGeF6E0osTj:kwkM4J3H3Yj2aMK90Pn0UgR6sXPHdr
TLSH
T1A15629167AABA8ECC199C874834A4A731E2170DB1B27B9FF41C485353F69AB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6072	elevation_service.exe
5084	elevation_service.exe
5900	maintenanceservice.exe
5472	OSE.EXE
4104	PerceptionSimulationService.exe
3592	perfhost.exe
5992	ReFsDedupSvc.exe
2396	SensorDataService.exe
5984	ssh-agent.exe
1584	AgentService.exe
3368	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2301318283806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e92d0d1c416dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fdfa28fc416dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ca8c58fc416dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002082edd1c416dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6072	elevation_service.exe
6072	elevation_service.exe
6072	elevation_service.exe
6072	elevation_service.exe
6072	elevation_service.exe
6072	elevation_service.exe
6072	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4548	2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe
Token: SeTakeOwnershipPrivilege	6072	elevation_service.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1584	AgentService.exe
Token: 33	3368	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3368	SearchIndexer.exe
Token: SeDebugPrivilege	6072	elevation_service.exe
Token: SeDebugPrivilege	5084	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3816	3368	SearchIndexer.exe	102
PID 3368 wrote to memory of 1244	3368	SearchIndexer.exe	103
PID 3368 wrote to memory of 6068	3368	SearchIndexer.exe	104
PID 3368 wrote to memory of 5588	3368	SearchIndexer.exe	105
PID 3368 wrote to memory of 5200	3368	SearchIndexer.exe	109
PID 3368 wrote to memory of 5548	3368	SearchIndexer.exe	110
PID 3368 wrote to memory of 3724	3368	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_388ea666fa64df394f2eda81131db4ae_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3592

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2396

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f12af556e0faa9791a7ecfe501ea9080fda01b45d8cd15c856aa126b9304fd75
MD5 d0bc647dd85f55f2116f3708d825bb3b
SHA1 3963e99834437f1d40ddfbd6bcdae67ad0890572
SHA512 fff9e1ed886c7513bd5f6d7f65b0040244b5c70ec380d22e89c820fdefae793cd7cc3ea342df74894f416ea2e618c9ce3bccc9527815d8f5fabe263e8f4fc634
SSDEEP 49152:pb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnkrJKR6sXPHdrV:/3q60jBlgR6sXPHdr
TLSH
T1AAD59D03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 01e4963d22f8d2bd4d63a727fdea7b8a50f28f24b21e4a25a788eec00b689df9
MD5 a7bdc7a7095b18667c6bf79922d130e4
SHA1 ca0adceeac2b79ba8d4404f8394b72a8c07b9229
SHA512 9607cb6f3bc09516219ee0462a586b0c5d7de6d452975d3028a271e9035043165cb3a25b34175abf36bcf6d81bfe9c5f1e4d201eafb4c466f15d8822fbd41d8f
SSDEEP 24576:tXYfDtczAomrf+EKR6HQ4VKXPTzdGqbLZ:4tccrJKR6sXPHdrV
TLSH
T13B65012877D404F9ED6B823CCCA28502E673BC554760E6DB03E4996A5F332D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 906e98945f0963602155ce5b4b6981dcc5f9a3abb3448a184992b7464b574f82
MD5 d79e40360beecb6d3198d80c57b1626b
SHA1 d913f37364fcc3050ad04a5703652c967dae5622
SHA512 fed1dafefc8ffadf12fe9d383f64a51702007d24db253b9c5fac11bf9fa5bd8d4a23749f96dc9d5f62ffa279eb3a9cce8b20f62f9b7113bbac937a48ee6bca27
SSDEEP 24576:t0Le5ji0hmxTrM7mrf+EKR6HQ4VKXPTzdGqbLZ:tPji0AFVrJKR6sXPHdrV
TLSH
T19F85AF66F6748331D073C0B9C5D2A68AED7230865B3089CB4286D77C7E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ae2d70bd84248de94bb83086bd23a1fcf025e1cba0f13f509176dccb2c660c12
MD5 2995af323dbb22ec1184b94aedce661e
SHA1 b72ec0362d9dd0429d6888a44f62b3f171c96104
SHA512 009cfc1fa24a25ef403cb2d97a86d9c266610b7d5dcc6cf591748c5686d3169aea368052b90dbf45eb75e6155384759098ce6c1ed382a45050777d515b29acf6
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWr6q8wyuVmrf+EKR6HQ4VKXPTzdGqbLZ:q/ezSC6vUzPviHjy5rJKR6sXPHdrV
TLSH
T187756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3daced1d0f8a00c19865bb78f323970b5485251190d502cab02bb9502a039367
MD5 99f4242a6d8336b982aa0befd72928a1
SHA1 30d05a8af11d134774e7a46c007aaba00e4e03f8
SHA512 15ab1cf4793289bc4f748bea2e023a03aabc3fdf3b515906d95f3ac42440fa42d5789b6a915c2d269fc8fb97f5ee2890986f4c9d7137e38b0109dcd1fde1e084
SSDEEP 24576:bVbqPb88hv/l+bUmrf+EKR6HQ4VKXPTzdGqbLZ:bVO88hXl+frJKR6sXPHdrV
TLSH
T13B559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 261f60cf6d60e3b7138ddcf1314b763b8da897d370d623630655bc82c97dca90
MD5 fe446a30ca882dd6cc3cedd8d00b3a6e
SHA1 f4e06e1fd2c2b08d2a10e7ff8ef987c2cd9d90af
SHA512 1262e4156dbb8b98f9707c259e5ec194492222973f514ef2c9c1df7be175d39485dbe743f67fc74a9fa6dd8ad284ebe20443fff736599f8488be246bfb089b67
SSDEEP 12288:q43mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:q43mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T10F4523E68B1410A6D34EAB75F9EA740350B1BD18985268E371E978CFF0384F5F612B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6eb06cf235d1ccb9fb7a6dd2943d2a26fc30f9bf4923531048363a6ae74c9cdd
MD5 5ceaa49982be743b64ffaa754e05bdea
SHA1 5b82ce865623b2fcbb78c121f1e9f71bc73082e2
SHA512 fef8c8c93162d564382e4e157515a7b74eff1b61a009d806f4b36ad830b2aebd82e501d9a670419663144fc9bd4206bcb0ae356374efdee35d6f5a746fde5efd
SSDEEP 12288:4eBNUbTVO86UMmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:4JIUMmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T10365DF7BEE28FCD2C27E9DB85A918600D77278304F52A3CBE165824EDE235E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2eea3a465801a5a423495b53030bd16bf02e71bdc8421d1880b0a564fdd0f298
MD5 9cf082e30d3d7e979e79a5faa3cbf43b
SHA1 9bee3fced2a41f2326339ec29ed0ddb4b48693e6
SHA512 eb50cc81c5d87b7c0c717da25dd8883ac7f82ba22780be02be75ae32d1a6ab7393f018653385a9302001eeb624c70dbbab3d43e03301c84aa876e840c3f2d0dd
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THK:4QvGAdlCEL8c/RRNw5C0gR6sXPHdr
TLSH
T14B266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ca42fb2821165df1942b4efec8a0089c04cc3b274993bd9ade7f43949a4f9eb8
MD5 e49a39b52d3a8f742ac35f29dde514ba
SHA1 a0743236fdd5a2e177bd4e51ff7f0e7b4ac337c5
SHA512 fcfa61b1f5c83901bbad93f7d0c19fdd5bcde78f7b3ff96e6000130de4de85e9818472f5315335de045ce2e67952b27d2e13c1eff0e8aad245616505998c681f
SSDEEP 12288:6AwSfxL/2Dc35DLLmt0LDQewsAj2mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbV:PMewsAj2mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1D475E071FA74E036C27F0DB22B66D706147DB9204B5229C3E3E89D9E99341D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e606cebf3e925b7488d60181e5e3f4e5fd355deb96fa72f5c785b3fd80eed7f1
MD5 c5ce9018addd8fbd7d88677aba5a67a5
SHA1 03604c0a92c1b787fd43ea34624b2208313b9375
SHA512 33bfdfd0df9e8372f08926ce3dc92957dfdd30232c1fc06a1f100a2965e6a762bc6c76ca6b1b81c27e7ee9d38aaf33bc48dce6f46672915d6dfe6737da2b7d44
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHFgEs/:6UEtQevvqc2W1cpV2RI32qF
TLSH
T13B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b7b03145965806381bb292d79fa8ed29f1c7092963520ee0ad4d18a33f2691f9
MD5 2678f709e069f28d78412586efeeb66a
SHA1 6c7ad41b2141c38d6cb699c1d328369cb5bd0a36
SHA512 fe0856cc25ea00f768012ec16300747d14614f0f643475f8c84cf1350e9478ff55e52df835f8eb371be6e5eb8cf577b4568216bf6fc9ebeffacbf473d74204a1
SSDEEP 49152:OCbRquA/m2yL5zLfFiV+XenmE3/zFrJKR6sXPHdrV:joq2VjnmAgR6sXPHdr
TLSH
T1EED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 500ec95d52947cc63031af6a2fff57f31d5551e21c42b043fb4b834e691dc334
MD5 f45021ee1f0051578f58f39b35b0175d
SHA1 c288db5e4a611ca07845491051908db938425b08
SHA512 0bd9d2c0cb1294c1bd426b77326969f0ae74e50d4945d963c0b6aa5e34e1383be8d9c3082b37db2c5052a758801d389c44237e225cc7240c22f84c658118e777
SSDEEP 24576:xAhGL2IFoiwtA5l7S535mrf+EKR6HQ4VKXPTzdGqbLZ:xAM1Foiq5QrJKR6sXPHdrV
TLSH
T14535AD81E7F911D4F5B3AA7899B69171EA76BCAA5E31C20F2150D10F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ca10674f68814caf248563a85a514f16142ad8d75820b6ff420d8b692a3f080f
MD5 85fdbf201e14471cac3c3d8081ca87b1
SHA1 a810c0d0533fb1a5f70066c52108c828dbff3294
SHA512 7c850be9540453c20c0185049ca3c36048e4c9201d060fda516eac8b976b8b27e8f1c47853d06e2c42191bd5aaa8571e019c964bf21233d8a6bdc923269b8fe8
SSDEEP 12288:9mw5HEjsChNoBFgl0WDm+C1mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:4wuxOWamrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T16665F18677A408F9E5679239C597D132F7F2BC012A21DB1F1360C65BAF37261BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cb914bf0bb63a9a5cbd40cb1772073118396062897eb2450de0a1d36b7dfdb4d
MD5 da8783947e5f274f6c4a3ee1939ece07
SHA1 6a4689febad599ea8096a2a38994db16c7bb1251
SHA512 9fcb0b31fc94bc1871d4f2f78a86d2c97851072568bc83704ecf9c37bfc4271d041519d33f385655b9799bbd7aa4e39199930d8759384137308cbb0c60fa594d
SSDEEP 12288:zlZ1IyGmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:5Zuzmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1005512DA23A420FAD25B933CDDE15602D3B27C16573253CF22A4659FAE309D16E35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 76b150f52062313caf882f154fbfad41bd38c6f9ae0cf62a38acb8e0957704ef
MD5 c803091a62af74d809742c6d8dd6d139
SHA1 dfc7c4079fb41ce6d94263f3e0adfe3436ecab15
SHA512 c3d6ca569528ecc8b3fa257a12431882f47ffc697ab3feec14cf4967419c1dcd73c86a0364b1afe90e6257c125277b7b04030e05674b674bbd97e9742e3a3583
SSDEEP 98304:CQRQyi36YOcPhLvw2gAf+PN3jgR6sXPHdr:ZQyiKahX+PNzgEs/
TLSH
T1C9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0f9e6579be0af94b99c3d58ee9e336262e9c7449d410963c0bdd43835d5a8a64
MD5 0d618a5e86e2325b09f0639e9f297f46
SHA1 c7f97d85874d024bffa450edad41bcbce1d3592a
SHA512 53dc3b4cc4b863d9737b9730dfb7483eafdc923445cda0113f4877df2b575906a46863872ee7fcec360cae97720e48c36853aa9762db778e9951e678a117d8be
SSDEEP 98304:QQRQyi36YOcPhLvw2gAf+PN3jgR6sXPHdr:HQyiKahX+PNzgEs/
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f0df49f5521432bf6b479f5cf6b1fb949decc1bfca2f3d62470e7981e97fc69d
MD5 27bdf3cb7215148b6ebe28e670933258
SHA1 03de2e1a4ff059fd0d0f6f70385ca584d3655954
SHA512 ed4c9c124fa3e0fb98884d0db624c495202ce6c56386f4e6a5e01bb4828694e744af64dfd429fec0707826263d196662bcbf888b02fee9f78c50d2cac6718915
SSDEEP 49152:Y68Qg55nhceWu7PNU3/VrJKR6sXPHdrV:ithLRc/9gR6sXPHdr
TLSH
T153B55A33B2F600A9C44DE1769F4A972196D17C75CFE0E3DB8151720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7599c88fff3f21e144e33db6d2ecc71baaeb491b6f8943531efdd36c09371992
MD5 5bdde8becae33e9e9fc6cb282d27c27a
SHA1 4b6745af16394d3e8d32b8e611c5b7a46b2e6741
SHA512 ff05a2665cea95d8928617aafb02a60d8eaa462f6d87831cc73ae0c6b0bbfdf55ef68a9b63a372cb32ffdbca9ed10ec3f85180773362ab4178b177c4b13f9e0c
SSDEEP 98304:yy5112gYy5azzVva69nLKnhZCgR6sXPHdr:7LIHjWh4gEs/
TLSH
T14C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b1c7582bf3d49bd2c2c61fbcf5ca74afa42a4ef86a885f593ab1985ae389f618
MD5 3d289a755d010d62f8f7895bedad2655
SHA1 32afb0636fb50f754b1baebde9565e9453771ea9
SHA512 2b022b5b543ea7837d2844d691f8665247ea45f3a1a4bc114a0b27ad64a37b697b41cb1b728cb9b54869ed61c914c3acdfcf13bd211edbdb66f04aee2659f354
SSDEEP 49152:AB+taZ3usBWOBr4tEG20bqx0z+n217aau1glJrJKR6sXPHdrV:au6JmUxd2dJgR6sXPHdr
TLSH
T153D59D13F2DA01E8D05ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a121ca9beae5ea40184fc60142780252eaed99296469f0bcd96dcbadc80d78a8
MD5 a064bbde07a378e0d883a7b698d9e05f
SHA1 d309df037fd42381db35c783896841f6cca87b82
SHA512 7a7881bf4dfacb075d004531d34ed47287329c5ca6608f92d059694531a55b3f0bdb95c21ec2bc017981f7b019d8a24cb62d76b94c393c6d8547545ab7452db8
SSDEEP 49152:p1hpsNoJpF1A6BU44CwH7R4xrrJKR6sXPHdrV:pmifPkRAgR6sXPHdr
TLSH
T1F9B5BE13F2D900E8D05ED17887569232EA72BC460B35B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 768014885908547381912dca2f80d77a35a05a60843c1d3441bddf1524ac7797
MD5 f1694e9b526a2d5eefb125e46909ba7f
SHA1 b3472d21a48ffa42676563624b5dc5cc3846a965
SHA512 a1adde98e4efff16812524f5ce8f4453625357af4c91ce0761dd208ff9cde79b6b6c60a2e53f0a77b93ba288976e363b82749e018c1dc0876ab799d22bc23b57
SSDEEP 49152:uSuZQIY0Be2KNRVtOnks6NMHqSrJKR6sXPHdrV:g5dKvi61GgR6sXPHdr
TLSH
T101C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 644f32145b19aa7b407bae0b0ec4e40688e297044b73e57aa5a96fae5dff1b56
MD5 fa6ecf25bfb3f5b2d10582f988b62b20
SHA1 6115fef560cb1f7e62cfe260a36484eb03644ae1
SHA512 28d87b20a41c4d88d5920ea3d75c8346f244e2c1f8f5b8af4c3783a5888b9a96f7bd95cb8a7f1244048dba1c4d9dfb3043e835d6fc6129d3b8b05cf3b8696160
SSDEEP 49152:lhtSn8EApI0figXgiDn0AP5w3rJKR6sXPHdrV:UX2iyphsgR6sXPHdr
TLSH
T10395BE13F2D900E8D05ED178C7468632E962BC150B35BAEF0A90B7561E7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8535cbdaf8e6f76ffb666db628eb1404da79715f9b4cf37ba7b37d92f05da433
MD5 7d7c0b8f888c3aca3752080467d5a37c
SHA1 b3cabd9ce532b6cadb66b9e879f0fb95cebce1c8
SHA512 c4572e0fa4fbed990248ac42e009712f70e44136ca67b701e7eda4d995e2bce2bdcd39100f459f92370900b7703addb427cdff96e20fc751f499826a7a03694f
SSDEEP 12288:bPmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:bPmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T18A4523EA9B1400A7D20EABB2F9D6750350B1BD19E85224E772DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2ccd8bab3cece9b859f8eccc3fd744513dadde5b6fd9a331059b66d73965eece
MD5 3a9f6c55dc60603456557bc8c9122877
SHA1 4f51f2cfd9764841f67c18653d99bae0da1d9276
SHA512 572b40744fc4ce4211a8756da4f4df3ead756da831876551dc0c21b67baf95a6d1abf072343299cc3e705b18df6ae32ca1bdcbf412e8d21e78848febcc4d108f
SSDEEP 12288:CCmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:CCmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T17C4523EA9B1400A7D20DABB2F9D6750350B1BD1AE85224E772DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 839858270183fc0106c2d40b1b6c08439c71367e0cea5be0522a5f88243e73f1
MD5 eb91c0182a5e0b93b187b49d07d5ae45
SHA1 0fc6239f95496a557b77a119f8abe737c309c8f5
SHA512 f8e65ee785133c5a11e3456eb47f9fe223682bd3c3ef0dcdfc42f433388023c27caa77c68337ac9269ab6b87d5f4322bbadab290b8193d80704bc48a54f24d52
SSDEEP 12288:rEmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:rEmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1E14523EA9B1400A7D20DABB2F9D6750350B1BC1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f81076860fd8a7809d51ad604ebd9e5560ba1bdb5eda04c34cc089b944452b0f
MD5 c1681029aad623a92fbe1e102a77d1b5
SHA1 fbae32c9b7e5728473586d96ed1be3f334094eb8
SHA512 eee7bdbfdad70013d354c4b87d09a0cb5cc0c8cd3ae0bee33ce661923aa4a5af4e9a23222b3c7df7e781379fbda34b4df16cceff80e1b94501dfa86988d18089
SSDEEP 12288:VVZmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:pmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1354523E65B5800E6D10EE775E9E6A003E0B1BC19D92265EF739538CFE8341E47A31F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 73328d46f992894c238d9a7310b991fa9ae387f2364ad2d6596a6ba666395e1f
MD5 3f8df8678ef1e0fbff232eb470d1405f
SHA1 61158d5cac0905346baf58ff8f0875e443b84989
SHA512 8b2141df0a2b12054f08210a67c0288ed07ce7119516d539ced81cfdb375a342d31e89f91c9b16a8fd944c1617dd59eddcf4b884bc09572de9bc01ecbecd68f2
SSDEEP 12288:BBmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:BBmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1074523EA9B1400A7D20DABB2F9D6750350B1BD1AE85224E772DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 33cd2d35dc9a0faee14bb96a66285f486d86a772cf1f4269c383aea74ba10a65
MD5 507c5f99f59d115aa8addabc9fd0cc25
SHA1 633057752cb2a1d81703acfd9cc128200361f0e3
SHA512 4f46be11987b7f4a28d39f4663224f64995d4c901031e1ca1ac0f871ec754da717ba9791492beb587b61e1ae6f4a973644d6991d99d073bc14f0890719af1bd2
SSDEEP 12288:7umr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:7umrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1554523EA9B1800A7D20EA7B2F9D6750350B1BD1AE85224E772DD74CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 254436b28650fa42bdf61d5082ade72bd37a022bb1f9553d119d65cf5847dea8
MD5 faf6b7290885f11c54d86f02138305ca
SHA1 9784f22a4dc8405decce55dc6b61296c04d146de
SHA512 b641e234e9019746fe9ab709162b6b8aa3d136f02cbc11d7ca6f6e66957a7d20a6a0d347c3690b0061d5c1185fa79fb74ecc02de59f074fa4c6ac6bdec69e6da
SSDEEP 12288:6Kmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:6Kmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T12B4523EA9B1400A7D20EA7B2F9D6750350B1BD1AE85224E772DDB4CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 812817a78679c6e58fa5a92a6c87a33d49c20570ba25d78218f0d0583bf1073d
MD5 75d48fcd3a67c390ed6e3d3845a2e6c9
SHA1 74cdf21c288f239406231bf92dddc8e33fcaf65d
SHA512 90fe6857767863525ed78adaa572e56ff63df6d5d5a85680e6e887571a5f6afce807fd9858c10750390739900ec12025b0f8bb118b417d4e50a0e613d2b37da1
SSDEEP 24576:rZMCzFVSOimrf+EKR6HQ4VKXPTzdGqbLZ:rZMCzfNrJKR6sXPHdrV
TLSH
T1E16501A5B35018F5DC67823EC9559902D1B27C1A0A60C65F13E8366B9F333E12D3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 34611c5bf554497fda62e20b855fd8e113dcf23ef252f2920964fa02d290ed51
MD5 d5e63a3a10864c826d0e2459c5a07450
SHA1 b3594e5812af9efc1265120be99a20f5c0a69647
SHA512 27a14f9923de779792904d05c1f4c65059e723817f5f0fd3d59d687946066437e17d82d5b89165caa7e90a82a1fc6bab754fc6251b3a55ed7bba722c0dce71b6
SSDEEP 12288:iDmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:iDmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1174523EA9B1400A7D20DABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6b71cfaabb728433150ea8907d6be1cc7ecbf3a67e1b16e722c6289712e49098
MD5 659bb4c033f253a533a1c6a3d7b20dcf
SHA1 3f372ad1f6d3a9f6554ac0d8d461552f338ee8a5
SHA512 c2931e574deaf91e87c0c5e1dfb2410c22166f3ea429fd7caec26ac5e2ca17969bd15ce9523f5a928a841eafe5c2c45abb9948166d218be507097c2c3274bb8d
SSDEEP 12288:xHmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:xHmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1644523EA9B1400A7D20EA7B6F9D6750350B1BD1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b0a3d53bbb309bdc03a4d74f2f862a5b3e662c028d679f7669bbb45f4776bf55
MD5 485589606ea64d07a50b03f069cccc6e
SHA1 f801c4bc3ff83f6e901e7e35d8ffbb335d16ea70
SHA512 8908cdaa90a3ac69036851373284adc5a31157cc40690dad4faa03103c05198bab93a2de8d6b6b915b8652b5b18479d6a452a9a108ea2d57f9a6e20a93d510de
SSDEEP 12288:zyPz5L8Gmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:+zyGmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1D7551257736530F9D12B9235C8921902F371BC3647219AEF23A456BB6E365E06E3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1d59ed11b3a91beea6333c18b0da9fe2820057b88b9bf332b1c9ffd6b76e1bc3
MD5 00db656dab428d273ec998c3791b9d53
SHA1 9b6f3440c4159da5437b9ccb07b31167685cefbd
SHA512 eba3d0c17aaff7172e2a26b658da70d90f0c776e7cca0d78a8ed5fa9317326adf13617312efa35da994e5d56ea9513341ab862f6c4498510226c4b618ae4e6e4
SSDEEP 12288:ADmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:ADmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1124523EA9B1400A7D20DABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 688986975a7040c6dcce09c0f9d9113802c2162a6f7957521be5d5c9d8a3370d
MD5 1213cf97676054c705c3b01d967288cf
SHA1 bd43774df902d8d9fd83d597c6a89d40da5fab9d
SHA512 014cf44b8485aa98dbdf2b237d31569e726137705832c8030ffb5bf23519683bb114096e06fbba7f58f0efd4769e3c5b905763856dbfb78673607c3286c91298
SSDEEP 12288:YDmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:YDmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1F94523EA9B1400A7D20DABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 81f3b6158800bce027934cbd6e8382dc75da272185f9439922c6fcc213b88d2e
MD5 5d456a6ef70cacf333e97ef9709205c2
SHA1 85836460f46717014fd11ff0155ca3227591128c
SHA512 020a08a72364a8993e24fba19fe5bb2fc920f414efdd1441d4468704e5e84e1f8f30dc5a4334e525e958f790e5407513eaf39c18e1b241f2bd6790d678e74a19
SSDEEP 12288:oyPz5L8Gmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:pzyGmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T15C551257736530F9D12B9235C8A21902F371BC36472199EF23A456BB6E365E06E3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8c78a7fb193c4c4c6fc1d6170c139ae69b13a2119e7a8213a1ed5841578713ef
MD5 b75e015143c38e01d3a55d97089af294
SHA1 78e52755d8e6215ceb0bfa1525a97c1b0113ed2a
SHA512 0aa4486630131073a5fe0cf8037016f48228927c3becb31e77c3c7ce8e81093671855bb7f67d4bd2f5238562cbcb49811695a1c210649e04ab3a0a4ec6c2dd1d
SSDEEP 24576:lT7aLl3z0zD0mrf+EKR6HQ4VKXPTzdGqbLZ:lT2LljsrJKR6sXPHdrV
TLSH
T1566502A5B35018F9DC67823ECD559902D1B27C1A0A70C65F13E8365B9F332E12D3AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2ef7a126a81708823196bb8d3accb0c60b48f0c17a5cd5b8fa2d04c89018be6c
MD5 2eaa6f6ab09443de415e9887433e14a0
SHA1 bdb72566484e1dd39f93b8cca1c4555473c453ce
SHA512 0bded23a5e4796b66ace4946d7b42e5b5cdd3c951cae7b46e1d428e70a7f2915ca0cfe556664ac811f649efabe1504c145c71080c1ce4fd0415f27fe860e5248
SSDEEP 24576:v3vd9CHKy7GZAmrf+EKR6HQ4VKXPTzdGqbLZ:/vd9CHKyaNrJKR6sXPHdrV
TLSH
T1A575CF90F3E410E8F0B79A35C9765502DAB67C5A1B31DE8F03A8255A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cfb9f5e226f75c50208afbfa6b9df1ad162e07b123d14f00343f188e5a795611
MD5 003f3b6bc8c560d5b4ef07dfd8bdf446
SHA1 295cd5e45b52166146e77e90fcd44b2e8ba01ac0
SHA512 dc2aaf19349282388aa738f1c9059aefab3bdf57e73e6171af20b893f26ac85abcadba31bf0080bb71726b09f83f79d4f4d959e680fb7eaa6a1f19cdc1148251
SSDEEP 12288:jkmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:jkmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1834523EA9B1800A7D20DABB2F9D6750350B1BD1AE85224E372DD74CFF0384F57612E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 86442dbdc4632ad1515f0c374b5c95ed88ced9850e8ce4ddfab582bcfc55b8df
MD5 ae8c1aa97f764fbd1faedff4f7e50961
SHA1 5d48834b31aa2c74483766dce6102b8a55158bf5
SHA512 f0ea2e38e37442ec2e0b9b177d4aa68eab47be2402814ee7973ee7f1ed0c95873ab459639e20dbf262fa694b84288c2da130022e160495a8e6fe817dce55f029
SSDEEP 12288:tmmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:tmmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T13F4523EA9B1400A7D20EA7B6F9E6750350B1BD19E85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 510edd2731fceea08b9e079da166283c6b809ab46da0c75bc8be3e05fc598cee
MD5 bc2cc24c11986e2105b1b96052f369d4
SHA1 56f5b7937982421182f544090f398540785455a2
SHA512 de27d92907e0332d07bb1497f83fe04056e2e15d57dd4ca47aad851443b56fcdf2b3e0903a58938e3a43410ef2e8398e71f937053cabcc0811733d440498b55b
SSDEEP 12288:49mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:49mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1C14523EA9B1800A7D20DAB76F9D6750350B1BD1AE85224E372DE74CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c14016655bd096d7925a86cf332993df6e49c9518e7d3b30a13be1511d362236
MD5 a2a2538ae6cdb0cab0230f28342049a6
SHA1 92f8d7ff7124aea2f15a0824aefb1d08666de7a9
SHA512 cc54ce4a6060ede77da52c48d4b84aec9f0ca045618f22e21a7f3272ddb517fccdd17657f72f056ff245492a449572eaaf277df7b1110290e69d9aa8112e98f9
SSDEEP 12288:zDmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:zDmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T11C4523EA9B1400A7D20DABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5e1101bf21cd60b15dd076c60274ae1bce9e0e564b0a6f933c1b23bc6d5b8804
MD5 1afd1694bcbcccf80a2f7ff7762b1428
SHA1 49f8d2e3ab3357ab3313700d511e0f4c91751c6f
SHA512 44e220362611c7872f8ec2a4a59912c00dc795cd992ee5e918a289f95ccb0f41fd902c126e4af9746dad70a34b81bee98836a8b5d29613676d988c0879e52ffc
SSDEEP 12288:zkmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:zkmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T16A4523EA9B1800A7D20DABB6F9D6750350B1BC1AE85224E772DD74CFF0384F57612E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4ad7f7b277af0ae7363eb454ee2166f56927f048c99e0f24f0af484fe2e58c65
MD5 9129758b3078a143b6863d11f9c01962
SHA1 ab2ec30a1396689d3c2db1231968f64a9916d918
SHA512 fcec9a067eceb4292dbee99bba8acd5b18a6fb0f72d873104430dfba6416eaf996a613396f2c67d3d1076d5668382847d51c94b065fd53827644fd0cd34f4864
SSDEEP 12288:Rrmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:Rrmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1A94523EA9B1400A7C20DABB6F9D6750350B5BD19A85324E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 82cdb52fc6599087798c139a7fa080c70ff61eb8c9acd03135d38dcdae2fca1d
MD5 6a074df56075e8c82f215ae9a2c9cb44
SHA1 c3c479270764b9f42952079b20061c26ad98dd9f
SHA512 beba69d586af659db4660fa66f01b7b878f92c1d65afe38f948bf3c7bd89c372215d92d2305f3e22f76c2494ad670de83e77d2d36a94265a3490fe1a980c469f
SSDEEP 12288:oBmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:oBmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1D34523EA9B1800A7D20DABB2F9D6750350B1BD1AE85224E772DD74CFF0384F57612E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 137d9d19c49c7fcab86b0d6934435ee8b36f1f11d83748fc93376dc45bd13c76
MD5 f82e25b479fbaf854d9ad8892463fa9e
SHA1 179440ebf7b3ca3a94e272a5c0d23a64f924f90e
SHA512 6b5e2c10444b6214de2c55e93dbd2d1dc8e0f60577a0cb0386d2c1f3dcf9904b718e523c9af0c440fa5a3f983e732c2c14c5c5e487e1a1fbeeb1901c28e776fb
SSDEEP 24576:NfwvWk9RX6wkyAIXmrf+EKR6HQ4VKXPTzdGqbLZ:FMnYIWrJKR6sXPHdrV
TLSH
T1A785D029EBDC04E5E177923C99B74606F2B178191B31C6CF129A53AE0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 09677b2156563bb681d3941e47a6729a5f18300157c4b27f3024ca5587a82556
MD5 c41536789fc0129f018993f9a4f33211
SHA1 50a9c9908c51b3d6292ed1e3bf09a07fa2f647c1
SHA512 4c86e186130b4352a36c780f059bae72279d87c1cf379b1f40814eb7d4516dd8510162376a123f9f3f030cb848508abfb0b23abae6ab765d3cae66f78042ade1
SSDEEP 49152:yYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XrJKR6sXPHdrV:OySzPDgR6sXPHdr
TLSH
T158066C96A16801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 eae3b2f2374ae25632e7f20510a86800b785e68492142e780afd2323baa64d2f
MD5 7d0cc4aa942e788ab242a41fe6d97d8d
SHA1 bc1dfbfa9b24b4819a5098a14c8602638a8feb14
SHA512 fccbbf4ea647bf39d5d5e6c5142109740bade2da3a669139cb25b3da666114d7d608b5e5a7da599009e462954cf294eb21852055e27283b3cc11d927edd88be6
SSDEEP 24576:d47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYymrf+EKR6HQ4VKXPTzdGqbLZ:d47JUQj4irIhCnDHUPfF/nrJKR6sXPH3
TLSH
T1C365AE1EA3EC01E5E1BA927885554A1AEA71782D1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 16c116f40e3f43c96f0c5e2e5b0a451de95b1a7ec382d9a5297a6e63f253fd83
MD5 b9e62cf27ba1b852e032af210ca01f72
SHA1 14f5cc34738a8d0c3722b13dd2a1a365cba2f685
SHA512 da28eaf1cf1a09a480681a03ac1a3fff95a4dca60990c18727241bee435e314e65231af6e03fff30186edf7028635d5303b6949e45564765f28cebd13c018b38
SSDEEP 12288:c8sfzmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:izmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T19155F15AD25801E9C05EA275CB965A02B3337C2587E1E3CB62D0F47E5F345D0AEEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 318d72b5fd18ce92b72eaa9e42551015055a77d523e6f2ae25fe1a824c46f87b
MD5 619539bd7e6c43d69c39587a1bea7267
SHA1 a64a08c9d1443ae6559a65d368b99e431931de67
SHA512 026f14cd31e52d064bcfcf81556f05135080dc3f85ee8006a40a7f7d3810bef17b033223bf6a6e3059cbe48b4d173e65815cc24190ae6d4216c1c234ad2310ac
SSDEEP 6144:HsBC2naMp03R9ybYcbPotMxuis+U3fUktqS2Nxn4coIEdROPDi1NHB6pB7qPkQ3Y:YqqnU3ftqN7n4c1stcpNqPL3wvcGmC
TLSH
T127251740766BD75FC6AD40321E36D1CCAB707D41EE05AB0372C8972FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d8b7c019dc2cab2ba02084a55f90411632aa0a965de06dd142934f8fb302ecb7
MD5 2422ba9e41b20b2b1ad1b9d2490b2db4
SHA1 60dadd51aabaeedb4eeb536d98684cdd2b6ece36
SHA512 b3cffcd9af991f53a0f2103032cc56b34974a9347661e3851778cf4554ce7dcc46b799882e7b3d28f40b5280d8f1d4b9e58e9c5db1b72251b703cf6eed690972
SSDEEP 6144:7D/zwX8aL4cNoT4wrHwlyyXIvcbVtMx54ilib3UmlgddAUUrMcbVtMxixeSZwtuo:a4cNE4wrHwlXy4ilEvlgddAUUrMzJ
TLSH
T1BF55D6819537A3DFD1FA6031032A5B4CBB64EC4677096F267388053AD86BB25A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 561e20cf7eeaf69de050e1791857897f4d280bdf7913055b8fdcb62fd202028e
MD5 58e5a89d488416b75c3a6824aa0d6902
SHA1 c26dba80454ee81d888a789e4e8212ca256da85c
SHA512 0b486db241b87a9f8e8439e31b863d738cfbcd40c147740c5f95557915d1169def1b78b85de35e102deac412c121a4e7cd46ea14dc0d3edbe7a0e0c8ee7c640c
SSDEEP 12288:XH7bmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:rbmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T17F4523E687580057E11EAB75F5EAA1032066BD289F1164E7B18974CFF0384E5BE31F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 406c0e2ddb9f1054c8f6bc6ac9088097e5829afe495723656b8132c2c1d84037
MD5 da5f20b7b8b07cee51acd1cb12e578d2
SHA1 6b43adb14457b4198a66cd0d42ca6ffbe3fd64bf
SHA512 a31c2c45cdda9397ef4d0263ec61beeaf7a5b96453c85e3953adf4739ba89970987397e20d19f3faebe9b77cbe710e5d2bf000829831dbc77425dea2067f8853
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYVmrf+EKR6HQ4VKXPTzdGqbLZ:xgb4mBIBhGFxrJKR6sXPHdrV
TLSH
T17D65AF1E22EC02F5E0F9E2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f2ee2d0eed8c5d4bca113908eed88a5f9490a04da8fded868eff62a32e33a25e
MD5 6b5f2c778f05d539bca118443c93e645
SHA1 8037e9025a877a1db31d56dc1359cc6eae78e298
SHA512 e80528ed9a284f0ca9fb741d1954314a512c229d3ffb8b386c64f875e08bc869872d6a0c11956d55dea871b018a90b32232d3682d2e42f40e58d5bd6a2abc5ef
SSDEEP 24576:fG88u8FpJqH1ozria7/mimrf+EKR6HQ4VKXPTzdGqbLZ:u7ZFPqVXa7/0rJKR6sXPHdrV
TLSH
T13985F16567E001F1D47BD13889864663F6B2B8250360EBDF07A88A561F33AE55B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 371a7b4e45f0b8ab6a2627a84bf592e5605d1c9e1a24ab4848081e83b0d49e61
MD5 ae77401cc75d920061bc3af25c7d76f0
SHA1 1c305169beddf0b892ac6b5b7014093f8fac91c7
SHA512 1be42092ea2f6ad373897e2695d04465584101b9df8761a904ef26c0026dc6baffccb0546cafb394744063bb28d1278eaab3c1148d974dd9c0e7465a2c225d4f
SSDEEP 12288:sHvUrBFrEjwaQ+mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:sPUr+NQ+mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T16F65F26F62AC18E5E67AE17DC5828609F371B862171292DF02D0817F5E37DE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0a43c2d8375ffa7abdeb59d9e8e5cdae91b71ba76562ede207e86fbfb26924fd
MD5 6e2f4cbda5750a3e86db0de01ef45a1a
SHA1 f5ec30bb7ae042a7fa4589f2b28fc5932154f8cb
SHA512 269fc00ee68f29e4b007210bca49ccc2f44559703653bdea7e8840f3b991cccb344fc732cf539e0ebcf8f6d487734107c21a04e0fc69d28d6676000aed459b0c
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9rJKR6sXPHdrV:pG05lO43b6gR6sXPHdr
TLSH
T131D5CF6E62EC11F9D0BBD17CDAC6460BEBB23815033556CB02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 425627069d0812ea02996364bafafa4e50d33ae1eac29a8b952e8d014e434e5f
MD5 4561de761d4f9f525ab33c6a0dbd99be
SHA1 3105d137296ed63ee9f93ea26884fb94b2d3bcb3
SHA512 bb83266b294fd73c8b6854efa2ab0dadd25ee367f48654b6143afe6bc348dd400f85edbf647b6540be68554c03e83134225fb5057f5d25d273c7617cc3e5759d
SSDEEP 24576:afa5POZ3dpqWVM50JicR2hG0lasx2+47eidnImrf+EKR6HQ4VKXPTzdGqbLZ:ya5POZ39Jt2pasx2+mVrJKR6sXPHdrV
TLSH
T1B765AF5EA7FC00D5D179D17DC583861AF5B1342653329ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c9aba9f8e1b36539596a70a914e240f8023b5955fca950adeb5382d76eebfb26
MD5 ffbe48291662957cde637e977a7fee56
SHA1 c5d1919346cafcfb4aef254ebcf623966a841618
SHA512 5f4de0dd79e28f93297441abef92df2fbf0ff6ccaedafa177c9d6ead571d0d16404d9194ee12d7e1997fe1af97e2ccbd52868f6000d48707867c37225e6ef800
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fk6mrf+EKR6HQ4VKXPTzdGqbLZ:gNc/zEOVHFUrJKR6sXPHdrV
TLSH
T16F858C5623E901E4E1BBE1BE89779546FA71786553308ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5f23ff5525b0c7b3db340a256848f0e9665339b53a7fc33537a4b860d2181293
MD5 66171c8b92349974e7946792f27a1279
SHA1 357e2f1915acbb221ebb3fd0f98802d0a39db613
SHA512 1cc4454aadac6b7c8d574f9d572f9039f5783ab76e5595d71985e2e54a7bdbcde00765b689b15338b1f20cad49f71db5f066ff80fb20ed7c9b9dba551e752c73
SSDEEP 24576:RtkNvNnaFeYhJNtmZBmGmrf+EKR6HQ4VKXPTzdGqbLZ:RtMwBtOm1rJKR6sXPHdrV
TLSH
T13F55AF6EBBB805E4D1FEC6B5CD238512E6727861073292CB5290C13F5E279D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 287659f8580bd3ac10d79fe5c559434986f0a6fd26bebb698df890f935b6b199
MD5 00ae750d941466e9df68319899df413d
SHA1 60e4e390e06074c1d20b7cf2f5f471db99f1cc0f
SHA512 151220d7a7fd7e965667ae1c9471575fa3a85debcf885641e34fd51f1ecb2daceaa47d6ff35485dba3ee0353ec68022b64416018f921ef63b9feb258d3e34f03
SSDEEP 24576:iD3FHshBIYQgAvmrf+EKR6HQ4VKXPTzdGqbLZ:iDVHeBIAAurJKR6sXPHdrV
TLSH
T15875E17EE75C00E4D57BD2BCDAA38502E27138A9032265DB12D491BA5F2BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1584-130-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1584-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1584-138-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1584-136-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1584-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2396-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2396-111-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2396-316-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2396-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2396-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2396-105-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3368-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3368-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3368-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3368-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3592-312-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3592-87-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/3592-82-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/3592-81-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4104-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4104-69-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4104-297-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4104-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4548-1-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4548-8-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4548-7-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4548-29-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4548-28-0x0000000140000000-0x000000014061C000-memory.dmp

Download

memory/4548-0-0x0000000140000000-0x000000014061C000-memory.dmp

Download

memory/5084-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5084-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5084-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5084-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5084-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5472-59-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/5472-58-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5472-282-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5472-65-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/5900-54-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5900-50-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5900-44-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5900-56-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5900-41-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5984-118-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5984-124-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5984-315-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5984-117-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5992-92-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5992-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5992-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5992-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5992-98-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5992-331-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6072-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6072-15-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/6072-21-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/6072-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download