155433e59feefc2e947aba862e355d9282f72c362c907facd39082ec0340260d

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe
Size 5.9MB
Sample260722-vaxe2aygme
SHA256 155433e59feefc2e947aba862e355d9282f72c362c907facd39082ec0340260d
MD5 eea41838f23c9106cf558b21c2f71896
SHA1 025d58c0f1e056a239e899cf83ec8d0243c7a70d
SHA512 54dc9012c89e42b7449e19e51c494c71facf1b2b002e278cde5551e709e9963de8a475f235c7ddc570d445e82e5d055392267a59031c3239f540c395e1b73b11
SSDEEP 98304:vCq40eVYqOr+FNb8dE8xOngOqBmDXtd2CNDU:vZ4KDdlxWhDXP2C5
TLSH
T1855629117AABA8ECC199C8B5834A46731E2174CB1B36B9FF44C446353FA9AB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5036	elevation_service.exe
5956	elevation_service.exe
2560	maintenanceservice.exe
5316	OSE.EXE
252	PerceptionSimulationService.exe
1208	perfhost.exe
2520	ReFsDedupSvc.exe
3344	SensorDataService.exe
3424	ssh-agent.exe
4688	AgentService.exe
2620	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d093bfa9238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5897fdff919dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1cdc2e2f919dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bbce8def919dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000028f04e0f919dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c26e8ce1f919dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f3b47e1f919dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001206e821fa19dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5036	elevation_service.exe
5036	elevation_service.exe
5036	elevation_service.exe
5036	elevation_service.exe
5036	elevation_service.exe
5036	elevation_service.exe
5036	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe
5956	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5536	2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe
Token: SeTakeOwnershipPrivilege	5036	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4688	AgentService.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2520	ReFsDedupSvc.exe
Token: 33	2620	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeDebugPrivilege	5036	elevation_service.exe
Token: SeDebugPrivilege	5956	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2968	2620	SearchIndexer.exe	101
PID 2620 wrote to memory of 3284	2620	SearchIndexer.exe	102
PID 2620 wrote to memory of 1544	2620	SearchIndexer.exe	103
PID 2620 wrote to memory of 4564	2620	SearchIndexer.exe	104
PID 2620 wrote to memory of 1496	2620	SearchIndexer.exe	106
PID 2620 wrote to memory of 1332	2620	SearchIndexer.exe	107
PID 2620 wrote to memory of 5240	2620	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_eea41838f23c9106cf558b21c2f71896_akira_glassworm_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3344

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4564
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 032c3e5b4c90e979d2d6d6d20d9c210baf27254e97c94f3116d8e0f569820322
MD5 049b32787cff9c51b240a9574b9cef6b
SHA1 66bd4d2c3b72e6908529d9de1b6297d73ffa37eb
SHA512 e7c8928f3230001f425a73edfa233a9d0c780eff6170d9de79a8b831b16e726b493a1e0b75a065bfca5c68a8a7d6bbd4a5a0524a1f8268ecc2b3ba539806162d
SSDEEP 49152:Hb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnldcvDXtd2CcPCDU:13q60jBgmDXtd2CNDU
TLSH
T1CAD58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 89d75e367ea8e748858178ebbdb90e3ad77c0acb981b7e54bd94ccb09203993f
MD5 736cd3760d6bd707a7d2592bab697b9d
SHA1 e2d5307b421a1833034c1a666b9127dcb8c2fe6d
SHA512 b866ea684a59eedd453a5e24f1475db337d40669698264810116dd0bc9aedebb1311cf9681a6dfbae286252bd4ae7df8b8601ed792762a0273b8fee10e15dfae
SSDEEP 24576:UXYfDtczAtxZLcvDaktGy2CcYaqOCDUd:TtcMdcvDXtd2CcPCDU
TLSH
T15565F12877D408F9EEA7427DCCA29411EA73BC5543A0E68B03E49A651F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1330182f08856fcd8c8c386eced8743b99f836257926f88f250910158d038e8c
MD5 2633da847a598937073bb4e0a7e2459e
SHA1 ba277fd0565a865fa0539a7651936ff9c9bf096d
SHA512 d92ed058c0010450c71619ed5452ecb6a3f9425bae1d9301e55306f876604a2e39f934dee69a48e3b39e23019bb860935333a1c5c570e348ce54b7b0ebda816d
SSDEEP 24576:z0Le5ji0hmxNrMAxZLcvDaktGy2CcYaqOCDUd:zPji0A7RdcvDXtd2CcPCDU
TLSH
T1B685AF16F6788335D073C0B9C5D2A69EED72308657308ACB4286D77C3E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a87e8d8a66da0864ce9e8faf1251439c53facfce388c976f94a62f62a3e3ea89
MD5 45cdf672c1d15871179796c60aadc421
SHA1 8dc2a07f573171f616c83c9deb112e9b46c3f07a
SHA512 681eb9e82d6760e16fe5721b9d4a7ed07dd10e934518bad5869244107baeebeada679b7d9210eef67de53d3c72c7280ad5e354b3b9b0ef50563d06a55d6f5db3
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWr6q8wyumxZLcvDaktGy2CcYaqOCDUd:5/ezSC6vUzPviHjy1dcvDXtd2CcPCDU
TLSH
T117755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9315730c64f7d5bb6a4943b7f8e7a8f9e818eb92e312554ba4d222e4a3d5d9e1
MD5 9aab8930172bf818a5627cdc27505e85
SHA1 75f00abc15f90b417672ed412d66582d34ef795a
SHA512 ee449e7ab0b2f594e063782530423c06d00f0b320723eedc41bd40ffb98e17ebae1d175a960bed13457afd8f68fbae647d0c95ffc358227090dd9b7a37f716d8
SSDEEP 24576:yVbqPb88hv/l+bZxZLcvDaktGy2CcYaqOCDUd:yVO88hXl+7dcvDXtd2CcPCDU
TLSH
T104559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bca57349ad22ee72c396dcfc3d16a4f1bdae49a6e185e90ae8609b8591a5244c
MD5 b7db08a7ad9be78e9a063e710959352b
SHA1 358dbd4fe28ca6b5164d12ead1e768a0b75e68cd
SHA512 560887c03d0ff4afb4cc7c103ee60d6ed2e5dd57e6e20f72f24b0bb92d0aa9329aca6e61b236a6c9a739f2bc937ae3e2c10c9f9fe1739235fe00ceb09a644344
SSDEEP 12288:KjcHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:KjcxZLcvDaktGy2CcYaqOCDUd
TLSH
T14145230917CC1446F7EB03F79C7F3821845BBC654282F84FA6B7AB5920BC06ED586DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 13d756aa6361168f3ce6c8128516b517881a8ec9596e5ccdc92647d9624187c5
MD5 2ce8e13f02903f59f96a58a92e68d2e5
SHA1 6dca6cf7d01c757cb26353e8ee95ef84edada492
SHA512 d75711828bbd782fcea6929ecd828de3ddcc3df9e956aead1e92a97237ffe7719337ce13f29c13fef0b6c8b8b9f35b2139693c52aa5ce85a9f443f16b8636ec4
SSDEEP 12288:UeBNUbTVO86UxHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:UJIUxxZLcvDaktGy2CcYaqOCDUd
TLSH
T14865CF3BAE28FCD2C27E4DB95A918600D77278304B52A3CBD175830EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eb28cb8300b0984739910fa972082821ae906fc78fb5ed90865d56497104a274
MD5 aaa103d91295f2f28554a44d42c14db2
SHA1 78d3e437442ff40f08edc8cc2f626c4df409310e
SHA512 75875d8d84c881a117275268ef9486071e75461639f22fb58b188716622218879b91ab8acf193aa964825b2ebf094baa610a5dccd61e06537f6f914f71ea43ee
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THn:HQvGAdlCEL8c/RRNw5CkmDXtd2CNDU
TLSH
T18D267C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f5b69963ee7cf254ca0c0d8306b4a46ef1aeae524ab36e0397b488bb9217bad7
MD5 f2af28fcf29b8e13cdaab00bdeaa4769
SHA1 911fc0eac669368e3afb6a51004300c4181ba7a8
SHA512 f40506c6855cad69f909d7e592cb2c9ae5d6e1fd0a01496767c817e6a69198e57ca2f851c77645b315222d1ee82fd3d8ab848bb58fcab5a1a073f81e7c0c531b
SSDEEP 12288:1AwSfxL/2Dc3DDLLmt0LDQewsAjXHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7o:WSewsAjXxZLcvDaktGy2CcYaqOCDUd
TLSH
T1FC75E031FAB4E036C3BF0DB61B36D716542DB9204B5229C3E3A88E9D59741D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5a8ebaa5263538016efa35e02ab1877e9881bc3142cc801f1f851487acb4bc3b
MD5 45bcc13a6690768d5d9f8dda6ba182ef
SHA1 ddee9547cc6812d40931e4549a5e00d19371d055
SHA512 1e85c6462038624db62414cf3c13dc7bb44bdb42bbfcf8ff5966dcee9a72ad6f96ff6b09f88f591f51ce2223ecf10b2e2217f7e0cabf970a8e362406a4da508f
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHyDXP2C5:2UEtQevvqc2W1cpV2RI32yDXu
TLSH
T18E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 44b66a5efe160a5b09f006efe0d58c46ac99dd6544b5926629ca68f2cdf1c20e
MD5 e1d360e6e3d09915af9f1a1e7b32ed0d
SHA1 331d018d6648616adf34f34e9054a2a101fc8dd4
SHA512 b984e5bebbf22c7d201f891957eb154426a62dc16fc1220c700bc5952f93b2dc990a7eee72ecf0cde9eb8329e16c143df2de13dbb3309526845b3f0cb90e25e2
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zBdcvDXtd2CcPCDU:goquVjnmYmDXtd2CNDU
TLSH
T1D2D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3656cf9ae978c2cae084b3ddc48ac7df20d8716badc652b98a04d32de9956810
MD5 62fb8dfd477dcc9571718383034f4e91
SHA1 80470a301416d5319fd0021f97a24110cc86d62b
SHA512 ccec36af54af580fede0a21640799c3002d1f6f188dca3386ab36b84549b1038a967e6bc0bce1e9cc9139949490a268ce611fba1e6ec0832a1106c1ec60d5963
SSDEEP 24576:fAhGL2IFoiwtA5l7S536xZLcvDaktGy2CcYaqOCDUd:fAM1Foiq5wdcvDXtd2CcPCDU
TLSH
T1C2359D80E7F955D4F5F3AAB899B69070E976BCA65E31D20F2160C21F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 341bd8a68f4ef3c2c1bd69396b0a9b371b461d377f28dddfe0f94362c7293f0a
MD5 f2c625dc17e2b5d42d0b6d350159ddbe
SHA1 a19ebd781d1cf78887954a496c7e156db2d856d5
SHA512 231a90223a395e8b2f8342f95c8a2ee3fe835d2bcd24b4af37e2a80e7f74ee63166f7a0f261e14d9d6ed98fc094b22dae92204f7c7617f82aa7c090e4084d14b
SSDEEP 12288:nmw5HEjsChNSBFgl0WDm+CGHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXT:mwuXOW7xZLcvDaktGy2CcYaqOCDUd
TLSH
T1F365F14A37E81CF9EAA74239C9579036E7B3BC112621D71F1360C65B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 41f9ca0de2712c8dd91cee5bc59cc9136c48fa58d31d43c41aa6d88a85484c91
MD5 ef68bef81edd0d3c9457e1c5bf860818
SHA1 e1b2c3dc88c88a9c67bfd5be10eefb40f7da5a2c
SHA512 caad27aaf2cc87f768b7c6c692b903046afe9e175597c0f5490f80ab05b353187f5125c8c5cee9588b3390e00994d0de988cf5926b9c7c9d9563511a6cb581da
SSDEEP 12288:h/Z1IynHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:5Zu4xZLcvDaktGy2CcYaqOCDUd
TLSH
T16855124A33D820F9E3A702BECCF62505D7727C62136293CF126646692E764DA5D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 db5fb128facf363382400bb79f29466d1dc91fcb8d29a044b1fade9f603420f4
MD5 267291ad0188a2a3c57e9e3558d2dbb9
SHA1 6ef667e9948582cb230dcedaee5365c88f7c4a6d
SHA512 35348497564240820d9e33be0a80797174e27fbff6da2d4a2678b4f92f2f16d828a007a58eb6b35fbb573e545ea58f4618c1ee98fa069d93850494cae9d38083
SSDEEP 98304:jQRQyi36YOcPhLvw2gAf+PN3xmDXtd2CNDU:yQyiKahX+PNUDXP2C5
TLSH
T141667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 71559294cedb5649aba2ee5534db8158bda24c0d1053292c1f6eedf9a8e3da6b
MD5 ee78b5c1a74ba242c27a352463cfa724
SHA1 eb45abc2c5b2e22453c4d910059900f775d2b413
SHA512 4ae6cc0b9f1b9cf2d6dc1ce3a11f3e58faa27cd2a9f04e6cebf37bd1dfc54ff634ce4a730e633ccc7638f73daed3459b55a06fb52b63203df1908224ad74f0f4
SSDEEP 98304:/QRQyi36YOcPhLvw2gAf+PN3xmDXtd2CNDU:OQyiKahX+PNUDXP2C5
TLSH
T1A7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f7a0be23b4b86af2e721f04149def38501a134c6803587419fed2b0100402bc7
MD5 486a57d61adfd66c73f81ecb121aa7ee
SHA1 6af6ace8e40aff99bb6abc6836fe9f0169339f38
SHA512 ac42dea1d271ec2d90b579aa52444dad2f34d793b278119d2574897549e2f2ac0b64e7f041b994498cba7b1f47895872f97b7bd8b66ca34cba7ab4181c98f5c5
SSDEEP 49152:l68Qg55nhceWu7PNU3/RdcvDXtd2CcPCDU:zthLRc/rmDXtd2CNDU
TLSH
T1B9B55A33B2F600A9C44DE1769F4A973196D27C758FE1E3DB811172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5da16f70f69490226f0c7223eb7c3cf623fdbde9e896b543054b8c5d7a8abc1c
MD5 b75fa4ba418cd9178e573adcf4aa0170
SHA1 8c303188db7772a338961e783cc3706d95330a66
SHA512 75405a858b2bd8ddad69ffbd172ce0cae69ee3b01bcc03ec3555cf7d2fb047eaf5ff381b4dc6782334aaf7b159bfcddb0b74dcb401c8786c5a2ba86175088bd8
SSDEEP 98304:9y5112gYy5azzVva69nLKnhZKmDXtd2CNDU:gLIHjWhlDXP2C5
TLSH
T199167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9b0202cc9fccbc2780dc17592111e4ffa430998c9c7bc6524c32872aa89f780b
MD5 d9a60537ba93f5643d1d8e5b8761a24d
SHA1 e3cd6c8502728cba231e7058fd9ef2e9bed8abb0
SHA512 55d869cb2e3111cc2956ec07d7cd02d1109bab28d1636f274f7e5d1965569041433c490cc85a2090c3b6078a369d84f5a1dc3a1c919cf1ec28e241046d72e503
SSDEEP 49152:MB+taZ3usBWOBr4tEG20bqx0z+n217aau1glEdcvDXtd2CcPCDU:Gu6JmUxd2d8mDXtd2CNDU
TLSH
T109D59D13F1DA01E8D06ED178974AA233E962BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 71d3fc39f66bd2ed6f1f407d9ab5289f3331e2fe205ea1ada3dbded342d37f14
MD5 16df843177bc9f2d28c98ae9614c458e
SHA1 ec21c6f3adaca619c56c801f3ad982d8c0ad8dfc
SHA512 096aba4fdaa303e16ab7d7f5735ed8592719545c96d902b33a3a9edf9819125b4ba01bd4050153f9a4cb847716695258205cf6955a6fa54a0368c9b3881870a3
SSDEEP 49152:D1hpsNoJpF1A6BU44CwH7R4xHdcvDXtd2CcPCDU:DmifPkRYmDXtd2CNDU
TLSH
T1C4B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 63b5b27694d4a2762dc3b6cb0990c3ac6a5a975f7bd254d9bb12da296b067dff
MD5 eb5794cf1513f55eb52f56e22053a0f2
SHA1 37dbb37e0c5865b943d1f897e57235227d842262
SHA512 cd0ea5b74bce915ff053d2ba7c496a9adc58908fc6c0405e7fd8357bce52c9153f11cef02058d100d09bf2243fb21582566c3a32e21deefd0f975a3f8e709069
SSDEEP 49152:vSuZQIY0Be2KNRVtOnks6NMHqidcvDXtd2CcPCDU:V5dKvi61GmDXtd2CNDU
TLSH
T191C5BF03F2E941E8E0BED6748B769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0d9f4beb5c00407f0eb0e59feebd54071901d6e2a9bdf690d85f95118ab129e2
MD5 6913131c6d2ad5f8a03be18de6fc11e6
SHA1 4a4867573d508db96ec7a0eaff7b99fc829b3cdc
SHA512 9e42fb300969798f67d6a8392b7a47fe143cf7487f52fa7e86ade3896d55828db4717e41dfb415dee146d7dc7f4348a2909e3a6d380e8942023c721b212fc3c4
SSDEEP 49152:RhtSn8EApI0figXgiDn0AP5wTdcvDXtd2CcPCDU:AX2iyphMmDXtd2CNDU
TLSH
T1A795BE13F2D900E8D05EC178C7568632E962BC160B35BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0b2179619f5b89f5e054871347136f7640cbe26207a62d3ba5000b0ec07e8e9f
MD5 d545a851579e5a11e072848acccc8513
SHA1 6f2a6e1a49dd1edf859f2f4df8f1628c92437345
SHA512 2ac92bf8657b76cacc6834a1c63b267fb26b34f993fa175735fba351e4c290d45a5717f679ba235e6764ca64b85fc7b0b26dd23498eaa16c376d34b391b2e356
SSDEEP 12288:yUHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:yUxZLcvDaktGy2CcYaqOCDUd
TLSH
T11845230927DD148AF7DA03F78C7B3424885B7C6A9283B44FB76B962530BC06F5586DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6a93d07f46e40e121583dc3084b75a698c6c7bd61746fd007cca7125a1f0a890
MD5 21e1867f99b1b7d65fbefd7ace1f3ac1
SHA1 03685722bfc676b33f6ad52bb3c5ab5a10908067
SHA512 6486bf644f700e22e0dfc65f9b7cc02a673fd7114789cc4fa41271156a2f8bf6a9f93979f978ab22f141213109c70b81abde1601c5068c41a5a20ebd801a9ee0
SSDEEP 12288:sDHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:sDxZLcvDaktGy2CcYaqOCDUd
TLSH
T13345230927DD1446F79A03F78C7B3464C85BBC6A5283B48FB7AB862530BC06F5586DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ea4870e767aef1bac281fc0363cbc86bad2b75b4cda367f80ba8afbca8fc9e77
MD5 b1a84079a1c754a6ee7f04b1ef3398af
SHA1 7e5c53b9d653c50e8b1631bce3447fc127106e13
SHA512 029a5a2483a70faf97055782b7351ead0f5db2fbfc6b920257cb3f7e1601d78e98e77ce0228cd99445a66f89631912a78d11b375859f6459d78bc33610ab05bb
SSDEEP 12288:fJHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:fJxZLcvDaktGy2CcYaqOCDUd
TLSH
T11845230927DD1446F7DA03F78C7B3464885B7C6A9283B48FB7AB862530BC06F5586DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3785a73ac688c9db1646885d64736c63f641938b0639e35f8ee3940af4e6a721
MD5 a6b65ab6a615780a989e84b643682619
SHA1 09d0936bd302d223f678dbab7a6b70629c2fddd8
SHA512 ebd4193b07f8dedbc17060845041cd3a3445ee36a5a33a664aac7f1292a4a6612248d64c1a62f86dead9380dac390fa6a799172767d75e7ff63656596a2ebf24
SSDEEP 12288:OVaHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:3xZLcvDaktGy2CcYaqOCDUd
TLSH
T11145230927DD00C6E7E703FBCC7B3420C4B7BCA59343B58FA7664A5528B80AE5965EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e8e6590c5fde62dd4e992453e61321026d78bee09fb458491f715e2b9d9e0025
MD5 43b4e3cf16266166686797434c762520
SHA1 d73ba27a42f63e8670091cc715bae2b7e4357dc9
SHA512 d512d47d67e1bff3c9adfb16d988321b75eea8f6ef2954dc87f27a1efc7acf6535a36a01b02fe01f629e7cd0bc3d4a65f06685d43923e4ea5cf352ccfe125beb
SSDEEP 12288:lCHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:lCxZLcvDaktGy2CcYaqOCDUd
TLSH
T10F45230927DD1446F7DA03F78C7B3464885B7C6A5283B48FB7AB862530BC06F558ADB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3c6702e7871023bf47c1af3515a59f001b0988dd59d75352b54611c3d73612a8
MD5 a08b1bf34ccb66c41bd0d9e95e31f1e4
SHA1 5fd95fbedc67b84cfe914907ceea15ef8e73dafc
SHA512 48e7b42c450547b49eeb9aaf376cff90b79f2079e5a1307fb9066685e4fcddaa53f1795539ded2fc2a2d7e3ba85f9e9e2a6041e5e16f3b351c8d72f9c1bc122c
SSDEEP 12288:QPHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:QPxZLcvDaktGy2CcYaqOCDUd
TLSH
T13E45230927DD1446F79A03F78C7B3464C85BBC6A9283B44FB76B862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1af1692cb7e0e812231ed03aaffe4d7c59e52557a3656cb85dcbf8f0e9c07b3c
MD5 3bffe91d374bef8359157498a8435b2a
SHA1 9316bd87873af898fa1a0b4f6657172f207a9a94
SHA512 667230c0ce85866ff28b543f9d62ae7e94ed5cc54485a9f0fa30eacef3dee14465647938225b5646fbc9a7ac83f1d00c0f3f6d721502c9de885a3ade537a3a28
SSDEEP 12288:urHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:urxZLcvDaktGy2CcYaqOCDUd
TLSH
T10F45230927DD184AF79A03F78C7B3424885BBC6A9283F44FB76B862530BC06F5585DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 005fbf23966331334a14461bf03eecbd71476f3d485bb142d38920125c4a6f86
MD5 cb0ae45d56d88cd80c89fea21e8e67f8
SHA1 c5c8bce052484f6ddcb04fe881d61116276b6881
SHA512 cf2d5caaa3486a7a50debc8e096fd174384c8032c63ab5398872167030874186f34b6b323a683b0033d101fa54da2fe1713ac78988c1871be2602316786a9abd
SSDEEP 24576:XZMMzFVSOjxZLcvDaktGy2CcYaqOCDUd:XZMMzfpdcvDXtd2CcPCDU
TLSH
T168650195739418F8EDA7427ECC265816D5B27C6A07A0C60F13F836271F772A11C2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2ed9d73727e503ea1ed009644f7addd4f335f32bd8b3b9fd424244ffe10a0076
MD5 b1e7e12b9b63cef5ca0ddf3dce5f1dcd
SHA1 2ac5cf86ef8f32d259d5d4daff040cfcaf38dbed
SHA512 0b31dfc98c6eb8dc34c4cc638913a6dc44c045f83cbf4d3941c04cb6851f99f7d993df8370d13473cd8ce2a94f591bac1d62279f3fb5a3ea4eae2f98f1a8ebe5
SSDEEP 12288:RIHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:RIxZLcvDaktGy2CcYaqOCDUd
TLSH
T1DB45230927DD1446F7DA03F78C7B3464885BBC6A5283B48FB76B862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3bf5d4107c8f35f5d32d9ec201837c863b5701e9ba71edd17a15f8327114e510
MD5 718daa09bedd359526afd8438df60ae6
SHA1 af1344f76be4400de67875f049763ab30427a16c
SHA512 1649f94ae660daf588c6f4402c6637808752d89b1fe04921c1291e724a80128f7a07c672f639b0bc71dbaa19de83ef166485f17638d0b207bdaeedc37e89ef94
SSDEEP 12288:6sHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:6sxZLcvDaktGy2CcYaqOCDUd
TLSH
T1AC45230927DD1446F79A03F78C7B3464885BBC6A9283B48FB76F862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4a9c930989076b170fd56d9aed4e406381ecbbacb616e30baba9afa5107e18e7
MD5 93fd4aded33532ec6e29e2fd92acada8
SHA1 25227a8c7942cca49255c726ea0fe4f758774e6b
SHA512 3a0011d8732f3f2f35ec5e4b26a289073d819bacd51b9c204981042d5a488cd7b1209ff194045ca1b7dc88be7a773360f960a1a98b8292d712322d697c705f96
SSDEEP 12288:1yPz5L8nHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:czynxZLcvDaktGy2CcYaqOCDUd
TLSH
T11155120733E930F9E277427ACC622911E776BC3207519A9F13A447762E361A59E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c1d3deaf1d9c1166a12f1929a515a526f07e8a031d1cfe56ddb3e3356cc614a3
MD5 fc09c8625905de93d8fc0a79d179dbec
SHA1 0984cc768294173068165eb65c0222dbc1c75082
SHA512 7c3c43f179395d6f85fe4df22afe826fa38e3feb5cf5a8d4d8cd034e103b65d1d04105805867989c2b3239531008d2e6ef9d3928d34bff6603211452ca126f68
SSDEEP 12288:pIHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:pIxZLcvDaktGy2CcYaqOCDUd
TLSH
T18045230927DD1446F7DA03F78C7B3464885BBC6A5283B48FB76B862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 da81522ac5ab31300ae2815cea347f0c6dab87f449fbc7c5b4c5364b1d372e9e
MD5 e59d4e864d6c04e3393cf288264e27ee
SHA1 6361ef2fce00255d55dd5d221213fcf95aee9d71
SHA512 bbd8479809728806da5c577c9c8fa50ce7f14d8235f4e1f777d3f50376bbf6bb2cce2f7edae0eb30242ac28225a1f1a1fc66b2bc2fa6531cf9a902014e084543
SSDEEP 12288:uIHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:uIxZLcvDaktGy2CcYaqOCDUd
TLSH
T19545230927DD1446F7DA03F78C7B3464885BBC6A5283B48FB7AB862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 43bb53391bef93a1f9f73e56f236f96fd8420617dab37d6a64308deea63e48ad
MD5 3fc08a5ab57e93bcf97ca68a70f2788d
SHA1 370a7557977ae44a4826776b6400d758e3d00404
SHA512 f3e0eafdbfdf8e5a67ebc99b5601839df9ebea52f14fab34bbd6bd664b62337531e3340d48e5e6ae5557fabdc9153b7a106d23c7f6d9afd590723c474181c452
SSDEEP 12288:FyPz5L8nHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:MzynxZLcvDaktGy2CcYaqOCDUd
TLSH
T18C55120733E930F9E277427ACC622911E776BC3207519A9F13A447762E361A59E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 38d3899f78c646ec116741903ba10beb563d19f57a4756a5f2e26d88c6f42948
MD5 37e0f839e9f86cf5bf40ede889daebde
SHA1 c8d947e9bdfac893e202c63ddae867393db94369
SHA512 cca7fa2554c4a5997f0bf1936ca628d253b5b3f78fcae451d24cd2da98d49669c35592def2083cf42ef093127349bcb77f53b4c0b08e6c46f64c6dde601afbaa
SSDEEP 24576:iT9aLl3z0zD5xZLcvDaktGy2CcYaqOCDUd:iTQLljcdcvDXtd2CcPCDU
TLSH
T1DB650194739418F8EDA7427ECC265816D5B27C6A0760C60F13B8366B5F372A11C2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0b1f0c4f7b15df1d484c9d812ee06b52a3dade88d13029dd2c766832d81f6e73
MD5 45835f07f80a3507dd5b7d1fcf8f77dc
SHA1 b54a653904302b52437f5b6b58b8072e02a13085
SHA512 13285ec55e74efed6df9164019458c4f63ee49bafb7a34c148848ef80b8762cc677b77848431f188a51423b753ad66f5a27f4d74c42c7fd64905a2decc5921f6
SSDEEP 24576:O3td9CHKy7GZlxZLcvDaktGy2CcYaqOCDUd:Qtd9CHKyapdcvDXtd2CcPCDU
TLSH
T15175CF90F3E814E8F1B78A75CC765511CAB67C5A1B61DE8F03A8261A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9d714e1e034d22c258b192a30b25cbdae06b656f94ccdaf3502a7c50c64fb6a2
MD5 a4930c29a9638f6b005c01a9193551e0
SHA1 e11bb5d4fb1a6bbb031ffa942a907f0d2f2b6aa3
SHA512 4c3edd981157374a8f38ed799cb202539d61e97ece10c1959ffcb88bfe18346c4d50fe3d5415c08f94c5f84af0c5cdd7c9eaee95f97c11b669b1634e23ebbf9e
SSDEEP 12288:qpHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:qpxZLcvDaktGy2CcYaqOCDUd
TLSH
T19E45230927DD1446F7DA03F78C7B3464885B7C6A9283B48FB7AB862530BC06F5586DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d25a9abc05044933273520e7554abc694e7e04e16550a4d49040fb608bbbcbfa
MD5 13afcc9e5cc53606086c3a36c68ee8c5
SHA1 88896eb9ebb9a2a53856418409f4b4f00cf08038
SHA512 03969f70c69bf23be2e8f35ac97debed9a7972aab7d6cbd4a3b82e604d0781e3af96edb3bc1c9b3389d52d37b735ead0a1c5e664c1139e4938e51e70b2d5f52d
SSDEEP 12288:OHHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:OHxZLcvDaktGy2CcYaqOCDUd
TLSH
T11E45230927DD149AF7DA03F78C7B3420885B7C6A9283B44FB7AB862530BC06F5585DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 767cdcbbd8cf8120bd4389f59a4f8ecc839d747c1c0da6f6e26586f7d7868ddd
MD5 9edf3ee9bb0795d6360ad2224e61ff11
SHA1 a6ff83d4d47d06253235f88d60d1b4a15447bedb
SHA512 b8a747a3b143fd51a47ae84c466639a8514f57c655c0df40429e2f037ad3b004863eb2ff1387015b5b9216527f3c2c85d8477a1f325f36fe447c38664fa70346
SSDEEP 12288:eOHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:eOxZLcvDaktGy2CcYaqOCDUd
TLSH
T10A45230927DD1446F7DA03F78C7B3464885BBC6A5283B48FB7AB862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b5be22808d508c182aa300404300b6f1a24a4833aaf83c56148210c595a54293
MD5 5d746b08d5837b108174048332f09d9b
SHA1 3705e6f66d3a64674b9ffcf4b8044f32bcf8be0b
SHA512 2d39a2e2226564cfa212515f69a012694d196066fab56b5008520d84e96ceeaf3bb5ebac60404921989af697e3d2acbb6e71b5a989fdacca3a7b0755df2beb36
SSDEEP 12288:DIHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:DIxZLcvDaktGy2CcYaqOCDUd
TLSH
T1B845230927DD144AF7DA03F78C7B3464885BBC6A5283B48FB76B862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a1e8987b1e8f2d425ca16e856ebb92ae81c50aab9f7a5f4ed5d9bd1eed69b966
MD5 719dc645d2cf048a4372250ef329a721
SHA1 dc046c63c823fda040a560b67682d8b72f86d90b
SHA512 4dc16d7a4bfe88f531a3dea871ef67157d0f41c86fe85050140734102698cf47c84f3407615ac29e8479cf0bde9f88697cf5cc9dc59ee714b7084c9568932fc3
SSDEEP 12288:fpHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:fpxZLcvDaktGy2CcYaqOCDUd
TLSH
T17945230927DD1446F7DA03F78C7B3464885B7C6A9283B48FB7AB862530BC06F5586DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 99217a72ac7fc3bc61cb1b7081b420bc4ebbcb78a8b1a0ed467320dc49ab4307
MD5 e1c6383bac07f9d97b2fab989b9b4ada
SHA1 0681aef91a3f4375297154ec285e8049c7cb780f
SHA512 fec68319e0f97640e4dad913def41a7e90b53b25f411aa3d70b5f1df6a51097089b6c3d01415a5dd4452e2ff15e6db529978834e759b46d481ef0626cb6d7ec2
SSDEEP 12288:twHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:twxZLcvDaktGy2CcYaqOCDUd
TLSH
T1D445230927DD148AF7DA03F78C7B3420885BBC6A9283B44FB76B862574BC06F5585DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c2567545f600711557396c66820344dad99c5bcdc61103172fbbbd2ce9f53061
MD5 33a6f73b2187632c854c8c6df39a275f
SHA1 e400426bd56c1b783c4269d411fa613d51cef0cc
SHA512 a3f46db08f7a5d42183f0c647c43d905511f4933f35fc1d99c2bafd0d7ec0cba68b894d6a164099257b138e242623673a49010ce23f67b8875f34ac21c949aa2
SSDEEP 12288:BCHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:BCxZLcvDaktGy2CcYaqOCDUd
TLSH
T19645230927DD1446F7DA03F78C7B3464885B7C6A5283B48FB7AB862530BC06F558ADB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 413aa5c101629c0e5786227c9fb39a34bf20425990bc004827061aeb537dd827
MD5 90eb71d43c756c261cbe0bd79aabdf6a
SHA1 789c13b261465db7e2c817f2ca1566e8cdb9d5ef
SHA512 bb14e8eb8817a8ac766db0e4b301e1d165303a5552d5f6890724ae67550b1c487b620be88b250745951a8a1d27bf5e6f523088456232713b98e6ed687f8ea607
SSDEEP 24576:8fwvok9RX6wkyAI8xZLcvDaktGy2CcYaqOCDUd:sMnYIWdcvDXtd2CcPCDU
TLSH
T16885CF29EBDC04E5E1B7827C89B7460AF6B178691B31C2CF129A536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ebd2f5a6599e00d63ceeb4f9d655b8f6d01694e16a2bbf832e9cb57e05c7f6da
MD5 5245e5890fc05b85498fe6fcfc02c231
SHA1 fa5236357956ec3f487dc3a4b11706bccc2ddc66
SHA512 937b49020896b7ea0cd09dad9a67c9823fd7c716ad201a29eebc9e90866525cc539856a8dc592d7830c8fcb77f94edf656570d4123570c83de5a3e5240fc1bc8
SSDEEP 49152:+YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zdcvDXtd2CcP1:qySzPRmDXtd2CNDU
TLSH
T1B0066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ed12f4fcefb72cd886caf35f896dd18b39ceaf4b1faf280ff59d1d5e28c4d8bd
MD5 e7e58a7e3d22430112d5f07152445c56
SHA1 e6fc921244cd03f9047687d4d86e17413d036e26
SHA512 d979e3f682f145f0edfc2b39ab2741e6b97b4c169a4865660373f2f0281c4def67c00bca05ab6e24963d6840c411da4eeee08e9a9f3aecb26e06308b8835709a
SSDEEP 24576:z47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYzxZLcvDaktGy2CcYaqOCDUd:z47JUQj4irIhCnDHUPfF/DdcvDXtd2Cq
TLSH
T11C65AE1DA3EC01D5E1BA827885155A1AEA71782E1B32DACF1270837D6F23ED45F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fdcc1e551f7e93a7ea8b2be9ad37882d1b5a4fe7bf264c972a4df2d1bf6228b6
MD5 3201e4ed8a94e80c50df63baa67ec353
SHA1 b0acdc1f49d29fc9a6ca8045e48e585867dd4cd1
SHA512 8c840415c640ac7fe0b68c75c3c4669c9a62f45fa900fa2947e5744695b11725de8a2c7ee6b7755e9e4560b04c7601549e70e946770c97fc95f49bfeb422ad7c
SSDEEP 12288:IGsf4HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:Y4xZLcvDaktGy2CcYaqOCDUd
TLSH
T1D655F109D29801D8D1AE12BACB562900F3237C6583E2E3CB63D1F53E1F791959DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 7cb26d0ef8518496ab9add015234934ec42e584a0cfe00964bfa886b4cda505d
MD5 dfadbaa1c608bd65299bac90488a4be1
SHA1 49c68d6db7306411b45244c3bcfce4fe773efba6
SHA512 ae5c718454c46433d8b65b576dfab556af489c158f1e34aac84021771b03b80ad587a0834b7287f13a70b6be1cb245b6f07bc259ff7441f39434cb1a88d6130a
SSDEEP 24576:T59gGLjv821tdXyjSAJOrPxZceTjRJfxQy:T5u2jvtrXyjSAJOrz7TjRJfx
TLSH
T119654A51762BC75FC6AD40325E32D2CCAB707D05EE446F0773C88B3F9576668BAA2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4f3289e92983067430a3db534e8c79a51ed3b3dc99d13e722ad86b33a6bda9bc
MD5 e9c235655aa6286c8e9e823537868252
SHA1 e5b5b6413c4c8c454bfbd48393d73215f2eff274
SHA512 3fc680bf729b9a3a8b2cbe32172f78efeb8dff84c93edd58e66e016398b3f8ca5b34cb9a54413694e0e0a75ea19446f7e06121ff3217a2e03100c60b807272f3
SSDEEP 6144:EV8YVmXyjSAJO+/E1wRtJqOCM/KDexH15Z0559/KDexHPSCAVK3o4Zz1lizhb:nYcXyjSAJOiRtJkM5CpSCA6hMd
TLSH
T12165E9816137E39FD1F7503203396A8CEB64EC07B7456F26B388453AD46AB25B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 23276d8c6ddbd1b7deb1a777e13d15ac8601cb03c76e8e8804afeba1ee2b98c4
MD5 190ad21643e96484dce38a8b784bcc32
SHA1 e65191f8c0e80e71a746441df1672986e1160797
SHA512 321ce16c4b57e39f39b967caea79684b4c6e7ef82557809ae78680d9b4e0a90157fa15986f95fb6db0e3c369810396441ddd482514b5da284ee1f5536909977f
SSDEEP 12288:m07gHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:fgxZLcvDaktGy2CcYaqOCDUd
TLSH
T12F45230527CC1846F7BA02F68C7F3430941FBC654782E4CFB65A976530B80EE9DA5E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 50c3194fa06e58f4196a1dbb2d0568b5f2bfe5658eef3df0b26a5ed237bcd7e9
MD5 633178495232bcadbf357f2824f90382
SHA1 5a8eb3dde5fbf32384940d04a9ccb9f925b9afbc
SHA512 8f0247ca78f66dfc02e0a67ea2e68c1af2b562283bbc26d8d2f51b9e62dd02980b7daa87a1312610db6fb88bd200b7c7a549977674acae4a30317d1e46bf7e78
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYmxZLcvDaktGy2CcYaqOCDUd:5gb4mBIBhGFNdcvDXtd2CcPCDU
TLSH
T17F65AE1E22EC02F5E1FAD2B8DDAA4417D6B278160732D2DF1251422D2F3BDE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f1c7f32e828bf806955f1b215861363f144b1bd94a0fc60cb53dc720796f564f
MD5 6b7bf6e75877f8792ecc4f746f81258c
SHA1 0a535451b0f3ba0a08bb8f563d8120abd0c0fe27
SHA512 2b6d5382627486cc6dce10a5cd267670fd72e12143fae9bf22e2a97cb1732627be6f0acc37b284b123bcc618c065f30085081c0900886095f61d5be9fec5a4ce
SSDEEP 24576:gG88u8FpJqH1Wzria7/mjxZLcvDaktGy2CcYaqOCDUd:z7ZFPqVha7/kdcvDXtd2CcPCDU
TLSH
T19785F12577E401F1D4BBD13889964663F6B2B8250360EBDF07A88B511F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 630e0f8e37614a6b39ba4ef8af2ddd259682cdc879d4144fa280e0f8ad3cfb84
MD5 6efb033b880893a7f488df3ab4029b0e
SHA1 ece453bdc341037b59172a8c432a921dd1ac0f50
SHA512 a0840a64c85a5eab6a1e6de20558634f5494cf6df94982e7b64556f8e4be121c6f99a7d823fbd73446671476c3c68ab1a1b7b0932bf014b698a3e6a5804fa4db
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZdcvDXtd2CcPCDU:9G05lO43bymDXtd2CNDU
TLSH
T129D5C06E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f0e63c7261d1b7aeac7686901c76d0c695def6e718a3afd492d7d583f1121868
MD5 6c2e5c1c86451776408842ca3c826e10
SHA1 f06bcf0ba3609ccaa6faec6ec6be7ebaa18bf2b1
SHA512 7486c9162d47b027e6df17debb96e8f37eaf1ebad5c75b3fdfb445c1fb0d754ca72ff26e240e52361d2d679685b66398f7d283e76ee186378c3def046eb3249f
SSDEEP 24576:Tfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnNxZLcvDaktGy2CcYaqOCDUd:ra5POZ39Jt2pasx2+mRdcvDXtd2CcPCg
TLSH
T1FB65BF5EA7FC00D5D5B9D17DC583461AE5B1342253329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 206032a288abbe14b2044d3fc1fde847b4807b025522e62cd23fb6b68c67e9b8
MD5 4fda1fb6341c6715ee62b7f00fa5e166
SHA1 de47b71deabb9a4227662cf7bf2c8abfdd48fed5
SHA512 3360ace4136784afd27b5a642ac28647f8770932e2f7663e35d4cbaef725c8b6ea19a60478b902a1e4f457e6fe7a390cd1967104486f9492991dcd74c2d82505
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkbxZLcvDaktGy2CcYaqOCDUd:ANc/zEOVHFEdcvDXtd2CcPCDU
TLSH
T18C857B1623E901E4F5BBE1BE89779546FA71786513308ACF0291851B1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 178ac6107869e3daa2842da6466fa52720b43134b2930cd6afb3b4944a3377c5
MD5 50550bea97fb77f237968a2e8f9d9723
SHA1 3faa81b99a8263a350678bd2c2b77848c3791746
SHA512 22956bf565f1f5f9fc437ea33f30676199fda06c18dbd5d295bfd0937940380b6759ba5d1b8e4687d1c9b52625f684e45cd9febcb7eb10e87e684f0e843e90d6
SSDEEP 24576:wtkNvNnaFeYhJNtmZBm6xZLcvDaktGy2CcYaqOCDUd:wtMwBtOmAdcvDXtd2CcPCDU
TLSH
T14E55AF2EB6F806E4D1FEC6B5CD238512E6727861073292CB5390C13E1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bae115dd6a833ebda5fe8cfa543cbbca05e2ae66ac12d365db9b212d6cd59a8f
MD5 75dedd9887023e229b2575905252251c
SHA1 63711ae0501a21ce2f02d362182c7cb588eae0f9
SHA512 ac21b26cb55375fb7a1552a29c7a4e9632995c2fb9bf115d0a9b386912aab544efa90f0cc18f5452ae2df1a44cc86270eca707f740fa6c7a0d0015308a179032
SSDEEP 12288:CHvUrBFrEjwaQfHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:CPUr+NQfxZLcvDaktGy2CcYaqOCDUd
TLSH
T1BB65F21F22EC18E5E776917D89465619E672B8620302E2CF02E1817E5E779ECBD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5b5d8619e8b5676cd630d79d3401883ba2fbc1e27fcd57de47e175197554fd63
MD5 be8f401cfb75680c30a6e2d4837c1f37
SHA1 9d7da6428d647273cc2e1e42b42abf395625d491
SHA512 1b2fb7985f31c853cd442ce7c3d620a7cdac3b3c1bb7e0479c4d730dd8b8ac91d9f8e2d6e0a9fa545142aaa735b886c6162253db10c506f0f264cdaeaa1b5dab
SSDEEP 24576:jD3FHshBIYQgA0xZLcvDaktGy2CcYaqOCDUd:jDVHeBIAAOdcvDXtd2CcPCDU
TLSH
T15775E13DE79C04E4E57BC1BCCA635906E67238A9032265CB12D4C1BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/252-78-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/252-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/252-292-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1208-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1208-307-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1544-325-0x0000019900100000-0x00000199002CA000-memory.dmp

Download

memory/2520-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2520-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2520-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2520-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2520-327-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2520-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2560-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2560-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2560-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2560-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2560-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2560-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2620-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2620-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2620-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2620-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3344-311-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3344-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3344-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3344-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3344-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3344-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3424-310-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3424-111-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3424-119-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4688-124-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4688-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4688-132-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4688-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4688-130-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5036-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5036-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5036-23-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5036-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5316-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5316-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5316-66-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5316-276-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5536-37-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5536-1-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5536-40-0x0000000140000000-0x00000001405E5000-memory.dmp

Download

memory/5536-9-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5536-0-0x0000000140000000-0x00000001405E5000-memory.dmp

Download

memory/5956-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5956-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5956-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5956-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download