610e428bad99c8001e3d5eb33f00d8d956253abfe1bfe86b349b3aa9c1bd2d3c

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe
Size 6.4MB
Sample260722-wdr56a1blf
SHA256 610e428bad99c8001e3d5eb33f00d8d956253abfe1bfe86b349b3aa9c1bd2d3c
MD5 56d5b9913a9224eefd1d75af4966d4f0
SHA1 836c8c972b1eb2e8f81913a68467f3bcc6fb23f1
SHA512 a6300dad3efabce8353e00f144e4bbb3621cde3f507098061e8d5f5efc9c2c250e57bb23a73a9f432ee0cba8503f7addbb14f37c2ae961a2b0272a90819c06b2
SSDEEP 98304:0RG0KZMGVtqNDZjO5K1LnSj1svHjmDXtd2CNDU:0YlmGVtge1cSDXP2C5
TLSH
T1FE6629167AABA8ECC1A9C874834A4A731E2174DB0726B9FF40C445353FA9BB45F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3844	elevation_service.exe
3648	elevation_service.exe
6720	maintenanceservice.exe
2968	OSE.EXE
5140	PerceptionSimulationService.exe
5564	perfhost.exe
1744	ReFsDedupSvc.exe
1620	SensorDataService.exe
6988	ssh-agent.exe
3688	AgentService.exe
2604	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3456855c957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000accbea5021add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069198365021add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc20dd65021add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc643d68021add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090c3a765021add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000293481a5021add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000328be9a5021add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad2b8865021add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3648	elevation_service.exe
3648	elevation_service.exe
3648	elevation_service.exe
3648	elevation_service.exe
3648	elevation_service.exe
3648	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1308	2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe
Token: SeTakeOwnershipPrivilege	3844	elevation_service.exe
Token: SeBackupPrivilege	1744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1744	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3688	AgentService.exe
Token: 33	2604	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2604	SearchIndexer.exe
Token: SeDebugPrivilege	3844	elevation_service.exe
Token: SeDebugPrivilege	3648	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 5384	2604	SearchIndexer.exe	101
PID 2604 wrote to memory of 972	2604	SearchIndexer.exe	102
PID 2604 wrote to memory of 2856	2604	SearchIndexer.exe	103
PID 2604 wrote to memory of 7048	2604	SearchIndexer.exe	104
PID 2604 wrote to memory of 3696	2604	SearchIndexer.exe	108
PID 2604 wrote to memory of 3880	2604	SearchIndexer.exe	109
PID 2604 wrote to memory of 1148	2604	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_56d5b9913a9224eefd1d75af4966d4f0_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6720

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2968

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5564

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:7048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 78c733373e09b26e366a4d8450a0a036ad2352451012f7185a4745aa3f4cd3ec
MD5 8016cbe1af9601d6f30569dd132cea65
SHA1 72d51393535d3b287ba935b82a89c1c3bbde8655
SHA512 bcdff2325a11aa08cdcfc6a53fd1a02999fd79f11de465d5fd5239701e9f9e9116e673da778f6a6774677181946b3d96113b751b26dfbf13bab96acaac25ca5e
SSDEEP 49152:6b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnxdcvDXtd2CcPCDU:s3q60jB8mDXtd2CNDU
TLSH
T130D58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 aae3d46287a2b950415cf53f34096067967d0d46e3b754d62d0f2022290f482c
MD5 8553209a5223931259f89065252edf46
SHA1 29c37ddff5c8880ab31c337da555e4a35aae0854
SHA512 8a8dd06ff4f69e286355c16c0b09d0bab3c5c9333e0df5f3e602f44b0836c882860f4fb20ad8ef4f1d3a0189466fff79e1ecd607cb8a603a25b405ae61d76a34
SSDEEP 24576:7XYfDtczAyxZLcvDaktGy2CcYaqOCDUd:etcXdcvDXtd2CcPCDU
TLSH
T15865F12877D408F9EDA7427DCCA29411EA73BC5543A0E68B03E48A651F372D85E3EF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 25d5b25f5a6df8a07dbe3ce3fabfa86ae530891caec4247afd5ca0223d2bb699
MD5 c3165c35a6bf9dcad40f01f32a688319
SHA1 569eee98464b3741798f1e11a9eb51aae4e84b4c
SHA512 481da188d957d40883407bf09abe1299e2211b97b7367c308645a95cd3dd0f527210705819a97ee2fa49d6682c8aed1a895d16452bc6686d195a5f9fc1b1d02c
SSDEEP 24576:l0Le5ji0hmxNrMPxZLcvDaktGy2CcYaqOCDUd:lPji0A7qdcvDXtd2CcPCDU
TLSH
T17E85AF16F6788335D073C0B9C5D2A69EED72308657308ACB4296C77C3E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 05be0579994f6df03ec86ff6506132c070afef5be26dffe91309a342186cb885
MD5 56df6323f9910169a14152457a308210
SHA1 5f6e9adc95dabaa461c4b76cb077ac247c6303b8
SHA512 189f662f2e4c9e4aa313b9db840a092a4816df60f03ecd304252fc41650c49351ff162ffd0c744460522610a017128197b0697535ff848a6485de589b1f175e8
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWr6q8wyuxxZLcvDaktGy2CcYaqOCDUd:t/ezSC6vUzPviHjy2dcvDXtd2CcPCDU
TLSH
T14D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6622d81a1bd2ef791655d2c470611388f321613099704497d6fe15fd5a07f5e4
MD5 3be571d01b1fd25732a02632e58e6d7b
SHA1 08be9b968f3774551e0cb151c8346c3a0bbb8c8f
SHA512 cd14822427bf2b2fcf79f3bdd2bd182eda4bda674a00a56179eda14c80d32cb1f96b85b40eed38ec434075144e74ba3a1b96a844d8d1dee7438f29cb61b9b812
SSDEEP 24576:5VbqPb88hv/l+bGxZLcvDaktGy2CcYaqOCDUd:5VO88hXl+wdcvDXtd2CcPCDU
TLSH
T180559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 03c9994ce4d034d22a6f5169d53c53bbe27806840320cc57089d47b061a5ab02
MD5 99fd36994bf7cf6b64fd94f5bc147dd3
SHA1 63a47ab994a321f16ec5cd7808217c995de6ee16
SHA512 8a16784000b37f0a0af51631d729a5abfbab1e64bae709f4d649dd700ebba498b592820c1e53d75b181285b9b6c8bef04095f079fd68f67fd110b6086c506cdb
SSDEEP 12288:ljTHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:ljTxZLcvDaktGy2CcYaqOCDUd
TLSH
T13345230917CC1446F7EB03F79C7F38208457BC654282F84FA2B7AB6920BC06ED586DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f9cb79933c08eb2a045019580df12e3f672bb519ccf802e26794324c278d9dcf
MD5 39b5d7681bb5619769b49033bad5262f
SHA1 e36648dad8baa4583fa57047a0c0c4f7f38e477a
SHA512 a46bdc1678662a5155d133a4e6fcc084f185f0737d0fe4255bb5c1ed2ebad1fc40b182584e9424ae62e87313d6b272cf8585bc3bbcef91a2af970a769607dc9c
SSDEEP 12288:TeBNUbTVO86UOHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:TJIUOxZLcvDaktGy2CcYaqOCDUd
TLSH
T11A65CF3BAE28FCD2C27E4DB95A918600D77278304B52A3CBD175830EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8ad046d1e247a0545eb451de35f82b829521f6a71ac985dee4bb490040d101cb
MD5 2d57735d689615dd79f228c3065ddd8e
SHA1 d7d0e12ee0147c647db90af964fd24f4074bd259
SHA512 2caec6a15037610bd9344b35c88526c7d2598cfc64e3eca76c4aba61b27a158425eec3fd999b0e49c3bba81f83d5ac17acbd9ac5e2999496c389540eee2e3f0b
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THk:QQvGAdlCEL8c/RRNw5CNmDXtd2CNDU
TLSH
T1C7267C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 03e8a798105b9afb7d418a6562bbb6bf57f4ef60e79cb1895d39dae25fe3dd49
MD5 b37e0b52c606cfe4eff4e7f0967edb69
SHA1 4f84635c75ba3addb58fe17bd538c37a423e0fea
SHA512 7cb1784adba3d97e9dbbaa8a6d7e52b40dc3d443060bbdde106d1ebfaf99dd807ab30725360bc6b5c58d8382779df305bda38b525cece8b4ee0a5ea10086e838
SSDEEP 12288:aAwSfxL/2Dc3DDLLmt0LDQewsAjQHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7o:vSewsAjQxZLcvDaktGy2CcYaqOCDUd
TLSH
T18575E031FAB4E036C3BF0DB61B36D716542DB9204B5229C3E3A88E9D59741D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 19c9312fc3b9ae0826a8f6209afc6705088d67c7ae25b6d657e56e86cbccedc1
MD5 9e622fec75a6802e5d9a754e00b128c1
SHA1 f5b412e96a2ece8acb4ec1f14a592038976a7c14
SHA512 08a59fdb650b66ecab54259bcfa844f148daf445f141618edf4d20f9aa3c180cac2c9289be964190d9107e6e2d90cfbcead1f6190f2dfd63357e0fcd58fb31fc
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHPDXP2C5:LUEtQevvqc2W1cpV2RI32PDXu
TLSH
T12A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4370feba5fbf71fcbe4630952394a4ecc66022dda03cd1d7f3b1a2f0ca43b205
MD5 2e8ade0269d30d3a81e37336f1468f91
SHA1 535a4c31f5046282ca982b161a567f797c6c2bef
SHA512 f4d3ca8decb54b6dd3f12805c9de17f25cf8d3f7c3a239f6c66bb2038d4dd4a23f162dc5d23b21218234f9eee82509d3cc6ffc33d450e280f8122231a984d058
SSDEEP 49152:FCbRquA/m2yL5zTfFiV+XenmE3/zadcvDXtd2CcPCDU:SoquVjnmJmDXtd2CNDU
TLSH
T119D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fd063e398c70931d145fa0435bcc4a03f68f222a240d28910725d4466ad0ea8e
MD5 cffeca6f475e93a2bf476a4e9b786c19
SHA1 8cdeb08b1bfdf632a0b7cb8a0e62073aa978ce52
SHA512 e3854475dff10e9df2c9d59a321f95e17773effb950f8645471a7856318b2c3c7cf4da3872202737743d23724d4c6eefd675f3c512111afaf750a9f38c63b9fc
SSDEEP 24576:sAhGL2IFoiwtA5l7S53dxZLcvDaktGy2CcYaqOCDUd:sAM1Foiq5zdcvDXtd2CcPCDU
TLSH
T19A359D80E7F955D4F5F3AAB899B69070E976BCA65E31D20F2160C21F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 959ecc70d1422e3f05c4bf21faa6ba4dedd2b503911d2101ebeb18fab5c56825
MD5 3e6b6e40d68ee00d48a099533438ebe1
SHA1 806637a2732029f23fe194da740833265613e73e
SHA512 659a3b641aea849e4ee949c51f537b9a2ceb3b15e2d4887ad5ebd00f35c9ca4bc54b220ffd2483f1559fabe1599f465e1b57ce23f87caf183cef4289df2d8b33
SSDEEP 12288:gmw5HEjsChNSBFgl0WDm+CRHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXT:9wuXOW8xZLcvDaktGy2CcYaqOCDUd
TLSH
T1EB65F14A37E81CF9EAA7423989579036E7F3BC112621D71F1360C65B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 49af8d1ced53e229000af45c6dd3283eb2db3bff2549dff24bca174a22cf3feb
MD5 0e0dd99be38b4405a8b5412cf551f42c
SHA1 f6e3fa729168adb612ecf6f79a57154ff86ae155
SHA512 be442819bbef7a8f2fb6c2798560667078f07e343e2f794b34300c2ffc7a860b8d038d084b9364b1451678b0c32e06d6e0b8e8a54ca0513aed308779c79fea65
SSDEEP 12288:d/Z1IygHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:lZuXxZLcvDaktGy2CcYaqOCDUd
TLSH
T15955124A33E820F9E3A702BECCF62505D7737C62136293CF126546692E764DA5D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 139827e8fa25aca613f64db37bf4d1338a85ba5b3c0602885f46ad05627be5f6
MD5 d1d1795296e84ed1776cc61d038c4b45
SHA1 3d99bfedff6565b4a097a051307cef81c61482ae
SHA512 fae62a2c51f1cd6192108cdaabd9894d19065db023603cb5dc987bd02930c7b31fd3837c7f5d8a9c916ee50d0a64807e71657b6da7067e7f2a2641d69fb3a0a0
SSDEEP 98304:IQRQyi36YOcPhLvw2gAf+PN34mDXtd2CNDU:fQyiKahX+PNtDXP2C5
TLSH
T151667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dac09918596e72cc8cafbd0d2a7edc87eb0f6667e893efb4efaaafd839151f1b
MD5 a247ef053cf47479420df835034e77df
SHA1 956b7a5d7a286d49c46bcca68874f866604e2ef7
SHA512 f1bffea570f2eb10861cba65e9752c717d4bb29da24cfdaf1d53e94f18c9551bee7ba32003296ee8dbee5f3d0906e0e9b1e52ccf36b7e0549e87aa2115ec515d
SSDEEP 98304:2QRQyi36YOcPhLvw2gAf+PN34mDXtd2CNDU:9QyiKahX+PNtDXP2C5
TLSH
T1D5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1b64c26396e9c7a239f3e843d213c77cb3ff3950bc49bd44ef5352cadef983ed
MD5 800f98562d706933b7b091d8383b7cc0
SHA1 5f145a5461c0cc7306106faf490503085da977b4
SHA512 d737985299eefea4900093e288238a5cfde329ae4203d8272321e1b2a0387ccefc9e98447f87a937aaaefd95e6cf07bde9a95ae2a3d34d51444583c8ac71833a
SSDEEP 49152:h68Qg55nhceWu7PNU3/qdcvDXtd2CcPCDU:fthLRc/OmDXtd2CNDU
TLSH
T186B55A33B2F600A9C44DE1769F4A973196D27C758FE1E3DB811172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a080c6be6dc5edb23773358bf0cae2d49ab359f4dc77efc4acdfc168a77c6ddd
MD5 603a2a2430c1c20b14c1c5605c84c743
SHA1 0adf76dae1ed964515186f151adebf6c49403edc
SHA512 d3122a10b10d8c5d24f877f8c7224a118fb31ef5f6c7bb488044fb5877850a4a817aea0462997e33b49bfdc16ddab332c18d0376bd3cb4605dcbe8a1d1726520
SSDEEP 98304:Py5112gYy5azzVva69nLKnhZ3mDXtd2CNDU:CLIHjWhUDXP2C5
TLSH
T1DC167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 721b24a12e4e0ea39291c547d227dc0ac3b1c0bca6367ddb88999f2510475356
MD5 f2c779126ea5e2699b8dbb3376fd1cc9
SHA1 c1205f63f67e1487fe1f44de1fac941de5267e8d
SHA512 f1a5e0fdceab96b34cf68366f2361ad1477856a2b0e046fe1f08f1a8d433c74005f54277a405fde1e68bd29602706ebc0e3f78ae14186b60ec92bb4a21254386
SSDEEP 49152:4B+taZ3usBWOBr4tEG20bqx0z+n217aau1glQdcvDXtd2CcPCDU:Su6JmUxd2domDXtd2CNDU
TLSH
T1AFD59D13F1DA01E8D06ED178974AA233E962BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb8f1ffb362c4c3e8f827126898145a1f4efc62c8cc352a42d9dcd9971f01089
MD5 b912b7a3f67dd27c0450947a4dc82a89
SHA1 cd3da820294e15d5655f47c6c88656bba2cda07b
SHA512 619250cb7eb963609283ac945cc9d88efcf116dd7f94cfd30e5191cdf059fd8ec78ac4bdb55279a8eae51851b95743b801f68aa8ba4430fbfb7514fd08982c28
SSDEEP 49152:R1hpsNoJpF1A6BU44CwH7R4xkdcvDXtd2CcPCDU:RmifPkRJmDXtd2CNDU
TLSH
T166B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4cda64c5376ff0d71a8b8762ed708fac639f04c5bc62f36d006944d18b8c085f
MD5 a31952f933bca2304e638551288dda3d
SHA1 15c6b966e6d2c4e8fc9804b03adbdff1af699521
SHA512 f6d1cb583a578ce1d249585908d97d277be632b366c36b7f07ce44ed4230ab0bf997c362593088605827275a440b8f108150ad7c4cd3879811afb2da40a56208
SSDEEP 49152:vSuZQIY0Be2KNRVtOnks6NMHqhdcvDXtd2CcPCDU:V5dKvi61bmDXtd2CNDU
TLSH
T15DC5BF03F2E941E8E0BED6748B769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 580d85ac637226369d45a13c6434243dc84c84f2dafe85919ed545b9eac10650
MD5 185f868be82d1dba3f9d46c476dd04ba
SHA1 7d47f886c27d883684968cc06f96bc2b9c6ab30a
SHA512 6814cd9e8309ca0eea5db70d033bca91fd88dab1763119745b272ace6a460949f18d57e8ee78247e6d56acf5026ca7de2c1f000166b0cf8674893f32b66edb50
SSDEEP 49152:+htSn8EApI0figXgiDn0AP5w4dcvDXtd2CcPCDU:fX2iyphlmDXtd2CNDU
TLSH
T1C095BE13F2D900E8D05EC178C7568632E962BC160B35BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cb5799d87864b3eefd297b57d2256634a12c9041106d874e2aba2e1bb631728f
MD5 0b0925a3e1d9a5a81343db3bc8780bd1
SHA1 13d5567cddfc3f14638bcf38b04b6f40f62a55c8
SHA512 20df490f373f13993130b148bed6c13cd16766ea2283f87ed84ff8c3db6b1ed2dd6346bb994ca52481c9786a922de6b5a8091d2084d7ff7ccdcfa6ea677b80f1
SSDEEP 12288:LbHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:LbxZLcvDaktGy2CcYaqOCDUd
TLSH
T1BA45230927DD1486F7DA03F78C7B3464885B7C6A9283B44FB7AF862530BC06F5585DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e37a9c35cca05b6aa80560cedff35b8499111080a5e15fc39efc836e986cf89f
MD5 b37adea5d5d1e36eb492636b701fee68
SHA1 810800b8b674ec56cab1db402279544bad98282f
SHA512 a7864daf72d5eafedda926340b9035fa84a84f4de3ad3ecc01919259aa50baeccee715f89c9eb2e44badac30e7b93fb431d81992edb05848b7df9eb2fc1664c1
SSDEEP 12288:80HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:80xZLcvDaktGy2CcYaqOCDUd
TLSH
T1C745230927DD1486F79A03F78C7B3464885BBC6A9283B44FB7AF862530BC06F5585DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c5525382fc74ce5c17a055bd6ca7960f7286fbc882a898b5a9edd0127ed58de5
MD5 1b11a34aa0775240ab79fef884800fcd
SHA1 b820d3a826e4e30ee15b2951f9696a2701f79296
SHA512 d0e441d3a0f7cd639dc6d1cfc2965971ccf3013edfcb66ab0483d8f19f3c04e560ea918edc4e9a4bb8381100c0574cf8c4538da0004d855b5f8209903d103cb5
SSDEEP 12288:j2HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:j2xZLcvDaktGy2CcYaqOCDUd
TLSH
T18845230927DD1486F7DA03F78C7B3464885B7C6A9283B44FB7AB862530BC06F5585DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ab1e1a4d5bfd5ca33cd224ab4ebdb81f2a383657672e4ef048135b49caf8fdc0
MD5 d9778999612ec907f2ed54f19e0665b2
SHA1 d9d1484f9cc6b77522e5176c166f5083c63e7961
SHA512 5684b987bea1e4fb2ca35011d503e04515541d08388bbc68eccdb92af47ea4562f86c7144144436f83a7b86ad8ffdefdbcff3e45e842f5f7eeeab1d34d9fa19a
SSDEEP 12288:sV9HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:ixZLcvDaktGy2CcYaqOCDUd
TLSH
T1F245230927DC10C6E7E703F7CC7B3420C4B7BCA59343F58FA7664A5928B80AE5965EA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f905f27809dda5b52855aaab1e96a8512c34386b84071c5ef84e501ab789dc15
MD5 56a12d3721b80bbca1a89efffc858d5c
SHA1 b791eb704c722c5fa4de912fbfb5390a56e2aefc
SHA512 bb424d1d2cf3f06c942a1d5d79fccd50b63bc474f84c911b251a53b2ce5c1d40115ace6920d93521a676da1bf26c18fde8d4e129956045df32537cbc241b92b9
SSDEEP 12288:3VHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:3VxZLcvDaktGy2CcYaqOCDUd
TLSH
T1A345230927DD1446F79A03F78C7B3464885B7C6A9283B48FB7AF862530BC06E5589DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3384e7d6aba8f11c83adb56aa8bf5d271473912809404c75f4c938bbb135c83c
MD5 db264d4d06a2594b3dcf512042ebc331
SHA1 7aede33b80dad891b8896bdad2282859b1721e3a
SHA512 4ebde501f395a96645597feba88ab12051315c257e5c6e63d1510ab5289f8bc7192647c6531c255d6faef1b75e2cb77e0b2ce5dd816ca530098413889eae822a
SSDEEP 12288:iYHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:iYxZLcvDaktGy2CcYaqOCDUd
TLSH
T10A45230927DD1446F79A03F78C7B3464885BBC6A9283B44FB7AB862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d6148390d1a86d4a3a421f8a1e771fba43289b5b1f241d061f11c656c649849a
MD5 65b0dfefc6f654d3fd7e510a6d5913e9
SHA1 58616df347e59b886201328fbb3942a2fab8dc41
SHA512 29d266f864dff59480c110b8028b5a4016c1f277d004f0b349bb38746b620169119f128f6d506aa567d6d8c37a18cebc23ee822b151e491bf78c7386d5c4ec39
SSDEEP 12288:HsHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:HsxZLcvDaktGy2CcYaqOCDUd
TLSH
T1DF45230927DD1846F79A03F78C7B3424885BBC6A9283F44FB7AB862530BC06F5585DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4f17853ec89447c7600587dc7e4bb14d605c82c668792ff47bd6e3ff66dc8220
MD5 7d91f601ba729b549b62d0fa2fd351e3
SHA1 68b277ade11e543ff922924698ad80d1d66316f1
SHA512 9e8a655f877e399fb6d4f811ba7e636823a35268cfa9662c5762b25edf46c5a11c151ff2b206c8488bcabab9d88c7a391f6e7f8029de3a1964a4d1711216ee30
SSDEEP 24576:wZMMzFVSOUxZLcvDaktGy2CcYaqOCDUd:wZMMzfSdcvDXtd2CcPCDU
TLSH
T16C650195739418F8EDA7427ECC265815D5B27C6A07A0C60F13F836271F772A11C2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 02007f359dcbc05338f2761d1435cd4b73df727a4644953b561cc4e19d29481f
MD5 64b1cd8a3b4f672129b1a8effb7dba90
SHA1 b52eb075424e7a91f161939cecfc3371ed4f4bf1
SHA512 f74fab3bf1f9b44b3452611a3d03c1b06da84a74bea6ccd7a987291ec801d013cdfc8810dc958903325fd5fb6871d52cac379cdda8fdd75683237a5e3b145adb
SSDEEP 12288:tnHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:tnxZLcvDaktGy2CcYaqOCDUd
TLSH
T16445230927DD1446F79A03F78C7B3464885BBC6A5283B48FB7AF862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c20eb00cc79525d7af25b8cf67e09de4fc1fb27449a4cec7d6795c7187bc1d2e
MD5 630a9b499bb86e7f46cff9b686cc66ae
SHA1 326846ef0d209b4813a1609b4355bbd60c3fba37
SHA512 b270673626b448e1d219723e815fa1838ddd77411210509b330687c9b70449ff4bbc06e91a14d39733da7a1551b97fdb87a5b2bf429181084043b9ef93ffaca8
SSDEEP 12288:4jHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:4jxZLcvDaktGy2CcYaqOCDUd
TLSH
T19B45230927DD1446F79A03F78C7B3464885BBC6A9283B48FB76F862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f4b3518449168cba5f471d7843d3299cc7544c0df6cdc367d5b094200d39e550
MD5 ce559af87253d58fbcaeacf968945741
SHA1 a1b897bf95d434408a85f7c599b6d985943ec81f
SHA512 b400b7d6e4c3ffe7d4787c3fb4fc40eb26ebab3689328018f9b3372a2a60e1967c110230f81be9c2caa52e3577ed6cd40cd0ae0f6c5144479e60c80446fc53a0
SSDEEP 12288:DyPz5L8gHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:uzygxZLcvDaktGy2CcYaqOCDUd
TLSH
T15555120733E930F9E277427ACC622911E776BC3207519A9F13A447762E361A59E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 743a7414d3fa1f0bcb27ebc1a26aef4c96a9d96eef91360cbf345567984e853d
MD5 56ecf80b5e6eb9ecdb1cf4b0e11dc9b6
SHA1 97019a2a9dd26ffff28b7f1360d32a47007721a8
SHA512 e082350eb1687262c02277636035dd32070f59cac89e495a34dae433ab252bb45b38eee141a3b0fe1d84972df49258fb48e789fe441cb0553d7aca38b06c71e5
SSDEEP 12288:/nHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:/nxZLcvDaktGy2CcYaqOCDUd
TLSH
T17B45230927DD1446F7DA03F78C7B3464885BBC6A5283B48FB7AF862530BC06F5589DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fb90ce54d08d3c2afd0e21f577303ca7da8aa92cf6d0dee3ebc347be8c24bd05
MD5 0e8ca1eacbf1609c292f2f9daf4f86ea
SHA1 974788aa7ef67a743537b4a9d31ab4130144d177
SHA512 f6c3982413a53bcd6e660b0f91050553dcc7df1ab9aaca54804b52a592e10c5a644a812c9d4c14f908446cb18b088be4d5fa59fd7af23897dc1e518b4c96d4b0
SSDEEP 12288:RnHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:RnxZLcvDaktGy2CcYaqOCDUd
TLSH
T1C045230927DD1446F79A03F78C7B3464885BBC6A5283B48FB7AF862530BC06F5585DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 64dfd5f664168d48284b13ac9de3a91bdb8309edbb3f67873dc8ed70f8d379f0
MD5 cb382e65137f23d7ee6f8f6a3acc590d
SHA1 fb59de02cd1c22615a62cea0531e588823ff96d7
SHA512 1d3326838792be210cb6880fda892ed4286ea19ca6e3db5032c3a3feeccefbd15c247525e315c3836802ed252c00310adbb08c514e5d793dff4186afdb7bb8d9
SSDEEP 12288:wyPz5L8gHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:BzygxZLcvDaktGy2CcYaqOCDUd
TLSH
T18755120733E930F9E277427ACC622911E772BC3207519A9F13A447762E361A59E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 dcd2f022133ed220337b1e66563381aba154e2d8d5150c772a82e94e8afe75b5
MD5 167ab5b4e1c74db0df0a057c828a5fba
SHA1 de5d0821d1dcb5658fe3124d27672c77553878d0
SHA512 47140a610c51d2e03c8597573edab3e7206b66db3076351d31dc6373c2708c634234a9f37e94e779de2334b63409d356163626eab817f23f1c7ffb2338f98306
SSDEEP 24576:fT9aLl3z0zDmxZLcvDaktGy2CcYaqOCDUd:fTQLljndcvDXtd2CcPCDU
TLSH
T1E4650194739418F8EDA7427ECC265816D5B27C6A0760C60F13F8366B5F372A11C2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 25938a01548cd94b770e0f5d4b1bcc11297a40093809c68bb4f633235b202b00
MD5 a0a8249773508c201733c18a6000eea3
SHA1 bef5409841a6dc9fc977ad54304d5360ef7d5b0a
SHA512 eddf07cee3b6a54a3cc1b68eed60f173e0c3a157069c28e578800f27e6a94e2538450a5973fa6cc97e24c027e06729ceca1e2444eaa754de05d22174dd25fabc
SSDEEP 24576:z3td9CHKy7GZaxZLcvDaktGy2CcYaqOCDUd:Ttd9CHKyaSdcvDXtd2CcPCDU
TLSH
T14375CF90F3E814E8F1B78A75CC765511CAB67C5A1B61DE8F03A8261A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 254cba2bc5fd8bb02043a3bf572f27a46a5a11ff7e81cc4ab2e8951427cfcba9
MD5 7ce3b01794e40f1c5b71ae8cf587d64e
SHA1 1c9456430d8867a4eac8773ce463e77d5bd4ce1a
SHA512 d73d7f4b9126d86f8ba7a830b97b19ed3fbaf3868037643b1842bae949f3df32d283cce3ecb6eed834583bfe7d94fb47597628f07c07fb2a87eb03a877c10508
SSDEEP 12288:OWHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:OWxZLcvDaktGy2CcYaqOCDUd
TLSH
T1DF45230927DD1446F79A03F78C7B3464885B7C6A9283B44FB7AB862530BC06F558ADF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f5fae6f80ae14e374a3615d98727b206b711f286243b68c3cc7d4bbfd37286a1
MD5 f7c9ee68743d33cb8479de4a4bba24bb
SHA1 1f22ebd8ccf013d98627ef2ca07b7f9ced5bc58a
SHA512 65bf01db14c4f682d40c5c3772ec370a76cbdc68915fa825269dbb0803168f223df2d57cbb869e2de9b8a2f03b3ecf1130c2666b3e9134055e95774a8efbfe26
SSDEEP 12288:EAHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUdn:EAxZLcvDaktGy2CcYaqOCDUd
TLSH
T1B445230927DD1486F7DA03F78C7B3420885B7C6A9283B44FB7AB8A2530BC06F5585DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8213f1ac8ffbeeaf7e7dd04c1571324e49fae30cdfc4e75e5da04f002cd05953
MD5 1f3eb0753a4406dad03352af572670ce
SHA1 832388503e5f7209a2a4f7ff8a3855213e75bd2d
SHA512 4dfef4fe549433830b6b68e01b919165bfd4cdd838bdb73f5421678125ee5e253ce4964f9610f78d8d67169e48e1b1348e01730a1e78d4c7b5bcfd54f3d9082a
SSDEEP 12288:0pHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:0pxZLcvDaktGy2CcYaqOCDUd
TLSH
T1D345230927DD1446F7DA03F78C7B3464885B7C6A5283B44FB7AB862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 873a2027d18952097b4f9a3d829cdcedc5584c4125b37f46d00c7d8210ec7efc
MD5 347d43535727ab8fa516ffc3de888ffa
SHA1 edd25335d023eb689a440adb4074d9bcb2abed5c
SHA512 3da08d75b79e27bfbbd1313a76d0d4d233f6db4ed78760786478416f3f56c02136d50514e7cc67a67abadfdca65bdca2d528406591a01ffd5252a986b9393993
SSDEEP 12288:EnHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:EnxZLcvDaktGy2CcYaqOCDUd
TLSH
T18345230927DD1446F79A03F78C7B3464885BBC6A5283B48FB7AF862530BC06F5589DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b84bbd3c97b7998f6731c7ab1ea7a4fa709f2ec1f6121d1f55e76fa4ee7dc898
MD5 c73ab30ba44162a9c06d477634533cc0
SHA1 7a8053aeba5e9620036dd6c36878f8fbc7e8845a
SHA512 edd9497b8aaf7709dda45ca01bf7dbfbe029e4439d563d8d1c612d1ee5d09e7106e4558579ce3ea6fb18ce6f8178478101ede2834c048fa7dd6e6422362d9d0e
SSDEEP 12288:pWHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:pWxZLcvDaktGy2CcYaqOCDUd
TLSH
T10A45230927DD1486F79A03F78C7B3464885B7C6A9283B44FB7AB862530BC06F5586DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1f30fd16443512639f4444e89f10268f89fe0a29eaefda40caa6264ea7b23c2a
MD5 3b889bd96b7e91e5c4c27b32693c99f0
SHA1 71ca436b69806cf939fc49461d203e65a145c4b3
SHA512 056345840a3370e271c6d2bfa14ab6f9ac93863ccbbe02d159f3a8a0d9fe435601f9fa3ab4ad70d9e1e534c663664ff401a62405064558fc1193cb38d939d6ed
SSDEEP 12288:W/HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:W/xZLcvDaktGy2CcYaqOCDUd
TLSH
T1C045230927DD1486F7DA03F78C7B3420885BBC6A9283B44FB76B862574BC06F5585DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 222eba629d6baecada59250b0997f21a79047d080a2f8c40d6a24c6a221f8196
MD5 c1651063179631b4d64f5d2853225160
SHA1 d66c796b0d8afd4c50bc961fc0e6b7e404b0f4f9
SHA512 fcfe4ca6853c129e404ef4193e8d86ff3be0e4de4dc3d41d5df2b865acd8695d0ed9112c6bfabf2d5fef8034594bb43e52f8e62d33e7368ade047f0c3d25140f
SSDEEP 12288:uVHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:uVxZLcvDaktGy2CcYaqOCDUd
TLSH
T13945230927DD1446F7DA03F78C7B3464885B7C6A9283B48FB7AB862530BC06E5589DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 fef62ab6920fe890eb404b1087a9a3c142af244f79c19756d96d9d35882b6f34
MD5 590d72be6fdd47a6286e6d40c1e541b4
SHA1 ba29061f6b998a6e61a536918c4f075085a99a3c
SHA512 8faab1763bc06b3c7d8353ae2aa1eb8d6112fc5cb4ab3f26a1877f6395cf306a5a0c6749246c91058fe347566c195ef700df554c3b13811e62772c05df1b1794
SSDEEP 24576:0fwvok9RX6wkyAIzxZLcvDaktGy2CcYaqOCDUd:EMnYINdcvDXtd2CcPCDU
TLSH
T14585CF29EBDC04E5E1B7827C89B7460AF6B178691B31C2CF129A536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f89c46fd528133c83ab087b08e8891c04b136227e377a62b0de84c791b0c57b5
MD5 f43a273bc1de982c5bdffdd0830c7af5
SHA1 c2b5a56c4e0729de44bedaa713e78fb66b625d2d
SHA512 cd29485abfbbab99c2d9bc59f6d2b3e3b8920d2fa08de6582e5a9e943ebede86b2f46eb1cb73ccd8924649c646f4a87d6e8733bad406eb0fc32691b971ab70b5
SSDEEP 49152:uYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YdcvDXtd2CcP1:6ySzPYmDXtd2CNDU
TLSH
T1D4066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3b6d69736dad995a240895c00539197881c3c42a58c3d6c1ebc2eb251911c532
MD5 bf341f597597b2d0eef712e006ca39a1
SHA1 1bbd0607a6b394349ca043b5db7557ea100eb0ef
SHA512 d802cefe0f930cf22e8469a7c45582062e7fc2d4e9a47ff13ab0aec09dc21ef6c0db446bbafe75315b74225f88b27120aac95d1897880f0c4c283e3607599a54
SSDEEP 24576:S47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYkxZLcvDaktGy2CcYaqOCDUd:S47JUQj4irIhCnDHUPfF/odcvDXtd2Cq
TLSH
T16E65AE1DA3EC01D5E1BA827885155A1AEA71782E1B32DACF1270837D6F23ED45F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bb05cbb2824732cdd0be4008623ca990d3df6e98324d2b94f73e5784bc7e2a4f
MD5 67695b395ff334a5cb183494ad5355c0
SHA1 b0b2823d179ee980aa69828a0dca8a07ed54c876
SHA512 928e94f9ea131dcd1f9a296d139d2d5b70989392c2853c8be778862b5a36c24e56febe65dd1bb58d97f5ddfb555a3dd1237083e2174abe720ae10644826bc4e9
SSDEEP 12288:KGsfXHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:mXxZLcvDaktGy2CcYaqOCDUd
TLSH
T1F555F109D29801D8D1AE12BACB562900F3237C6583E2E3CB63D1F53E1F791959DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2bf5009c88a473ab83a49f1d8e72eaf98b148513d41bba074225791673a07aea
MD5 97741a4328f23c84db4a042e65bc73d9
SHA1 c2fac8a822ee2a4c624b1938fe90eb8ded890d71
SHA512 32d09c95315b90b9f61a0fcf6315d3ef2c2dd2c960d2c546c811ea5f0a906d68050b7a837ce3df676581d4a60d25c042262119e89abc4b23560cb3f00e69d2d5
SSDEEP 12288:0bkBWVU3fXx4fmxYgtv+2vcpw/xrbPiz7qiF1ITCgrntnsHJJz:0osVUPOgtv+2vcy/Viz7FITVTtsHvz
TLSH
T1D1353840766AD74FC6A940321E33D5CCA7707D01FE45AB0372C89B3FD576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c6a75c817c7754e0ebac6cae97dd83f4aec1749f04b84024946516c5847d01d4
MD5 a19d69b38800d828b89fd14c862f142d
SHA1 4c6ac1ff8e2500b17004becad4cccb703fa0899d
SHA512 6ff117bfdaf49af68483a89b1cdac3f9fa2c28020a01349a35e83d3cbb19dced715b922c9d2b67d77a62beff10ecb0023db8e68a58c6b2c6825ebc76a46753df
SSDEEP 12288:39xiPNPogtv+2vciWwu3TYD3qOxM7NwpQjd2YVP:Tgtv+2vc72WP
TLSH
T12A65E8819537A3CFD0F62032076A5F4CA7A4EC06B7056F2673C8453AD86A729B5F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dfb9f8b4c66de9a764a4d0ca576fd03238a77a668d0a258418fe5654aa6bc119
MD5 41f825f5573c90a40e3a115677733a18
SHA1 2839c62ca48b7d60e33c5185f0c81225a75f8548
SHA512 1e4b743f193c75aca4df2899d629e4df8e0c44d2b95a7cc0a9dd095485b73679ae536299f91257bab454b8eded31ea17f049e6bb467e494b1a70714ec3fbe362
SSDEEP 12288:U07vHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:pvxZLcvDaktGy2CcYaqOCDUd
TLSH
T1B045230527DC1846F7BA02F68C7F3430441FBC654782E4CFB66A976930B80EE9DA5E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 646ea8a56e413210da0c4cc3ec01fd6caf66c1b5231211a1e45f541c39844dfa
MD5 582e9e18bee1b199c44e31f28815beb6
SHA1 fac4ba46e710178669755ea46bbef31b374561a2
SHA512 50c342d3ae66c0fbfbccbfc2d86ef7bef91eec553bc29630ef8d91783f993cbedb9657f124f015b402fbbc8ac0a65e9f2e5c9ef59a880ba74524d496687bfe3c
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYxxZLcvDaktGy2CcYaqOCDUd:7gb4mBIBhGF+dcvDXtd2CcPCDU
TLSH
T1EC65AE1E22EC02F5E1FAD2B8CDAA4417D6B278160732D2DF1251426D2F3BDE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b777906f2816db47df6ae7f8509b4d1eaf32eafceb5eb771ae826a9e5629f34b
MD5 5c7d04cb250d5dd95b7fd28b81447567
SHA1 f4a5c9a9ca3058b34e9c8e1a52083c54f7da9b0c
SHA512 2341ea3f1eaa5d9837c21c9b545b50b701a879198dba3f3300cb05e864fdb93f774dd8cf72ea7e75495d92b2861d130fb79e063fdf72e6ae1d6098fff0aaf7f6
SSDEEP 24576:iG88u8FpJqH1Wzria7/mUxZLcvDaktGy2CcYaqOCDUd:57ZFPqVha7//dcvDXtd2CcPCDU
TLSH
T14E85F12577E401F1D4BBD13889964663F6B2B8250360EBDF07A88B511F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d2dcff44093fce9299ac66cce91474255b57a8af5ef0719dba8af15058b7e82c
MD5 cff01964f71b804a498a0a766a9677d7
SHA1 7ef6d4ce3664c2bd0721b28eb429897e8eaf2241
SHA512 8a2a3f772243c14f54f3bedd15d04238a33537e37f1bb8ac30d3beca21ab8cbf819c1927875eb40c52cbca798154351aa00f3a5448fb1c127d914c0b402837e4
SSDEEP 12288:zHvUrBFrEjwaQoHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:zPUr+NQoxZLcvDaktGy2CcYaqOCDUd
TLSH
T11465F21F22EC18E5E776917D89465619E672B8620302E2CF02E1817E5E779ECBD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 937f50b6092ae8c470447c7e1f2cd16f82eb0be6420c5e60b0d029edfbb9db60
MD5 7ce40c0f612dd21ee104684921c80331
SHA1 5307c50898f117bd787f8bc9f8a982fe6e7b99bc
SHA512 20ddc0c970d0342a7eb81c0bc733644297bc09e28a6d051fa32677ef3b5b0ac94917f682bfd0b9cfed8680ab2477c39de9f2a972f9477b58ce1fa57dcba369b8
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCdcvDXtd2CcPCDU:xG05lO43bPmDXtd2CNDU
TLSH
T1B5D5C06E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 02d8de0bcb789265201aa3678a31f68a9e1cbd2c6e7ffa84f8295c7046fe740c
MD5 8b599c272e6a07664cb5ee2028a18e1d
SHA1 77248e5a04a3a295ada84cd4f8fa675cf9393452
SHA512 89a8012848a94a4126452749f216677c06a67fe21d883f90b937fdc85b1967b6c392d5177eaa950f6b32f9b345364c33923b20c69f35bacbc1b295208574bf1c
SSDEEP 24576:Kfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnSxZLcvDaktGy2CcYaqOCDUd:Ca5POZ39Jt2pasx2+mqdcvDXtd2CcPCg
TLSH
T16365BF5EA7FC00D5D5B9D17DC583461AE5B1342253329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7df4a2940fb5356058d964f94371204f7b08d30145b3af1df3e03ace682583be
MD5 5a5fb213c895777830287f52001b2664
SHA1 a3c08f12102352e875d4d855f1f149aa4992085d
SHA512 c903976db329b653849bac9bddda691b36826cd86fee9884dc344fb6067aa7bec5c9c2fbac5b60c2067c882b021cae48ceb25516d1536dce676c555b0afb7c98
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkcxZLcvDaktGy2CcYaqOCDUd:cNc/zEOVHFfdcvDXtd2CcPCDU
TLSH
T1B2857B1623E901E4F5BBE1BE89779546FA71786513308ACF0291851B1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 825a11ab33c301f72d2a7ad9f6ba6d24121f90927cef02b28e3a1bf78f317f04
MD5 77ed64f7cbcaa759ef21fcc096f27afb
SHA1 f3d0167127bb1327cb77177e0e73d2a29ea75e3d
SHA512 668037a28e8d72612255a9814ff7ec7b7b71538c1e88406b041189104ddae85998a92f2c61d4d31b619f242266fff4317b9b446da7d679e00ab40453d30e44fa
SSDEEP 24576:wtkNvNnaFeYhJNtmZBmGxZLcvDaktGy2CcYaqOCDUd:wtMwBtOm8dcvDXtd2CcPCDU
TLSH
T15055AF2EB6F806E4D1FEC6B5CD238512E6727861073292CB5390C13E1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 64686c13e5234d69335582687e74548e06c2f9d8b9b905b23c969b7f0291a939
MD5 643082c76d66dea83f53c794af4fa628
SHA1 7e89935563ed478e84682a8a5dc4f48c7008af20
SHA512 ccc9bc1e0936cc1b052f722858e5b3e71464ca0124f69e7974fc84199eb240a840b2c2e4abe01209410827289228217e64668c062bc521d7ac378b9c49e6e1a4
SSDEEP 24576:UD3FHshBIYQgA7xZLcvDaktGy2CcYaqOCDUd:UDVHeBIAAVdcvDXtd2CcPCDU
TLSH
T19575E13DE79C04E4E57BC1BCCA635906E67238A9032265CB12D4C1BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-7-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1308-1-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1308-8-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1308-26-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1308-37-0x0000000140000000-0x0000000140678000-memory.dmp

Download

memory/1308-0-0x0000000140000000-0x0000000140678000-memory.dmp

Download

memory/1620-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1620-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1620-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1620-105-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1620-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1620-310-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1744-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1744-327-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1744-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1744-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1744-85-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1744-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2604-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2604-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2604-313-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/2604-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2604-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2968-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2968-276-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2968-66-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2968-60-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3648-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3648-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3648-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3648-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3648-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3688-132-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3688-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3688-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3688-130-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3688-124-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3844-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3844-23-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3844-15-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3844-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5140-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5140-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5140-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5140-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5564-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5564-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6720-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6720-54-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/6720-52-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/6720-44-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/6720-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6988-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6988-112-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6988-118-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6988-309-0x0000000140000000-0x000000014027D000-memory.dmp

Download