4917626eb5d101d2d4c86a263f6cd58d8ebdb629e2357ac02adaab208fa6a412

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe
Size 21.8MB
Sample260730-gp8jysvsgy
SHA256 4917626eb5d101d2d4c86a263f6cd58d8ebdb629e2357ac02adaab208fa6a412
MD5 0c5dc82ee8a77b391a8f415f48a90757
SHA1 be7c648cab080f115514044305ed2de711b3e388
SHA512 4be723a14e0709e097398696e909812bcd85777ec3024c701a7b16d5f18ea9c064d97e3180a0f7f382521c599aa29ca9b19c8d210e06c82dcfd0d46187a39122
SSDEEP 393216:Yec9gwLPOnKkMQB6shbp8TcLjJw4UfqWNBFBAe0v8asquXDedDFRo:Mg2QB6i8TonUf9NBnAb0Jed/
TLSH
T17F37F146FBE20879C876C834C65D9236A6347C455713A6EF2AC877143ABB7E09F2D780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2456	elevation_service.exe
2752	elevation_service.exe
5868	maintenanceservice.exe
4932	OSE.EXE
1280	PerceptionSimulationService.exe
2528	perfhost.exe
2136	ReFsDedupSvc.exe
1468	SensorDataService.exe
2916	ssh-agent.exe
5004	AgentService.exe
2188	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4497323683806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e0faeb7e81fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038c38ab7e81fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075b15ab7e81fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009928c5b7e81fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e9ba6f8e81fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000631efcb7e81fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2456	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6108	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe
Token: SeTakeOwnershipPrivilege	2456	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5004	AgentService.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2136	ReFsDedupSvc.exe
Token: 33	2188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeDebugPrivilege	2456	elevation_service.exe
Token: SeDebugPrivilege	2752	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6108	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6108	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6108	2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3100	2188	SearchIndexer.exe	104
PID 2188 wrote to memory of 4172	2188	SearchIndexer.exe	105
PID 2188 wrote to memory of 1740	2188	SearchIndexer.exe	106
PID 2188 wrote to memory of 2112	2188	SearchIndexer.exe	107
PID 2188 wrote to memory of 4852	2188	SearchIndexer.exe	109
PID 2188 wrote to memory of 5340	2188	SearchIndexer.exe	110
PID 2188 wrote to memory of 4316	2188	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0c5dc82ee8a77b391a8f415f48a90757_akira_glassworm.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1620 1616 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1640 1648 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1620 1616 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1640 1648 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e2c0f750204a520221904eb0963ae0eb4ad39b7947d204acb4782fb3819525d5
MD5 4cdac4ec5673d2e984b01c786f2bdc04
SHA1 562be0bbbb43fb2ede8a74cacf945ac5cdaf6631
SHA512 fb50afb511379aa907c7c40c8dea690a11b3f9a8a61d8031d1e944e70b221c436140b2bf5238c232b51dc7a49864844a29956d143d2c243a9e74e6783b2a0b41
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn85SW6H8DS52tdDpbRZy:x3q6HjBt5SSDntdDpbRZy
TLSH
T1FDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 744636d2e167ec00f55a6bc9ac24aa94bb3dfc3cf5707829475ca3605bda6d3c
MD5 322711ea470565d0787de6af6164ce1d
SHA1 d2e0b88ceeee1f35b42e6b268d4e7562fbd860f2
SHA512 f5b0687feac286e445c139255e13736ece1cd158490a74818784634341264001603bc25f8c7211f3fb44e7445eae167d4bd6b377144c8b396ace74d3ca4f381e
SSDEEP 24576:mXYfDtczA75SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Ftco5SW6H8DS52tdDpbRZy
TLSH
T13F05022873D008FAED6B8279C8B28511EA33B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7540a307083036e163affd778638538ef13479e093c9c2a718ebe576c35926c4
MD5 701dba89e606d06c81afde461815f2f8
SHA1 be9069e108352a588399e8ca14e0ca0212581ae4
SHA512 af96f1b9698ed4bf58cca8236453c02d33a792c7e8ba8366a6f1b43663fd6194e092de5a295784571d57ec424cb9423e2aa409573bd9aa1b9d9ce30c3c0c07dc
SSDEEP 24576:V0Le5ji0hmxirMW5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:VPji0Acx5SW6H8DS52tdDpbRZy
TLSH
T109359E55F6748332D073C0B9C5D2A69EE97130865B308ACB4286D77C7F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2a3416ada1616195e056fefd947031db835310637b94bd9eac16f37e745b18b8
MD5 8a5c383608685f514e6fff0f8e86b443
SHA1 a4e587fe42d3bf3693c698953c391cd8c64021ae
SHA512 7e481461ce955eb288ff3d40e9a487ad072e05a9c91ddfc66bc1ce83cfdd0062eac02c63e5c0142420fe075ab62d53356301f6d07ed3ea28383cb6a520addb7e
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyu45SSiVw6uAX8DS52tpz9ZRzbPmSZyo:4/ezSC6vUzPvxHjyl5SW6H8DS52tdDpO
TLSH
T1F0755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 56ea627e3053bd52aa89e331e7c6d7b778b1b8a10ab3faf207b49dec5a12cb18
MD5 b67340e131d100be4abf99b218c44a6d
SHA1 eee811638b0e3b55173a650c5aa0d2672f5cd0d6
SHA512 b1ee4c5fc10e61df9d7d4347f68a552c465a4547230499940db26d143885dbdff5a95eb85653094fbb73d284f5c40ad7380dfff73c06d400f75b1058f7cb0648
SSDEEP 24576:mVbqPb88hv/l+6H5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:mVO88hXl+q5SW6H8DS52tdDpbRZy
TLSH
T153559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 94accca8d75fd712dfa074596279cdd59bbcd7effc5d1451d29694e3990132c6
MD5 091e915c3c69b2aa54787bb961ba2e32
SHA1 b6f669135999c25b90ad968805e3f21e585a2c25
SHA512 a7d141e3150e92d1579b7df0fe0f343c9bd7e494f9be3fec95615c1209414b3a055b655140964cddd21b0e10324280b0c9c8a5536ed1b8878612ae5f9beb53e5
SSDEEP 12288:LRC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6X:LRC5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T107C423C4479030E7E31F0AB3F1FA96D4DA18EDAD8404663B4E717687CA3998FC576426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 698e50ce009b98b443f4b8d18055aacbe74df9a1b51c42d0d25021dd11d3b182
MD5 c5ad02befb64caa1e45aad4fa6fd71ba
SHA1 0a1a6e63c6d7b778e6bcf068c47e6d29437c57af
SHA512 9b012ac90f84a2ad6d619df96a23741739c26f96c9ebe5b94d2317b17a7e89b10033cb9f8971c2e2fb5351065b3211749a1e7a68b22553a05ba41fe6c5f86b67
SSDEEP 24576:lJIUP5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:lJIUP5SW6H8DS52tdDpbRZy
TLSH
T1AF05DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820ECE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 deabf2ba2a4465a7c990da2760a44b6eb7ce6a4af89e5ce52f09b19b20e432d2
MD5 028a0ca474ba913201daa6cb1619b004
SHA1 acb643fd8b343e20b64b46a33ff6e0aeb5504322
SHA512 88903e9cbef7174940a5114fd7f4ca13357d0f8e85cf3987f9c499916abd713c11e1514d32a3a7e0d650fd0e9ce70bb9072d3e7483ff8244f3da1d6ff93b31fd
SSDEEP 98304:nQvGAdlCEL8c/yRNw5CI5SSDntdDpbRZy:QvyEYc/y3w8eSintdDFRo
TLSH
T163267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e890cc0e4a0388a83ffccf202cfb464139de45b6944939aec9109080e3bdec12
MD5 39262a94c1458a1d03717b4036f1e2fa
SHA1 e0762e7a7f32706cda9a8e6c29584fbfb828d5cd
SHA512 7775b0fbee6248c664773ef8e046fe249f2b743743f656f66e687b03b6fa3f996893a3cbe65e332dbbba353af2718ec2b440ed8a3dd477410558af954990aaa4
SSDEEP 24576:VdewsAjB5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:bljB5SW6H8DS52tdDpbRZy
TLSH
T1E315E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 48bff4ddc4212daba3098071f62a6a5d666e0373f924be79f3df2aa59fc35d6a
MD5 77f65f5039cec4c4a1986e25dd50ba3a
SHA1 7afc99f5897d9ec6f57ff2e7bb9856bb0bc06458
SHA512 aa47a8e7db2352a1bfc6d4b50346c81a95904e542e7ad7f378f9a1f18ed40ab5d621c74d34092265d9de1030811fbd9941b96b22301c90995937e22d83ebb281
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHbSintdDFRo:0UEtQevvqc2W1cpV2EI32uedDFRo
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9a3e959798f7291d3ad5b168f9717d8af9435605a35064b298ad9a845202e60d
MD5 67f07fe05ef9404747726593977dbb6f
SHA1 5cafe732bb289065c4b58137766588b301e96084
SHA512 c29182596dc35a8cfddca7a2ab9825c386df8f29c4f6d39cbf9e32f02599f6e766d1bf074ff715da40c4bfddc20958b8f01fff8c4b51772cd7a733cb79929dc3
SSDEEP 49152:8CbRquA/m2yL5zLfFiV+XenmE3/zh5SW6H8DS52tdDpbRZy:1oq2Vjnms5SSDntdDpbRZy
TLSH
T159D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9747722499f7834604fbc915813fb6ab23b2008da9c4d8d42e7435c8d49faa08
MD5 7e87a4ca73505c08fa2cf978613f9812
SHA1 68ba96d4512ad4d34538c2703d5e2072a0b91377
SHA512 2fe9d15b56881e35b3b27b6841f94febdfd34698eab356c22996e43dbc67f4214eb671c5078a8f5db43425361eaaaeb261518afeaa2f5a3f515369aa6fb35aad
SSDEEP 24576:DAhGLJIFoiwtA5l7S53M5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:DAMyFoiq585SW6H8DS52tdDpbRZy
TLSH
T1F335AE80E7F955D4F5B7AAB899B68570EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e4bb3ed0b60629061ba7bd5da46445c6a76e91fec294eb357860ee8b9a66bd87
MD5 88b13e5dc815fbac8a33935c9ac20469
SHA1 a41dad0d27cb24608e9f3bd078d58b0b035fc4d8
SHA512 2af499de5afe7e7c5c80c8dea0224239cac78e1457f5965b9f9e6261e85041a249a87b9af29259f280226a86d1eaf2f87bcb77d0621a9e65d6280ba412f00719
SSDEEP 24576:CwuoOWF5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:CwDOg5SW6H8DS52tdDpbRZy
TLSH
T18105F14533A41CFAE56B4239C597C136F7B2B8162A24D72F0B60C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b7c34a2f273be53eef47100d296921e4988319711f9e80396effe4d357340e0b
MD5 f981da9053b3bcf9c89192e7a072c807
SHA1 17bed362a664da00e1d90f251cb0d90384cef1fb
SHA512 09cc5e779347b462da2dfbc06f1725daa6fc8155db89925e1d089fd744cdf8d5086cd6cffc489d4e7daa55de862fbfe399023a6117db32003e181cd60eb893ff
SSDEEP 12288:oBZ1IyR5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6X:WZu+5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T19CE4128923E430FBE25B427AD9F58685D771B4A6533443DF0A60429B5F33AC64E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f9446ecee891f524ea74cb72ea73687427c203badce73553b61a3c8cd8cce6c7
MD5 5d687b6200bc08b3ae3084acc47c4fb3
SHA1 9ae519cb6fe99fa13e121376a233c588060cd491
SHA512 7e43a2e3f8074b96c15dd7d7f6828c36c65177eaf1eec70a328cb212eefc84790bb931e11636aca720d071370552e239199ffe083f22e42213f78671e263eb0f
SSDEEP 98304:dQRQyi36YOcPQLvw2gAf+PN3D5SSDntdDpbRZy:UQyiKayX+PNFSintdDFRo
TLSH
T186667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 31a4801caa8f2821f8ecb0f7b853e5900ef825b4bd59f45a16c668f61721abef
MD5 a07e8883d861f42920df38e3f2b23c5a
SHA1 c4907ad8efee4d11add8a9d75546edad33e21043
SHA512 6b3ed132f75565b93c2880bf462340106268b29b654fd96d9ad9ec3985d8bff986582f2781a11b736ca84e061b5b165d4526fd48db68ea5acc8d9fc295159474
SSDEEP 98304:MQRQyi36YOcPQLvw2gAf+PN3D5SSDntdDpbRZy:TQyiKayX+PNFSintdDFRo
TLSH
T180667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 224e5ca1fe7774a4e25dc1148a7726c602f6aafbee712cd512dc96d973ed17cd
MD5 ddb3a9e0390594601bb078f4d579e846
SHA1 db266c707b2cc0afbc619f3f271a0b6fad57e3ed
SHA512 4ad90d0e799c63be317d0fd20e9c4b8bb758c5344b0e87a765da148c2d8eca0166da5826acd921ede849b0a233d485dd146c8eb731dfd4f03212223ef7380717
SSDEEP 49152:w68Qg55nhheWu7PNU3/x5SW6H8DS52tdDpbRZy:qthWRc/x5SSDntdDpbRZy
TLSH
T11DB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6696fa50e75b407bd158277b30860e038de0919532ea7e6aa606bbfbc814897f
MD5 023575beb128dafdbf3b06e53d452238
SHA1 a553edf2ade1f8c57b9a3a31d2f4047e5608db8d
SHA512 824f5c06d2fe474cc1367b4fc36e68705098932da024590cca6f3a803eb20cc02ae7e9d83eda27a8b9ed13bc35fd7ebaf098cb83e88498af2d26425eee19a77e
SSDEEP 98304:7y5112gYy5azzVvL69nLKnhZC5SSDntdDpbRZy:WLIHmWhqSintdDFRo
TLSH
T1E4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1f60693889115ea3dae1df2afbfb8dbfbf50f2c8b77fd458fa76524b882d0941
MD5 28d89de9c5a8bbe5b24d30b72b786b48
SHA1 1040c1bd7c70c89669c06b1d883e5d17859494a6
SHA512 b98a93c991a97d2278b317f22789d09d43985623b6b2b163d65915140fa4fe0d1b4ba08bc8e46b110bbdee398c899d0261e27ec468cfcf8e2dcb7b1a723ab6cd
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glp5SW6H8DS52tdDpbRZy:3u6JmVxd2dp5SSDntdDpbRZy
TLSH
T1AAD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e388af518d7baec4e25976940fc20aece799cd05dbf17337a4af7a6a9d96f95d
MD5 9b86cee39db6102aeba7ab4f0c4c6f4c
SHA1 4481cbf74d33cc12a3dc324702514127ad7e79d9
SHA512 28af07b77795efabc986a04be14c5c23093bc7b97f8b9ff3dc2431901b216a27b2e9256fc47180562d5bcbd97afb1e2893819303cb1727df61ce57f1a31740ea
SSDEEP 49152:u1hpsNoJpF1A6UU44CwH7R4xv5SW6H8DS52tdDpbRZy:umifPbRs5SSDntdDpbRZy
TLSH
T103B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 162c1319a114c4b0fc2d9478b7be7e01fd20c436645780b24b2ea2ae55ae8f0a
MD5 25861d1c90efab5257d501b121cab884
SHA1 29ebd086311fc24688123d61ac5b49672b5f2674
SHA512 8723bf7aefd20aa8eff8a16dff762477b10c20523f7f9770fa90a50360f45906aca9ff5af9b614b890329182ab81d7bdc9027e99d6a83afac9fc3337fae7e9c4
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHq+5SW6H8DS52tdDpbRZy:I5dKTi61+5SSDntdDpbRZy
TLSH
T107C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65793fe387bd17439f5bbe4ed391526733a6b35da43c1526b45ed0dffa1e20e6
MD5 00a6ef212a03b84f8b63ddcedb948a09
SHA1 556558ba9928f2492adcd61a7779cdf92e632b26
SHA512 bf161dbab77082e04910b210448bf8d9b0b2a2c6334b539624b8bad6105d0239b7fa5f2c1d0430e62b16a4ef3fab0a14dbaa1d4db17386e0c90db12047404809
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5w75SW6H8DS52tdDpbRZy:PX2iyphA5SSDntdDpbRZy
TLSH
T1E895BE13F2D900E8D05ED175C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0e6a3c05b121af5c11d8b5c7122673aae3b7cd8d6cb9be79abbd9cfa0fa71cca
MD5 678745938c076233668a5debf5afe9c1
SHA1 a9eeb07842ed5b666ca3c332d3a5a39eb32d9669
SHA512 7d6507e0618fbe69d0578a800e44d44d6f144e9c215469f064ef4afe99c10d1bd5f45ec84f9a119346fcc7e86d163859e136b2889d4924ab91018866d2c46232
SSDEEP 12288:yq5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6m:yq5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1DCC423C457A121EBE30E0AF3E1F686D4DA0CA6EFD408623B5F716147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4d7606c89526fc8bf7707829b8bbd493d4d6840ead13711d1dc445b4353c704b
MD5 1829be13fdc06460b0933cb0a3a94f2a
SHA1 55767be2f79040036cabfd09f3fee807f244f94d
SHA512 e397b214fd0f1976ccdc9b347630241803dffaede814a40039af666eaedaa3a178a99dfce00ea6ca0af7f4ac1d4a1935381ce708249179fc0405249f1abe8be5
SSDEEP 12288:J95OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6L:J95SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A9C423C457A121EBE30E0AF3E2F686D4D90CE6EF9408623B5F719147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3b161012a58d562c17568c34f8e822cd6c17b8045765028610a8657c102d803e
MD5 b4f54e712b675288f4ccb59a8391c6a6
SHA1 366447dae5b0dd2850fa81fb922e4ef1297e4a45
SHA512 b78b39d899b27719884a005d8bf322f7db0490d572f07b080621da805649fd8006e4de685a61031546e03bfcc4691c358a48a34d15b68e4c29032439335a14f7
SSDEEP 12288:035OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6L:035SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T11EC423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B9F716147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 243df805a72a3ccdd7865d1f11727f8035ef62646899114efa5bbab706d87f56
MD5 2b8fc6b80dbc4a289b667728f50a86ee
SHA1 4b778a1a4712bb3bcb7725f581627cc8248b35e6
SHA512 b068d2f09621b4a56cf0b3703097f6fe868d8d17f17465b009ab3c9b0b34e669e703234564c8a2b6fbc4e5c4eb399308496ff64bc7d30e0cff346f6194160447
SSDEEP 12288:KVs5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6H:N5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T170D4238417A120E7E61F86F3D1F686D4E628F8EED524A37F4F20054B4F31BCA9935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f14e67fa31fdd4e0ed856088bd2c6c1d4589fae4f7e48cdf2b8093c2c7bb89ed
MD5 4fe0da90c5c96a0b1a2925cd65a9d33b
SHA1 08a7ea4d480b71dcd15631bbaf7840025a52f17b
SHA512 50903daf7a5adca3fd2de7b1da69d5772e910d13c0930f25b85ebda3e4e48c230feee6a9607e7528f62332235d5ca2acaa0b86c4d61a355c476e5ac77391838f
SSDEEP 12288:YE5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6e:YE5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T16DC423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5F716147CB3598F8676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 cdab5eaf0bc4057c1961e27702b9ac020dbeec68de3663fa8399b764e9a70ad7
MD5 bf6e23eae8fa9b30f856cf2ceb6c336d
SHA1 7b9c7776a0ad202048166af1db0657a05484a460
SHA512 55669de889f8ca291dbe1d974f12d7f2878f328b4bf0ec5378d0814dc3e37a403e340e2112c635cba2d0fc075701e64f5bcb750efe24a8407e0f31b2357a0ec6
SSDEEP 12288:BJ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6V:BJ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C8C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5F719147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e7bdd77ec272e3ce2f985c750c62ffd694a6a2dc68433760bcc5657557923dfe
MD5 812ce8a2505e96effa45ea0c5ee2edbb
SHA1 e0fe772f9b09f548f188908201696d625d7e05b6
SHA512 cb912b5c1bd7ff4588d5783fcf8f3dd26e08ad3fd561b11510cdbf854101c3b22f8968ef282c37ee0899ec85e57d01639022bfbf27ad6c965f8864a90178474f
SSDEEP 12288:P15OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6t:P15SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CDC423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5F719143DB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e77c6e990eb3a05e0db7bdca57c774540585c02080a518de6a43cab377eb3d3f
MD5 2927c0ef90c3cb14d397bd06ebb06238
SHA1 1e4e68e543f1f1a21c513f14a0e18c3a76afa8f0
SHA512 6a1093572f6235ec460a17c97667c217dc47f6d769dcc976fcec91b46f952ac46987b1fff17f68deeacd4b63dad62c959924dbd886a97d9dcf203e1b7a9fef58
SSDEEP 24576:mZMSzFVSOd5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:mZMSzfZ5SW6H8DS52tdDpbRZy
TLSH
T109050294B39018FAEC67823EC9658945D6B2BC5A0760C62F07F436675F333920D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 318299e414381b4461392db3bb4cb467a636e8bf9990c06e1dcaa2814f4dafe8
MD5 41101cb4bd7acbb79b65748665dac41a
SHA1 c16457b3dea57a7a76fe949e1e1bf4858926f82f
SHA512 e8272fa87a385a9bf7958c2d2efa0ffa9f5e264142e5c6f18c2d7299bfdc1cb17a6318daa14bd8a2c5a3f486149e0d46eb2dd6c6e944c03a8673e19f030b2965
SSDEEP 12288:uO5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6V:uO5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T152C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B9E715147CB3598F467A428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 87cf1cedb6027977b5b6431b189babae5210d1f5ac33a0bfe99057a152b38037
MD5 a4a62da500cd64380b418a7933ab960b
SHA1 e2a703c26f160bc65dfabe7d7ffa587616714086
SHA512 7656d758d65f365d7cdba0ba706a0d3e19805c33ec4d0a9ea9fbb99aaa048cfc54c72718ebea9940effa37700bd60d5b06c2ce4a4bb49b528e57a8810d31a9e7
SSDEEP 12288:PS5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6c:PS5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T117C423C457A121EBE30E0AF3E2F686D4DA0CE6EFD408623B5E719147CB3598F4276429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 332b3666f1c39bfa62dd5b49813ec7e7bc0cc7edaf3fa42c2b99cde08c0f2458
MD5 452a39ae7f59da4ffb41341b5d2a25a6
SHA1 8881bf5dd4fe615aecd016b21dd55baa901a5bce
SHA512 051f1781ba4223fe9f489f19337ed18246670c80292fee720984d53f1c4a356439ee8ae0e0da631671c5cb2b71adfa53ee73b70ccf7acd66181272e81ca33dd5
SSDEEP 12288:YyPz5L8R5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6S:5zyR5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T18AF4124773A130FAD12B8275C8A20A41F775B87647209ABF1BA047775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9797879e5deb5c14a9f16c4755e1c9414fbc83e723a48567b855a31ef87c2d7f
MD5 69dc0689de7d877007631aa564a9e318
SHA1 27ffdf889031ddccb27b9c9a00ab3587b81ced4b
SHA512 90a6785bf8884fc9db8cf4d5ef33fad0bf7108a855f7e4b3c1a9ebb54b54f5b2082df3f5e053c6e5ff9421ac93265641007ca895670b8f8b13acf686128619f6
SSDEEP 12288:EO5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow61:EO5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T198C423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B9E715147DB3598F8676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 74039f2b4a48b40d587ef4d71908cb7580b60092f9d62890be9677e8a8163414
MD5 80b670f19aad1b163cc970e127395545
SHA1 e310914211cd80fc3ac0a6e37314d311af5ed02e
SHA512 32f4a60e93b37da052a4c27851cdb7a563c55a8b7e15b6d7d4245cdf079be8e0480092da3bf227f8b376ae5cc0ff38b5fb25ecec631d76f42ae2827dd4341c5c
SSDEEP 12288:UO5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow61:UO5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D9C423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B9E715147DB3598F8676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 680ea0cf3f93ac0b169c99cf7f4b59581cb53460c3c6255338c708d95bcef864
MD5 3a60737cdada08ff9014ac8577e0044c
SHA1 b16776a93a933372a6fca45e45a61c667089b139
SHA512 01e584c23d6595cd3e648ad51bbe17f44c0a557886899a50e8e193f951d9f505d63dc84a2ed6f76eb34da90bd21359f9f35d2280a59321dca35ed0f0136999d6
SSDEEP 12288:AyPz5L8R5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6j:xzyR5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T186F4124773A130FAD12B8275C8A20A41F775B87647209ABF1BA047775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 00876b5b6b7f0f603cc367430d0ccbc94728ef8923e5fded8c1bc64f29b2efb1
MD5 ea8defecb388cb485d82e9b07782f94a
SHA1 b10741d9d2d42c82d4ac6176ba3c948554f1fc78
SHA512 000d47e10276daace84a8e6214b8d01c8106231020de8da6327d8125d16524dda0559c881e9bd75fe358d18269691d21041984b4db809930dc5928ba2d197e33
SSDEEP 24576:qTHaLl3z0zDn5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:qT6Llj45SW6H8DS52tdDpbRZy
TLSH
T144050294B39018F9EC6B827FC9658946D6B2BC5A0760C62F07B436675F333910C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1d2fe5638879d96ac2282d9cb47f3ced3369253d6ef888c738d38e580a4dbf23
MD5 12a6c1aef1c08afa7531996751569b32
SHA1 e30966e8cfe40024530781daa97242ea7a565474
SHA512 7be90b88388871f09e6eaa4504ac96258cabc16f8af222a56ac275275d3d7eca17d80d815c9d93406379f1b50f750925fdfbd18a17fa279eb2773c43b1dddf79
SSDEEP 24576:S37d9CHKy7GZj5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:07d9CHKyaZ5SW6H8DS52tdDpbRZy
TLSH
T11025CF90F3E410E9F1B78A35C9768511DA767C9A5B30DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9cbeb6d8cda7d0c745f81cf445c18fb647e426471135510eeda3279466cd53d1
MD5 09ae66fb9ca57c94b51c6552e4442086
SHA1 e71a64463b6cb4ea50457bf5627ef7aa5b2cbf0c
SHA512 5814ddabc990d6a4a3dba57a95bf13c45bc3e5b3d6a7d030ad70d72277a8aed648bc598ea765cef7ff21493ee34866f59f3fc2a53c368bad16d87ee97189ba40
SSDEEP 12288:jX5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6N:jX5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B5C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5F716147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 89b87700c199dfcf5ec624882463a63439811c31d604f34b8007a88bffa25fc7
MD5 e6f75eb19245f1cf2fe80c6ed84c630e
SHA1 fd9eaaa2e1fd44f8ae0fb1ca4bd21f540db621e5
SHA512 240d755ef722d1819614d568bee36d94228311ef6a0bd5c9ba3e23975e3cbbc867733b3e08963a5c8bce79e8efd3d548d00eb956b6d0dc8ae51e66c0819ee341
SSDEEP 12288:Gx5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow61:Gx5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T189C423C457A121EBE20E0AF3E1F686D4DA0CA6EFD408623B5F715147CB39D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 4cabfb90ed82c100db05f185e723917260f4570b516f143a4c3299a56857655f
MD5 600f589eb3c3b3499309a25dd77c4d6d
SHA1 c0df241ec26ff04e159d09a1704639a6069c8c95
SHA512 d753c2c590a311911d01b0d7f9905afe6ab80f72af182a6040cb2c4c80a0a75ba1a655676f179fa9abdd7de6a4f008c9e79325dcc8c5c4f3c96488f8bb7d5a79
SSDEEP 12288:1Q5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6v:1Q5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1AEC423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E715147CB39D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 12e5a5ee9f4df0db5d1151e6881b96c96f8c218bcaa692b3eeb83e1f27642186
MD5 e6e0cfa5021343bcf3de398e8a792411
SHA1 65ecb6f28f5e629bbed4fc2ff1d4dc0f7cd57021
SHA512 f0edbfbcb1eafdc762036e963c1b9266ee04a46710ec863e79acd7b3325b25c22af8fbf59b7b9af497e37ff02f1d6446697581d4d3f840b38a76b8bc1cebae81
SSDEEP 12288:eO5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6v:eO5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T10CC423C457A121EBE30E0AF3E2F686D4D90CE5EFD408623B9E715147DB3598F867A428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 3ef584b3023f998202a6de35d6742146295a813ab71c0427724866696703c08a
MD5 497bc782fce7ffa63e5b6ff1eaccf293
SHA1 0bec6b5e9b7a47797099f93761c56bebda403764
SHA512 fa5a2a4c93a0df4788c538f45eabeed8aec469a44c8d64859cd013cd6c753023bab781938359adfe8fc99d5039072ae81f78bb83f6960723b8c8f605f3c03ff9
SSDEEP 12288:FX5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6F:FX5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T181C423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5F716147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 7a69e0e4706f4490d1bfaf3dccc9cde7280e7a12cfa1d879e46c5bac207494a3
MD5 11ea5a58b4e4332f3a5d0480e926b902
SHA1 af99a310c353aed6bdd8c2de2deda4603d8747b1
SHA512 83ace4100b442e449914c4f7538c5e925520cb4ae15b4a4102aea57d7f4a0cdf89e7e589c4ad3d95883d96cc6af240ee37635102dc1f1ef250bd147f8ae6fd32
SSDEEP 12288:/G5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6p:/G5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CAC423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5F715147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 5b4a62f758f7a631eca8d7613d45bfc04294263c698fee037c8df3d1ffb84354
MD5 eb7df1a89198711b5be5d796dd6d672d
SHA1 d535264ae1f182a6ff458564f485bb8b10cf5d3a
SHA512 1f1444e765a6513483f995a67478a481e4d9ce327dc49e49d7a19a96d9862cdc4a91847121d6416de4771802cfc2f6a4f7408daba55b666e179dca6e7b855187
SSDEEP 12288:EE5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6/:EE5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15BC423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5F716147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a4b553263bcb64de26d6d02efb8c4549dd9dd1414e8cb9ee5dea1d2f65547b10
MD5 9390cc9e4a9086758d653caa02b45fe2
SHA1 b5a17f0869a7a9a77ff4f60acc07d54fa7c4d0a7
SHA512 fad38a8235cddf3602e3eba16b03538ec73a943c773667e5f7edc81e9b9ad1562f8249d0ce8b39e6d3b802d9ab7420b4d0e96a6f1c4770af09892fb212aaeb4a
SSDEEP 24576:yfwvok9RX6wkyAIi5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:eMnYIi5SW6H8DS52tdDpbRZy
TLSH
T1B235D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c250d3bd146691f3dd08912026f2051a9cd45c60b27fecf779d78e5d73419290
MD5 41d3a23222c7d464e9cde87e2936c192
SHA1 90ab8ca774960ea49946bd83b143dcc674308c3a
SHA512 bb60e0bdb210ce6ea69e9b29096b227d91b4f8dad22960df5c3fcaa3a78275e03c91e28bdfcc61eb4ef247fe5d5c67c875e8ae10575e977cfb498b57f95a25c4
SSDEEP 49152:FYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0b5SW6H8DS52tK:FySzPj5SSDntdDpbRZy
TLSH
T1E0066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b07790f5e7e8a58933fe78ef81bbe3df2887c0b87f88da366ead428440d76152
MD5 ae0660078e131b4bc2a2a0e486accc4f
SHA1 487fcd718968ac86313d8204a6bf18e6fbe428ec
SHA512 ce74cd6f5191acd3e7029099469fc9e9bcdb050d552bd92863591c90d1ec04662185d3ae433db03bfbbaef7f0dd77a69d3a6665691752a33136f0addda9bd5c5
SSDEEP 24576:m47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYt5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:m47JUQj1irIhCnDHUPfF/r5SW6H8DS5X
TLSH
T1C065AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 08ce93a70b1d9b377a31a6988c290307016cee8e1cee1e6659660b7e71b7b464
MD5 ca5f8ae4ee838fc6b26b374defaaf3f5
SHA1 e76f8719110def40ab7d21337acc00eef6c2a944
SHA512 7fda100e52932cf021a288fa93c9e55ea2c6670cd03a21b886ded73b1454e7d9ff8c81117320d8eea6517963e56691e80dcd53549c4cac5b20f7f90a4bfd54b3
SSDEEP 12288:NNsf+5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow66:i+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CFE4F149D29412EAC01E5276C7A64A80F3277C6983E0D3DB5BD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 c6be64902be427a2fd81d0b10bc4a9bd590cdfd568e609803fc176aa269de688
MD5 a5f0944ef8eb1e9e6e5882f5347d67ee
SHA1 c38f3eed3b6d6d600c6fdc9b935c7752a163cd4e
SHA512 9a4c0dd509e74af6ce148c3f9e83f474d09f847f25ec70c825757715619f67cd9b892e7efe40b095ca51f82905ea7413dd74998fcea15c89d7143ea7d1f2842a
SSDEEP 12288:UcqpU3fWDjysuVeikOP/QNJ6PkgEdsgiWZX3ZE4J:UcKUPy84wRPDEGFkH
TLSH
T1E9252850766BD75FC6AD40321E36D6CCA7707D41EE059B0372C88B2FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2db62db93b0f43f394e2b91fed8b906b0a8550d099cdd871fc9d27ba9a98e29e
MD5 faabdc9e83fccee71adc351122feb056
SHA1 d3debdae9cce9d46fe47bcd17f9d774debe4b54a
SHA512 a32e365de8268091baabb1c328ff56084df84fb5ac60edfc356a12b3d70e8ff773c4b6a6cc88a7262e837d45c3a828052367a5554e699d4a61a112c317ce0150
SSDEEP 12288:c3bsWOY1ysyoxPDWRQ0DRgSAx7wa2cg5EaBu51Bf44LE8gErMDdAJ1elsDiDuE:eh2Wr+DuE
TLSH
T16E65D7815537A3CFD0FB6072072A9B4CAB64EC4377056F227388593AD86A765A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ccb4a7349d087e9e8eb12ad485924588f095d736b4e3c1db2bbeb57ffeb976d6
MD5 3d2d00a06118b9990dbad5675b051e44
SHA1 e11ad8e1770f4434a07641beb305082346d1df1e
SHA512 8fd84094188c96381c64e117cbb2bad758294d21b862bde39859912c02b321ebd2663b2d86f3ea851dfcc5599e2df8c38606edf41b5c31ad621e7db610d082b7
SSDEEP 12288:HF725OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow61:d25SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T163D4238043942597F22E06F3A1FAC2B4E60CF5BE8B0491FB9D215287D735DCB8E7651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c9b146ec20502012bc1c9b10dd644b73246bd0c53299fbbd269b9f5b87fa259f
MD5 be42ac589bc69c7d20c0a3a297e53a0c
SHA1 65b5360701447c3f532c43366f1f66b371ea2fdf
SHA512 9b69dae5ac966940a83f6b11811e482d1ae679ffbb1ccccc38d10fa2608ccb7560b3f7b5c9b6a5166af2fb61519c1c19334dec692f1393b205d535f06b852ba4
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bY45SSiVw6uAX8DS52tpz9ZRzbPmSZyo:qgb4mBIBhGFt5SW6H8DS52tdDpbRZy
TLSH
T19A65AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ee0e3e2bbd595dfee6c4f89be1830418e0640cf4d836c4f49f947ddd1fbb7263
MD5 489942f0275a6fe3f815c0a143a15d9f
SHA1 99ac040c824850e605b0a087cc59b3a6e0fc5b96
SHA512 33a76814cc1a8b3695a3e544079809a5a13794ab651eaa62adb4ac59f525e213a16b1a4c772285625b0cdcb2b18f605ab6f72277155fd1e2af21dc00ac8a079c
SSDEEP 24576:sG88u8FpJqH1bzria7/md5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:P7ZFPqVea7/w5SW6H8DS52tdDpbRZy
TLSH
T17335F16577E101F1D47BD138899646A3F6B1B4250324EBEF0BA88B521F23AD54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 0f573bdf9d6ae850a29bcceb97f3f65ab9abda69e25a245e64c6d7104709c93c
MD5 b7d4f1266b10bb85d457b8c7bb91e04c
SHA1 c18ab221b526c8daa142f32ee5fe591317befd24
SHA512 bcc3c3a7aeb165d7847bb38ebdc8cb89b092a116704ea263f471ab884c55e71b7a77f1460de08ceed7494a881c3a7cbb35ccaf3d505028f903baf1cac60ec475
SSDEEP 24576:gPUr+NQZ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:gJQZ5SW6H8DS52tdDpbRZy
TLSH
T1D805F15E22E818E6E67AA17DC5828719F771B4660311D2DF06E0817F4F27ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ce0ae1c8087b264c174bab72c7d6a53c525bfd083c12a870c95cdda2789bf4b1
MD5 e6f467b45706b9a1fd94dce4f3dff99e
SHA1 9e5cb21bd9ba7937af3b129d4f430d27a4929942
SHA512 f61a899a8ddeff3394a0020d82faaa141abce0fa8abb66143fcbadf6242692d6fbcde56662ef33ba9ca0935f082663709d659adfd0185eba77dc9ad15020e9b4
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJ5SW6H8DS52tdDpbK:fG05lO43b65SSDntdDpbRZy
TLSH
T127D5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4e231a0b026987e39a03a2b08eb2c7c4c138e4e585bf23262dce7653620e386d
MD5 039f15dcf56f904a2884d7148b53fbca
SHA1 327eb59d5f512346b372b383496378b06e04db32
SHA512 c10a59a0958a8560a42c4dfaa154bd2fa4352bf4793557c5811d82cc2b52fc9704f696578dfdc2daf9353d6098859b7c86250ec04c0748def02d999c2466d066
SSDEEP 24576:5fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnb5SSiVw6uAX8DS52tpz9ZRzbPmS1:pa5POZ3+Jt2pasx2+mx5SW6H8DS52td
TLSH
T16365AE5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b9ef81bd88d1803d947b3bcadaeb01eecaeec8eb37ad933fcef1544ebb3a86ef
MD5 15415cef7d59c0cf9ab3a582c6e6abbe
SHA1 a23e91875809d7e14a888739c0c9381f14a407c6
SHA512 a561a74275c8e7178f4546b872fc1dbbcf5038117e4732878e0f3754ec8ddb1d3fbcb4823141fcd40be0010eb0cbe0029944a1607b4080105c599b736b8d8f18
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fkl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:yNc/zEOVHFQ5SW6H8DS52tdDpbRZy
TLSH
T155857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4c365c8f01a525852efc9ff8b3f74b1925a2e29a8d5194219b3a3fb3c476a363
MD5 f236801749a4f640891c5e39f6d1f793
SHA1 d85c9be39cbde76ea57583dda8a2e09d6f6f89b5
SHA512 b7f0ac1cfc45a4ee8396121be118955ac9b771b2f6fb798422719efd0ad4b927ae7ccc6b08df843e20919ebcc48cdc721cd746ab775409da0944ae7634219f46
SSDEEP 24576:F8kNvNnaFeYhJNtmZBmV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:F8MwBtOmV5SW6H8DS52tdDpbRZy
TLSH
T1D855AF6EB6B806E4D1FEC6B5CD238512E6727461073293CB5290C13F4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1f4ed4529d83ef47e5fb619c8cbc9f45dc812cf3c9d089edd87e101e43a90d52
MD5 6c91867ea79b74174ba83b64c255118f
SHA1 803c9b1017796a5e71c17a074665a1618882e55a
SHA512 3679f0aeeb66220f46dec0d48f7ede3669c940727c55437669917bd8dfb330bcdd3833491eba76cf57ddaa981dff0fc42f72cbabc071dfd2d9580719a379e610
SSDEEP 24576:ID3FHshBIYQgAK5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:IDVHeBIAAK5SW6H8DS52tdDpbRZy
TLSH
T13425E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1280-294-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1280-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1280-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1468-313-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1468-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-107-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1468-101-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1468-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2136-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2136-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2136-328-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2136-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2136-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2136-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2188-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2188-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2188-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2188-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2456-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2456-20-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2456-14-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2456-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2528-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2528-79-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/2528-84-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/2528-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2752-165-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2752-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2752-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2752-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2916-120-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2916-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2916-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4932-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4932-280-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4932-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4932-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5004-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5004-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5004-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5004-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5004-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5868-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5868-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5868-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5868-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5868-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6108-63-0x0000000140000000-0x00000001415CA000-memory.dmp

Download

memory/6108-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/6108-9-0x0000000140000000-0x00000001415CA000-memory.dmp

Download

memory/6108-6-0x0000000002060000-0x00000000020C0000-memory.dmp

Download