362d84bb6494b1b24d3e24f71c0606aba0abed699c4124550e310a0e22f3bf16

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Size 18.3MB
Sample260923-xmlkeaab62
SHA256 362d84bb6494b1b24d3e24f71c0606aba0abed699c4124550e310a0e22f3bf16
MD5 af4002584bbcfa4097ac49236f31d4ca
SHA1 8048dd175ce89301af40dd764e452bb8be7204d8
SHA512 5dbb7edbd1a2a0c10c220ac0059481bd4488bab63813137acbd6d6e613d2c8f3862b4c132c1ab654253b5a1b7e7151a131af3982c46ae2fa1b7c4bbd3b0196d1
SSDEEP 196608:fn3ppTcLbxEtAkNMHe8//aZq+TPJDVQBWG:fP4I/N+ec/aZqIP0B
TLSH
T1E21729157A6B98ACC59BC87083478A734E2130DF0A36BDBF44C456393F79BF46B29258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1908	elevation_service.exe
2700	elevation_service.exe
3324	maintenanceservice.exe
3652	OSE.EXE
5068	PerceptionSimulationService.exe
3160	perfhost.exe
4268	ReFsDedupSvc.exe
4796	SensorDataService.exe
5672	ssh-agent.exe
4804	AgentService.exe
3592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b45bbe733a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_1484460896\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_1484460896\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_1484460896\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_819019715\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_1484460896\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_1484460896\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_68896100\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2292_819019715\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d5d5e928d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000006c53b938d4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093373d948d4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047b0add58d4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e971a0918d4bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e12331928d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000680bde928d4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe
2980	msedgewebview2.exe
2980	msedgewebview2.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2292	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	4804	AgentService.exe
Token: 33	3592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3592	SearchIndexer.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4268	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
Token: SeDebugPrivilege	1908	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 2292	4416	2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe	90
PID 2292 wrote to memory of 5552	2292	msedgewebview2.exe	91
PID 2292 wrote to memory of 5380	2292	msedgewebview2.exe	94
PID 2292 wrote to memory of 5380	2292	msedgewebview2.exe	94
PID 2292 wrote to memory of 5380	2292	msedgewebview2.exe	94
PID 2292 wrote to memory of 5380	2292	msedgewebview2.exe	94
PID 2292 wrote to memory of 5588	2292	msedgewebview2.exe	95
PID 2292 wrote to memory of 1472	2292	msedgewebview2.exe	96
PID 2292 wrote to memory of 1472	2292	msedgewebview2.exe	96
PID 2292 wrote to memory of 1472	2292	msedgewebview2.exe	96
PID 2292 wrote to memory of 3256	2292	msedgewebview2.exe	97
PID 2292 wrote to memory of 3256	2292	msedgewebview2.exe	97
PID 2292 wrote to memory of 3256	2292	msedgewebview2.exe	97
PID 2292 wrote to memory of 3256	2292	msedgewebview2.exe	97
PID 2292 wrote to memory of 3256	2292	msedgewebview2.exe	97
PID 3592 wrote to memory of 4784	3592	SearchIndexer.exe	106
PID 3592 wrote to memory of 3400	3592	SearchIndexer.exe	107
PID 3592 wrote to memory of 2356	3592	SearchIndexer.exe	108
PID 3592 wrote to memory of 5100	3592	SearchIndexer.exe	109
PID 2292 wrote to memory of 3448	2292	msedgewebview2.exe	113
PID 2292 wrote to memory of 3448	2292	msedgewebview2.exe	113
PID 2292 wrote to memory of 3448	2292	msedgewebview2.exe	113
PID 2292 wrote to memory of 4336	2292	msedgewebview2.exe	114
PID 2292 wrote to memory of 4336	2292	msedgewebview2.exe	114
PID 2292 wrote to memory of 4336	2292	msedgewebview2.exe	114
PID 2292 wrote to memory of 2980	2292	msedgewebview2.exe	115
PID 3592 wrote to memory of 3076	3592	SearchIndexer.exe	116
PID 3592 wrote to memory of 4948	3592	SearchIndexer.exe	117
PID 3592 wrote to memory of 4388	3592	SearchIndexer.exe	118
PID 2292 wrote to memory of 6108	2292	msedgewebview2.exe	119
PID 2292 wrote to memory of 6108	2292	msedgewebview2.exe	119
PID 2292 wrote to memory of 6108	2292	msedgewebview2.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4416.2664.16143423616986313441 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView /prefetch:4 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x148,0x7ffd7db25fd8,0x7ffd7db25fe4,0x7ffd7db25ff0
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,16792977807084405429,7075447540647145182,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1776,i,16792977807084405429,7075447540647145182,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2400 --field-trial-handle=1776,i,16792977807084405429,7075447540647145182,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3340 --field-trial-handle=1776,i,16792977807084405429,7075447540647145182,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=1776,i,16792977807084405429,7075447540647145182,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1776,i,16792977807084405429,7075447540647145182,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4164 --field-trial-handle=1776,i,16792977807084405429,7075447540647145182,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=2026-09-23_af4002584bbcfa4097ac49236f31d4ca_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=1776,i,16792977807084405429,7075447540647145182,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f
    3⤵
    PID:6108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3324

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3652

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3160

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5672

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 66e09c0d348e06528eb68af7a62946954b9ca241f4aaec6869fe9a10980981b7
MD5 cf94345f887fc996a0a85a547fcb0167
SHA1 f093304ae8875c934252c07c1d506696c64577ea
SHA512 b79b5275d91546e51cd8d7850e52faa1a7ced764954e0d64bd1bb75a6b2fafb79eaddc3f9c17912a3fbba8b44b467f8e83414822920c87c925a11dadaa4c886b
SSDEEP 49152:hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnwDmg27RnWGj:n3q6sjBbD527BWG
TLSH
T1ADD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2a0b1bbcb6097ba005c04e8b8cb7a3874a2bdea85ed56f528af623bf295d1fd7
MD5 ae57f935baf3cced7bf03830a829ab4f
SHA1 a1ab7ac957d818f54c1599334738617bfa622c77
SHA512 0f08f59357a7045641bafebc6283c5c8d8d14e69dc710bd03ae3ce124c77b7656c8e77bb3d2e912ae33d799ead37e4b8397325b8fbdb640e8bbd6a81b1f260bd
SSDEEP 24576:RXYfDtczALsqjnhMgeiCl7G0nehbGZpbD:0tc6Dmg27RnWGj
TLSH
T1D4650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2fdd9a99b6652402c313d2b03db6a40ff4ae21efa95b1b66a443fc29de483a12
MD5 cc1c62c6a1d0e581c655bd53ca765d55
SHA1 2e5d1383f09f30f65e25ec8fa73839ba87e193c5
SHA512 bf3897e648a157c136dfb09377b8dd2edbd5e0b69ec051ac5e176ada54bb7af00b97f6754057c37f3666b0fc5151436a953bb870fd2082c7890a8b28df254e26
SSDEEP 24576:70Le5ji0hmxxrMMsqjnhMgeiCl7G0nehbGZpbD:7Pji0AjNDmg27RnWGj
TLSH
T14B859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ea22ee3165ea2842289d1267666ea68642195631be64824930b95d8c7156f65f
MD5 65f997b4f61ea8e020968a52448ff8d1
SHA1 3a5e1bd311e3af43b153f4f50a7d53cd6eeb4f1c
SHA512 6bfe5479ef8121512f0316ebe24352059abe1cc00a6d7d0b2dd4bce76c616bc963cede11ec468ee2b43658477a220d8088897fa76369b30020531310835b9731
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWn6q8wyuGsqjnhMgeiCl7G0nehbGZpbD:9/ezSC6vUzPveHjyBDmg27RnWGj
TLSH
T102755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 828a3cd98170a1079c1b3c4331cc22332cdf32cb0c75c9fde2effdf966e1cbb8
MD5 3cffe3809bd18a6e272d82b6dad46f1d
SHA1 fea5ffe9f1b840e437e4936d322e550b9bc6996a
SHA512 543effb7ac42db1a1b51ff5f2784169f7f4546a3fa5666d1f998da37e3016200403a89ffd1ccf665ae7c970be866092adfcfd0af7293bb1986f0c0c52e3d9c4e
SSDEEP 24576:3VbqPb88hv/l+YXsqjnhMgeiCl7G0nehbGZpbD:3VO88hXl+iDmg27RnWGj
TLSH
T193559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a4c2b08bf839fc24ea73025298da086380e505fbae5de25b4e502d6577a24e5d
MD5 258f08d25c13e708d237c2793eb4b0fc
SHA1 a69cdbf4f9f259b438c3485feaee97db0262100c
SHA512 8e77614820ae92954d8d7ef0bf92b820bc739b41bce3fa311eb794fe4677c0ba522d86b0a2c824fda7f7c58f3bd08f00bd6108244d38b12d2453e5fff9563843
SSDEEP 12288:FLYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FLYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BF964C50CAEB7608B5C3E9F11EAC137E56982008536A637DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 04cc0970937647fa8ac7b55c739290c4ba3eb590f58674fe1d4e2c11395700a4
MD5 8c5c3c52d861f850f30fdc4a40b4eeed
SHA1 b32721c71129562bdeddda742d4e003f1153d4c7
SHA512 a98fcd4f7ae54dec85723314ed28b782d6e8250226cadc46a8b46fe582aad653f3cc9bc5cc17577d3e24884d7b0c4a7c8fcafaa44a1aba55ba515a94d1e710ca
SSDEEP 12288:xeBNUbTVO86UvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:xJIUvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C65CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 29464da601c49369d3ec6ab09cba53ca05df297c87fe0c9c6278b2867898e70b
MD5 70035750acc958a0aee980a3fdc6d53b
SHA1 c2088ebbe130d5e645ba2adaa44d142f3396297c
SHA512 0e901ed73be8598c8a1d3398b7fa2b2bb4576834fd1b4ca56f160f256ba6fc02d8e1b910a48b5e766a95389db445f1ca914a94029de78decbf9120f3cabbc152
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:uQvGAdlCEL8c/DRNw5CaD527BWG
TLSH
T142266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 97fdeaddfad164370ebe11a8702e7b82380fe377abacd7a4797cbcfc34e647a1
MD5 850f4c124992a7cf3972ccb5c4691b0e
SHA1 f7fee45c010b4d2079d65d32bbfc726b49935bc1
SHA512 3ca2f6817396900c90bfc868e2a9f0e7cd50b9f9ba8224ea99c219ee54aa76cead54896d30c6e87c124c010940d31d2e3bcef742714169a7ea0b839052689b77
SSDEEP 12288:cAwSfxL/2Dc3RDLLmt0LDQewsAjZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:B0ewsAjZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B75E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99c30e8545d73b17f32d0ba997d37045adbcd3747d6065f18ae585f17e9ed860
MD5 2e41189008cc30f1af3ffa4b39c65eb0
SHA1 7b6d791fa90b65871655206d5ed0d42dcbe9deb7
SHA512 d3c1204380628b677289b97b4050f959d36f21422b9e0f1b55c2e48a68186eaafa18b29407b86e7b097f0568000015670f8ffb5ba70a89d6469824feb17a6e3e
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH1VQBWG:oUEtQevvqc2W1cpV2tI32AB
TLSH
T1C3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 12cbabf79dc3b090241f4d315801a91501513e63f200eea4a3a20bcd8580f4f6
MD5 22be71c51e217324129adc27bb1e3bf1
SHA1 22322e4da411f8b655d88c8dbdcb4d0faf94db1e
SHA512 30b431ff9b572f15caddd326ea33335fccf5ad8d74959bf94cea6ece5a2657a63983f632975b4f7e2db90e214c469def43f5c308a32d582f5f9a6e542c54a72b
SSDEEP 49152:VCbRquA/m2yL5zTfFiV+XenmE3/z9Dmg27RnWGj:CoquVjnmeD527BWG
TLSH
T167D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 391047008c070ab1e059869609968a849c5a3b744cf7751e5e2a5c351a0ef768
MD5 7ce3901c6876b8e35fe40c3a50e30885
SHA1 a442e63d3d790a66178e8203e5a6af920d7f5562
SHA512 c1ccb328700b50af2ccd873ff6a2984d6d6b84fa39cb925d94371e72fedee074437794e0f285817716b31e6afebce57709d459837de6584eba316f6feed3c1a7
SSDEEP 24576:XAhGL3IFoiwtA5l7S53qsqjnhMgeiCl7G0nehbGZpbD:XAMUFoiq5uDmg27RnWGj
TLSH
T1C9359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 be11fb0201e5f18c87cbb9e824361657353885ce10e7c1c5cec304c63142deeb
MD5 c837c463665bab1d0bbd2c9c72db2441
SHA1 29242bc9e5c8cb63eec2957e2fb8ee16c781c510
SHA512 b7160e40c904060861b56acdd9d3560e05f68d629cff7ea95ad23886fbc45f077554ab6b6be2ec1eda109b7ab3a279fa836f0a6cfdfdcf6e616d2d5ebd76f47e
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:wwu4OW9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E65F15A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2e2dc178c6c9feae783ca4c05bf684defa2e6a7e82e9afa80462a2ab24322750
MD5 317a2f4d340ac691b4cbea41fccf8957
SHA1 10356363c1003d3c9d0878aac2902ed4a79a36cd
SHA512 2f3694e7fb8960982586c7f68530dfd96728aa5fc7b4545a2b98d19db6b130863829fa402846667a523195a87fa2ecb382a30af539cbc98851b020ba90d73499
SSDEEP 12288:JeZ1IypXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sZuksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF5512AA239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 eca329da8ffbfd00b7e6c7d7a698f502563bc84a2317ad7558a1f53e3e727754
MD5 0e2f8b93992ff0afe0352310f9587cd0
SHA1 c2ab11bd595180107e5b27597825c24ab2c91a8f
SHA512 f3715ee8ee1217a1513b4f8a7a18f6507d875f799e4c10cfcd672bf8d61408e71b726023e9902aa88085b5db0c2b220df50a1448ea6b45d5a0a222315a3041a8
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN3HD527BWG:nQyiKa/X+PN3VQBWG
TLSH
T15C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e9caf518c6312eb2ea30e4437865d7f903eec3d52fe7bb366010058c7ecce0fc
MD5 830bca1bcadb1bf41a49bf5dfc0e0328
SHA1 679c06ebceb6e4fa1c2439429e1def74ab232647
SHA512 bdaac1be9695ef64245164dcfa87eace26f89008e22596f5c086063b0fe5f333b0a328b7dc5f06d92ca781679c497580616db5a48c85322dccfd4f3b54032a34
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN3HD527BWG:UQyiKa/X+PN3VQBWG
TLSH
T16C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3f53a63158e90025f98b0668507eb04ad089344db7a0ce2fa7567f0af5abc117
MD5 74efe1ee540e000caf39cca6fe36c5fe
SHA1 844c138ece6dca64b87c5bc3bf892ff1f2a75b6f
SHA512 b029ed386abf03edd2fe3af40a65335074cdebcb344a9ef3c55e0d13eb72e8f4222a02b84b8a7854110ddb376045f9a8a269432fd90b16931b9460e3b1ef8ce4
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0UsqjnhMgeiCl7Ge:368Qg55nhceWu7PNU3/NDmg27RnWGj
TLSH
T10AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b8d428cb397d4520a610b54824f2d955a56f97063302a3b011540cee1e1f6c22
MD5 9d39d27e7f29655a5fb1953f03269675
SHA1 7c7ffcf0351ead984e5295c961f847454ac72627
SHA512 98a563a008c4c470a5a1dddae570c04c77d7c576d79b4d31b921c2217b0a793f4b6bf87a28fca1fb734813c273cb885aada226862617cc3ac91c9d2549a6e3c8
SSDEEP 98304:dy5112gYy5azzVvt69nLKnhZED527BWG:ALIHEWhWVQBWG
TLSH
T1AD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6b8d924372f5373d3df44b84cb8b3dc3e4f5806d8fec527dbc3581420e37861f
MD5 1b9a2caaa095a90eab85192b930b2928
SHA1 02c0d63a8986085aaab0e90ecbd7347898dfecc1
SHA512 85f4bf12c7e9971915ffa3642d7572177bff5594ef0bd3529f02913193750cc0cf3471f6a028b503ca818e143974512aad8e063ddfe243f55492a9be447c2411
SSDEEP 49152:KB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvDmg27RnWGj:Yu6Jmdxd2dvD527BWG
TLSH
T149D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2162a3fab2b31c774b94bdbaadf8d4fd3cbd962ead6b6bc10b56d2ab9e35e63c
MD5 593c00c3babb7a8c10ac66c8caaebe10
SHA1 f0a51a899954e7dae61e5e779f76f77515c86bc1
SHA512 a1ffa1edfcaa78352a870b417f97cc131db885e99b951c0195537a31e0ad2f595da0e0e0c76f72497fac00eb9f3bfda50758f06852e25fb90426de2e2c093833
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xzDmg27RnWGj:5mifPWReD527BWG
TLSH
T1A4B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 585b21092eeb864b662f94537d0e3b6f18d520a9f9489be7616ea9d2b7325efc
MD5 a08cf6d3621e11625e770f180d2e8603
SHA1 cddc91268167003f4a095028d120287b5456404f
SHA512 f8e0a2587c8a142a1c4684e3cc4eb886b91ebb7456d7e712f3533e43a15b203291cc67b4c5d8b6470b8999f6e16047604f4a06d0d791fc790fa1572b0e0f0ddf
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHqADmg27RnWGj:95dKii61AD527BWG
TLSH
T1FDC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7a98866e3c81d217c31b0e86238e61f94bd3cf534a852906806eec8950a0e602
MD5 897301254a9d6316e19c1354cfc086fc
SHA1 031bdbb2b308cf1b97b4a5f35cec80682ae23892
SHA512 7776b124516c83c78539bee7f9c9e0cbd638c6225e34543876258931569a661387eea48c360b944013393b894e549196f777e0655ddfe41c250a728cc593b46a
SSDEEP 49152:+htSn8EApI0fig3giDn0AP5w/Dmg27RnWGj:fX2imphyD527BWG
TLSH
T1E295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b5d29870dd5ec14b3abb3885ef0fb7b88b2f4063c875c3fcdf06f0d456729e75
MD5 bfef3cf9c7e03fa69b53d05a9ca5e00d
SHA1 80ce52ca448089abcfdd08cf09cea84c8c99efb9
SHA512 4a17d42ac2d02702e3d881916a01b8276aa71bdb0036c6a9a88e6420232c0590ecf0a8e02681edea741835c5558294cf284a1ee4047b79c7231d9c69e9a955b2
SSDEEP 12288:lQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BE964C41CBE52648B5C3E9F14DAC073E5BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 22c0576b1e7875df3347054b6f16563fb7a6b09bb94c206e74bb2aea645b133f
MD5 da5178778d9418e42169fce7661751df
SHA1 7cc995ae9a803d44c8abbaa261299eebbe39ecaa
SHA512 65eb7ed02345c2efc6528574a95cc262f6ad33272b6e7636b2dbccea5323a41f5ae88231e8c58960db2fb1b76c5cbe6c2aa2b549272e37f64b3148a4a88ed0bc
SSDEEP 12288:fFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BE954C41CBE52644B5C3E5F14DAC073E5BE9200493BA9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3623169db96e15ec44846f2936b781bcd109cff92a4010671022b417b8a4c25f
MD5 2c472853f99a142ff8a259b99e59f8b4
SHA1 41c28c4cf2649785ea6758d5303e735a758fa51c
SHA512 9070da74f843dfda7028bcbb5ff6b18d4b874f95c5ee2305ef1cc5b4ecd8f0a2575ab0956c37437dc62e91e8e91ef3de0431776af4409be66dc943e643191fff
SSDEEP 12288:qHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ac4d3d92014c65586356cba2d55cb83e1e517bcc9b295bba7a7f81b0144b6e43
MD5 abbe24ca57d3b53bdd3c524ccec12679
SHA1 6d78409e120b47af905da49db1f65c59f104d5dc
SHA512 dc6e1b163c3c60c4bff75c7bd62bfe101c382e17ee4deb118953b1ee72b991154f4bba8adeef1577ad672a0829e98cccfab99914ebce442b9168235502df1f0e
SSDEEP 12288:AVKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B45236F575C40CAD83285B4C2F5E11DE8237D96EB3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 67d7da1fff1e322d177ca6d2c40744bfa0c96a0db10d918424da0e3b82bbe7a9
MD5 c87224b0997ab5fdf6a33641f98b7457
SHA1 fe4554be89419e56921fe63933957973b8944525
SHA512 0da1d3284956ae6b881bd6331c948f5fbf2db287b82a531074bdc02923be17a0c044fbc37751fb12d75e0ecf3dde9300ed6405c70fdd4c5e91bc6efe37ae0157
SSDEEP 12288:/yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1204523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cd71d99d889ebbc702ce6de2c6f26ff4a69c09ba8a622e7cd802a6d10f07606d
MD5 fcae618607b0edf2b6a100baf1de801b
SHA1 d1784b66a606f2cec2806086bf803b51d0da578a
SHA512 a690f616fb3b477a8411a8eef4d2c961da5adeb8226ae30de1464bc06d661a5f32aa8f4c446f7079fe18753e8799dfa415672c14507f3f28ec497ad130169d49
SSDEEP 12288:9xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BE964C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 26f8f172ec7c1e3ca7c1593758979b32e8186d5880054f490f54aa1b71e9c2a2
MD5 dbeadd9ceb279dac06ab98c0e7d28d74
SHA1 f7af03e9a795d83b162497d3a0ab14320d6cdbb5
SHA512 91fad5ac9c15366df0da8933e471ba6595941864daff26a9b8aba6d3732b4538673b87f97febb861438c66c3aa79e6eed9e5765836c8a25f3eeaf605c720f44c
SSDEEP 12288:wtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BE964C41CBE62644B5C3E5F15DAC073E5BE9200483BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 282184ea25177224243e51b27ccd04f7ab6dcece6f7148316f116872d2b8ff9f
MD5 92f9153de6ae60bc624bdb2f3d1ee318
SHA1 56bed2a919969c1f7c5dadff9aaad564fe7e97f0
SHA512 3ef6750b7b5e1346005a6c0073066911d56ba7a8ce808add970d78af0f0df2c82983ae6f98626029bf39f20b3fe61e97117db7a731608177c3a498ce46a577bf
SSDEEP 24576:tZMRzFVSOlsqjnhMgeiCl7G0nehbGZpbD:tZMRzfVDmg27RnWGj
TLSH
T1C16501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ec4efb0db4cec95a1a0b04f169d9b7c1defd68595afdccbb9dd40374994abc7c
MD5 765c12739a16410cf88325ede5b12838
SHA1 bd7073281564d7608c6597397e5012803f1c7549
SHA512 00ebde25e226691de5bcc6bdfc98b296397ee3a4095e6c671db419027cede99267071d9cebdffe3ac8032eaf2f637907f5984a96c3db81e92230196a3c92fa95
SSDEEP 12288:+0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BF964C51CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f77b0056221ef933d86ec952215e20f3f28616a02525c811985d54fbd855dbeb
MD5 c364efed35c58ed184a646c497fd9b23
SHA1 5bc739265e041716fce05a70d28bd84a60b14b82
SHA512 a176a3e428a1da4b691dffb3f8f5d3e95d860ec3a4c0e507acc96a94e323d3570536576f12ab1190f61ffdf63acccfccc12ae6797bc279413df43ba7fb1dab13
SSDEEP 12288:voXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BF964C41CAE62644B5C3E9F14DAC073E5BE9200493BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 cf898334475e28ccda84a1f9c34053e778a7fec91773bb48e7977faafb1b9b2a
MD5 c1787a520e34982ad0aa6e78ad9cb9ec
SHA1 9048053d0b123d042fff02dfb13c72459a603ac3
SHA512 f85c87838c5245668a4cf6e4a28f5cf34212ea0d27e29e48e0b51b3e1abf20aa620645c2f237382021dfd37b7bee896986af79bff5041c58cbfddf7fcc1803eb
SSDEEP 12288:5yPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4zypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E755125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6b769f1faa538929eced9ed26587a84829cfcdfaf8b75141c268028260df874c
MD5 51f34f347451eb2f7294745397aa4bd9
SHA1 907f4acdf4bd66befb7b3c8517ba79da185b9e8a
SHA512 e08c7d3eaa4c145d18d34cac2f504976351ee4ad94b229bd50b2d2feb3b6d8aae0b5f3234421f8c9504a9e57ad00693c31a0892e89ac784321916ab1d81b2e02
SSDEEP 12288:H0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1674523BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 650877e0a93a928262b9f36f885d34bafa46fcfb6ffcf45c0fcc99f2d357258a
MD5 4f3e41881de3804a94e8f34aa165b6ee
SHA1 83e2c92c56bf31ba7f08b25552e1a316325a261b
SHA512 c127a172ae8792b21de30f6545fca37abdf8ddec360d1236797a35657beeefd492772babc3e58c3ea6150016b25779bf3d2ab0a16f0ab35ebc099e7960d90ffc
SSDEEP 12288:90Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:90sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BF964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 bfcb070d96258837f1495a9dc40f5da6b5b233fcb88c3aaade0a90ad51da3df3
MD5 873dcd89de8d13d724fbab8f0a71a139
SHA1 c05bb08e8b27694fd7de9d58ff17918ac7e297b9
SHA512 348376689da4b60b8dcd83b1021a5dff20005dcaf4399c71cf66d67547215c9eaa7c921a9c8492326148df9b3fdb5bc4c78928e0a7beb52446541e3419180c58
SSDEEP 12288:MyPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VzypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18155125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 009375173993f45b003a6368d5c312223b7da5e6d0b8f3bd46d6e7366c0bc62d
MD5 5a8ada76acd3812e510151abd5f014eb
SHA1 6a96639c1f42f491e97219a45dddb83f23f379ed
SHA512 7a906d6466d5d40b225cc78e9d96d1de4aaec5ccf31c91f9e90e8f5f9248dacbec4a09c1b85c08d2b9d355ce46c463b4e065ec08932cb7b5658b9ea43e1f594d
SSDEEP 24576:XTDaLl3z0zD3sqjnhMgeiCl7G0nehbGZpbD:XTuLljKDmg27RnWGj
TLSH
T1356501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6e90afef738315786ca10f4291bbb92d0146f595ae98ca3339c21947e1cbc6f1
MD5 320154888be48fc0fdcf92caa0a408da
SHA1 1a2d741de60a26b6c4b3be6f9bbf644975c54456
SHA512 47ed46b86a81279b135ffa1cf92366a21ed427ddcc1ab9f0c3535a226a110e5578bb98b2ac8370c78be615682c180556295ad6ab2a2d66f2dc5653e1813b204a
SSDEEP 24576:t3vd9CHKy7GZjsqjnhMgeiCl7G0nehbGZpbD:Nvd9CHKyaVDmg27RnWGj
TLSH
T1DD75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8b35a114a76c961062272d15662c2acb4916ae099f7897babceec44c406f4f50
MD5 5ec7f4920acf53e0b2c113b0126bd2d4
SHA1 4e20d45ce69d75b8b64ae5b4c4522775c85f6042
SHA512 174fca57a2b5951d0f224af1199065576610c0f6e2d471d8179dd9f5024329bed8d34e42a90ea67481a460c793db73751c61f69a0b11b904015a4fb2007e3a57
SSDEEP 12288:0nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F84523BE954C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 307b07a6541678d21caf74a9595d659568409e4461b00695a6859ecc670c77be
MD5 6e9f0d8fa9c05f4b6dd7fa01541ad264
SHA1 df3301582fce33025c4a5b9878b08b3431967424
SHA512 4b7d43499d2d38fcfeed8e03ac8fecbd4a8e93131552cdea9266f4989381ee26bf9263f9f7f9d311e96810092503e6bbbaee18126b7734dd5ebd40e50bbe7889
SSDEEP 12288:QJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E64523BE965C41CBE52644F5C3E9E10DAC073E5BE9200483BA977CBAF7B54584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 3e4df1b3344763b757d8206d40979aca30bd8999ef52285d4d946f3db11d4865
MD5 28db818a0ba02192d1d4ff7c20a9f4df
SHA1 95bd0f377afa1a499bca7ac7feea99e7d03fbdf8
SHA512 02d26800ec172eeafb04219fee1f4d67b11d8e4041e6c837015ed9b4b360a6ef917779ce803f64b17104fba3b06f8ba95a26acb04d952f94ca9d1bac0b146d39
SSDEEP 24576:zfwvUk9RX6wkyAI4sqjnhMgeiCl7G0nehbGZpbD:pMnYIkDmg27RnWGj
TLSH
T12785D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e2a3b7fcce67d0069d6222e9e9363346e7cbb6aae60dc3d8e3d0c84c13b1cc70
MD5 5363b7ca4056feeb93eb7099195d7347
SHA1 d6315853044557b01713d59852e991663f273da0
SHA512 c0a8b0e2cb9d4ba1f7222c1c219ca04630f5218d10d81d8a03b3b4daba51c6ea530130ad65af912c40d26212bb4414d9ec571d10010a4130f36fb82552b97b46
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fDmg27RnWGj:tySzPnD527BWG
TLSH
T17C066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 608565c9ae4d73fcaa5a4ca2e1027f28d35b6be5ca3dc5e4c82440444d077ba9
MD5 5926ffa02f6314dd3cca0866f5f59212
SHA1 733071ae25a9f8307a263b8b976048a419557c53
SHA512 cb4d7d79921d3d35483952eea615a4b565c655fc7597388a076bbd44f4d563ed4b02f61e5c641305fd9f774d81d54b050a851faaf8c2f20f4e697b8d90ac8893
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY1sqjnhMgeiCl7G0nehbGZpbD:F47JUQjTirIhCnDHUPfF/vDmg27RnWGj
TLSH
T16C65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b10f35f06f63c371734e695c601c5e76fcd44a266a014aa8ce17d7cbc220a7ef
MD5 b3a994035fa070e8a60aaa7bfbe058bc
SHA1 62a98d6b736a11754e6c9c0ffffc4b57083a9583
SHA512 3ac1f25d894cd45b57ac0e1136526a4d96b241a72ad85c5620cfa0da5ce8fffd762b312fb97998afae1de520ef9d9f9fccb90ddf0b0f6066ef177e36b41af714
SSDEEP 12288:WbsfkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA55011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2179f537ae25dc8b757191f526a857dba314ad85fefdcc442879a5da0a263d05
MD5 738099a9076c4426de029d5f5582e53e
SHA1 71fda5c4eb3cef5a94324af00c9699bee3b7f50e
SHA512 b2d6d1a1ffec42e54c41d527601d6d11ef580b9af6440767d57be4e3c39378d8d9b73259f3890492435590505ab392c8fc52188070fdc6bb0dc1864b9d7465d2
SSDEEP 12288:EcArDBqAZY2DXpN8HbavSIGICk4IuZBdwl3cIKhg:EVDzZjDXpN8HbavSFwkIlMI
TLSH
T11B4518107666CB4FC56980325E32D6CCAB707D11EE056F0773C98B3FD5B6658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 290ccbf53e0ee276661a542ee1684a0546bc210e14127f47822d350f685cc4e1
MD5 860d3ac08002fcc30ef5c2febcdd290e
SHA1 b8ae6d3f028c8a6ddc4f39de0981cbdffaa2bd66
SHA512 5fce991935986bced9302504271eb486162aecbf3d6b9649ffb673de8abebc6002796fbb218023e7f7d4450e22f37fa284209fd9279c8079a5cc3228260adcc3
SSDEEP 12288:TbIpv+pFnblZJom9oBoLgDuzqLJFxLwVOZh6Qd+EJ5iriBMxMIk7IC05u:GGxFit
TLSH
T177550A419136E78FD0BB6032073A6B8CB764EC02B7495F26A3C9053AD86A745F1F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 429c76f01f0a39728a615b8a366ee6208a186f366b81f324a4ac1de21322e7ba
MD5 7a648282921aab88ef0c69b26db926e5
SHA1 9074d0e9bb1b3a28c3459123a56cfeab8a9ee04f
SHA512 348e7a8f367edcb57640d36d66029c1fb31375d28025a815257ea1fa45a3d95ac386e17983c676dc0cd9063bfcb646f1015d8d5a765e078211ed20341dacda72
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 748a5288b1a1fdf2d52dd88e4d5a8c8119c415f5eac6704245a9b04ce90de4ba
MD5 8a2ea35ac44d42bda8be7b7da5f32736
SHA1 f3c579bace16db29ed201cda5a6c8427399f8f81
SHA512 358c40b7273439d8ea7ce69ea22e6fef936602dbbff03fb881ff55038833183c973fa9979d84312a0728d4d84ab898131cd144e53241922755b91831db87f510
TLSH
T15FD0241773430774C41030730013F50D0500D10FC30540045C3DC55D3F040540F53451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f8876d975c4040eb74bd4aa0f60d376898eeb88abf4315953b18ea4f9438bfa0
MD5 308ca3404b28d6b497a70dfb84280cda
SHA1 6c42f3d1dcbe9238b56c7b25d780263f11354395
SHA512 3b3998e2fc6024a9d916b8a87d380e262f05dd95dcd4f37a59c53dce5696badf32ebf6b680fe3e9884532e44c51df422f5bb953f3cac0f5710c2d38a0f757492
TLSH
T120A0021509950207C241137918E606D37B70CD290A076B43C0E911A4ACA17C09501C51
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d93f.TMP

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d93f.TMP
Size 48B
SHA256 e241ddfa41eb8ca5443aea7db96838c5a17233b2870f6d44e78237166abd8252
MD5 2f00c9c50727dcc113d0448e41b139e9
SHA1 706734cdb39421f40c62efec9ba349b824de0006
SHA512 bea6460b384da0958f3629a8ea8913732bc74e4d560055a9d0ea75edcc27dd18c866c7f7f8fe5a0f3b50126ca4ec30915b72f7fc4990a9d0084ff0c33eabfd58
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\Network Persistent State
Size 570B
SHA256 b8b676f725bf3f12f900e7c460d77981bdecd55b7f0c3a189ee8b439bcb5a17d
MD5 e20f006e62e9ff18e9dba954a9cbcb02
SHA1 de206cd37b7243e10bd75de1bcd09291af7e0291
SHA512 92245812c6eae919973cf72448bb757b76679869643d7d1b59ea120431dd1e31e2dd2ad77e03e371987d7723f5d50a7bc40c51fba6ceebe8718673bbb9dbf587
TLSH
T19EF08192C2E4C56D4B5517F426397913C53E080A92283D26DDDAF7AE57D2075D12090F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9f00.TMP

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a9f00.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 6cabdcad950e2c02c72795c75ba4ea8c475f8b3b4c0b93ca53d076a3297fe973
MD5 f914d43fb033b67e697f2ddabf2d8564
SHA1 10c9600ca689ec99ac19c0885029eedae262afdc
SHA512 5272bbcfb4e8898216aa2bb306f9bfd6b22da49feab2616fcd82d947b71c4c5de385d3f9f07eebf8c443c460fa02a25551f0090be8e79fff8a73ca5bac695e53
SSDEEP 96:stN/dzolGuhb9pkJo5h16Z0hs7/x+6MhmuecJml1ejeMK+g128XM1C7K:stRpuuonhsV+FdmlQjknG6K
TLSH
T147D194165E24797B8CC7E909FA297B03E2F9643261D41E58EBF8462C14DB6CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee2ae4c0-63bf-465c-8f28-ed714b600e27.tmp

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\ee2ae4c0-63bf-465c-8f28-ed714b600e27.tmp
Size 6KB
SHA256 3f189e0f217b0ef677ac018925a429f43de60a717bb0751ef1d791df28fde25e
MD5 22d5bd2e8000d1a90995eb38b6c513d1
SHA1 2976103ef4b8faca9019447cc272773852e08959
SHA512 4817f1e673b42533b219f316a7d38b32376056591a98ddfb22851cfa543c3b56bc150911427ac150a3631d5d42ce0b08607e89f9c27552c232acc069b0682d9b
SSDEEP 96:stN/dzo+uhb9pkJo5h16Z0hs7/x+6MhmuecJml1ejeMK+gu28XM1C7K:stRp0uonhsV+FdmlQjkkG6K
TLSH
T1E0D195155E24B97B4CC6E909FA29BA07E2F9643260D51E58EBF8862C14DB6CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State
Size 16KB
SHA256 b96866e4aab62a996605795f3d2a9a4d84cc4aa8d671f8860054a6f51d46c9e1
MD5 f1b4d2d42b634c2fb7b0de6c5d998574
SHA1 6a35ac69d48295b3b1893999ddd6a512dcce8f66
SHA512 2d78b39bfce4f6e9051a1bbac186ba97197515fc9fa132c19ec1bcd4ffad3d6e1f35e65ba48c8930e49454b7b48e4c3056e1ed325c17da17ea137916bb78e0b4
SSDEEP 384:3+aQikB+z/xvxjg/qhEmNBSt1b+NkVDCE9z7:G/UxvxjgC+pskVnF7
TLSH
T16B729D3F59647E3395F3B9047D581B8BCAB998B290C27EB85AAC1F0E16C76D81746C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State
Size 2KB
SHA256 f0d943329a4f1ebc623559b85b9e9462d094e527a81a63548aebc822015ab405
MD5 38f5988944be6a8501608fc6c7700d3f
SHA1 437fad8c088413758453aea29b71dc3930343e06
SHA512 a3485c6c9f47b19d0e750468ae2b38c5db168fc66bef6a688087b1c5ddd6fe7e7ae3f73a050e4065f4316ab6c4a2eea370d2946d4881576b07c31211c7d5646e
TLSH
T15951D637AD10AA77C9E39E09BD867F23CE7540A19A822F90A9DC0B1C00C799D2747C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State
Size 3KB
SHA256 3cfef5d4e418a03e9a50ab40c348e6b0a54293470ae142b514e34b91945fb5db
MD5 b5b0b0214bbaabd7c0682efd24717c8e
SHA1 38ee59549f3a0b2c417fad455b2703df348f53ae
SHA512 0d586ad7d5c6e3625c70d2c23a6ce11a109a019ce272688e5d07d750768790fbdaa7b062db6702bf31500312d7722945327783c891f4e622e8e0804e8c0600c1
TLSH
T17571937BAD60A97B89E39D09BC863F16ABA14027D9817F94E9EC0F0C01C76C82353C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597f58.TMP

Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State~RFe597f58.TMP
Size 1KB
SHA256 0986494069d3e3a7c1141b3ce19360e6c4a4411b35a314b67a3613d362eaaeb1
MD5 199fa14f0d5cbd171844f17eeb1eb8f8
SHA1 7269afcffbf912c8d9f3c80e5646404e0a9a9da7
SHA512 a4aed55f2cc780b045fafff2a9687776302123d4810850496e43804f00b1a3a4d865d76ffdbe706ac2a199a8030e2975a94d7f0740d1a3425d6e296a68021a59
TLSH
T1CE3196B7D9A06A32EDC2AD0B7942BE674E70006A81414E4071DC0B1D11D748DAB7FC33
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bd02043c7369559708eeb8abf950dd8fe3f5aed4cfd029892c03deb75e3e2c6e
MD5 6d8b0ead405912eeffff2f98bff92c39
SHA1 03370b26872ac20d3eecb111caeb1d064075c31e
SHA512 a10c002f3de76bdc9d083a1264a2149fb504fa1f9bfdfffd2b5069b1d5b64391e6b1df7411934c220b11c446a6f95934630151e827eba64b52f762f40ec2999a
SSDEEP 12288:+07sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HssqjnhMgeiCl7G0nehbGZpbD
TLSH
T10645237B934C518AF93609B482EAE12D680B7E669F1044C3B94778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 af4c0ce947eeab688e55e561979865770d0e000efc030adc23f9a5be82b15a4f
MD5 fe3cb75269b4bc0d61f5917db9820adc
SHA1 f0b3e947c846be7ce8123c87cd54bd6071ada314
SHA512 c0499573cdbdf688270ac3987f09a4899febacf79afd8ca058fe72cae89b99e537198560e042bc2900076ead17103b6cfb528ae5e18b9c272ac067217af95e1a
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYGsqjnhMgeiCl7G0nehbGZpbD:Bgb4mBIBhGFpDmg27RnWGj
TLSH
T1E2659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 96d4b6751220b5deb16b9abaf949a6d6db3ae4e9001bd1d2b01eda26e60b523d
MD5 20c6ae6b44db708efa69e0ae56b0ba29
SHA1 3c0ee1b370ef9bc62a9f80b6c1b33dfdc6b68718
SHA512 d0cd748bc4180870f83fac4a01860a3a3198c336b166b0b09d1a24cc71d25c154727c7ca663bd7907c427aaa6dc3b965006ba2d50cd3fbbc7ce3a548f6a2ba48
SSDEEP 24576:nG88u8FpJqH1bzria7/mlsqjnhMgeiCl7G0nehbGZpbD:G7ZFPqVea7/iDmg27RnWGj
TLSH
T1E985016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3921a031f3133d0347787c2d2d3f825121751778b51b9ba24223f58d9a8a21e3
MD5 6763f1378c61bd47c569a65480319307
SHA1 eabe4e922f3d768de14447b46923bc56f87b38a8
SHA512 b9fad00f6f4ff0009c61d316cfee79cb8d2e79cebabd85d35167e2b79825a6603de74c6f6af3bb4b5cad8de1b3fd215ad16a5e7b6ba0fb9f8f482862fb0f8516
SSDEEP 12288:kHvUrBFrEjwaQBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:kPUr+NQBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10465F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 446af62cd3d46c98161e69d595bf3a2bbb5e0a19955a8e2ef4347bbf44135338
MD5 2a9f09250153e7d1b58a071d523ccafd
SHA1 af6fcc0245c90a501882e06b54ead66f9742d821
SHA512 1daf0216bcf640c9d1d594d1c75c928cb3dea3c1ca766d8d13812e840b7821f283d9743c8d6f7b5f83c5e4880728e3eaeafd5aa21af02f2b504ac00707f5801f
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFDmg27RnWGj:/G05lO43bcD527BWG
TLSH
T190D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8c2e7d1229d88c13634b42abb0fc3a20982cc7f85fb7695fb32e23c1f72356ab
MD5 e422af43d519265acfd290394566021a
SHA1 6a1ce1ff2b0772afa89c3b2060c5dbe28af4ff34
SHA512 702583f53d2a36c50699014ef66150e5ca949853d75cbe205bb67676ec5a3a63da0774f3a63e207eda01ecbd43213002c9b1254562bd23d6a964be0ce571e627
SSDEEP 24576:pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnrsqjnhMgeiCl7G0nehbGZpbD:5a5POZ3BJt2pasx2+mNDmg27RnWGj
TLSH
T13B65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6dfdc459db6dab7864534f42deb8d92bf657787e8c12debba4d139172e6fd0d8
MD5 012287957b92f3b0226fec1d0860b7aa
SHA1 3aa5e8820808a6d6ca232aa111b5e2aa29e7a619
SHA512 afb6c53ed8320ec62cbcf8ac39bdafddb80b08949a81ef8f2e2c04750938622a41e5a3854582375ec7bd2419f0c778a44948a9eab106d3e9bcafad8fb918ed0d
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FkdsqjnhMgeiCl7G0nehbGZpbD:yNc/zEOVHFCDmg27RnWGj
TLSH
T1A7857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9708d00d374353389a455fb3efa4f5714eb7afb5710c5b05392b78cb50f56930
MD5 f4a010f57499fa1845cecbecd192d30c
SHA1 b81de5300432d6b3c4c6ba673d2d9049e91ea3e4
SHA512 606819973a3c0e938737d338339ab5d52440d3fb0e713d15c8829a580097fbc1d3c28cd7b16444167e558b4156f69051f69a322b3b937976a28de76f01665318
SSDEEP 24576:jTkNvNnaFeYhJNtmZBm/sqjnhMgeiCl7G0nehbGZpbD:jTMwBtOmjDmg27RnWGj
TLSH
T1E755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d0569b82d3920cf13f2317cc39f7fd9cf56363011ca821cfc3c750b3aa311c84
MD5 db471ab0017d8de9ebe2afa5e1909657
SHA1 7ba7b8abc51277aaa6dfb7456bc124c8558fa74f
SHA512 a9dade3edace9c6ac78196731bde567182a2f9eccafced58e2cabcadb04ae1d874a0d5af89460c882d6e8e73d3acfae8587f87e7f2753a7b8a84eb48051ec4ba
SSDEEP 24576:uD3FHshBIYQgAwsqjnhMgeiCl7G0nehbGZpbD:uDVHeBIAAsDmg27RnWGj
TLSH
T13D75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1908-17-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1908-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1908-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1908-266-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2700-284-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2700-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2700-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2700-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2980-752-0x000001F705FD0000-0x000001F705FD1000-memory.dmp

Download

memory/2980-751-0x000001F705FD0000-0x000001F705FD1000-memory.dmp

Download

memory/2980-750-0x000001F705FD0000-0x000001F705FD1000-memory.dmp

Download

memory/2980-753-0x000001F705FD0000-0x000001F705FD1000-memory.dmp

Download

memory/2980-754-0x000001F705FD0000-0x000001F705FD1000-memory.dmp

Download

memory/2980-749-0x000001F705FD0000-0x000001F705FD1000-memory.dmp

Download

memory/2980-745-0x000001F705FD0000-0x000001F705FD1000-memory.dmp

Download

memory/2980-743-0x000001F705FD0000-0x000001F705FD1000-memory.dmp

Download

memory/3160-226-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3160-536-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3256-138-0x00007FFD9D430000-0x00007FFD9D431000-memory.dmp

Download

memory/3324-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3324-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3324-153-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3324-160-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3324-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3448-672-0x00007FFD9D270000-0x00007FFD9D271000-memory.dmp

Download

memory/3448-673-0x00007FFD9D530000-0x00007FFD9D531000-memory.dmp

Download

memory/3592-285-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3592-560-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3592-292-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3592-286-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3652-197-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3652-501-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3652-196-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3652-203-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4268-538-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4268-238-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4268-583-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4268-585-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4268-236-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4268-229-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4416-6-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4416-235-0x0000000140000000-0x000000014124E000-memory.dmp

Download

memory/4416-9-0x0000000140000000-0x000000014124E000-memory.dmp

Download

memory/4416-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4796-242-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4796-551-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4796-559-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4796-558-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4796-249-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4796-243-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4804-269-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4804-267-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4804-275-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4804-280-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4804-282-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5068-214-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5068-518-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5068-222-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5068-216-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5380-75-0x00007FFD9D430000-0x00007FFD9D431000-memory.dmp

Download

memory/5672-254-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5672-256-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5672-262-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5672-556-0x0000000140000000-0x000000014027D000-memory.dmp

Download