9c55a596ab1553f431d5c890b3b9da9213868d0f44fdd410000f2382f6e8ef7c

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Size 12.3MB
Sample260701-jpblbsht2q
SHA256 9c55a596ab1553f431d5c890b3b9da9213868d0f44fdd410000f2382f6e8ef7c
MD5 bb94128ba4ca338c294381bd5c5bd6cf
SHA1 f6de12361ef1e19085220522f7239b442b7abfe6
SHA512 660e7127c92bc7d13c65d3b9814e6cfdb18215717cd8194de2cb2c29eec474f936fa73acc44c888a23c74e0b99844c258314d110b1b59eee8b48670e23e7c3d9
SSDEEP 196608:Jhr1I2WcqSjj7UlG8drCeqBvKCzcLVVQBWG:Jhr1tqSP7UlZdrWlDzcLgB
TLSH
T19AD65C2B62EC01DCD0FAD1B9C91B4903E6757456037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1344	elevation_service.exe
1876	elevation_service.exe
4960	maintenanceservice.exe
4388	OSE.EXE
2688	PerceptionSimulationService.exe
1096	perfhost.exe
5864	ReFsDedupSvc.exe
1584	SensorDataService.exe
3564	ssh-agent.exe
560	AgentService.exe
5424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5c899107e819cbc6.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000205962902e09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e606c4d2e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037fb1f902e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5980	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	1344	elevation_service.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	560	AgentService.exe
Token: 33	5424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5424	SearchIndexer.exe
Token: SeDebugPrivilege	1344	elevation_service.exe
Token: SeDebugPrivilege	1876	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5980	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5980	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 1636	5980	2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe	90
PID 5424 wrote to memory of 3888	5424	SearchIndexer.exe	101
PID 5424 wrote to memory of 2156	5424	SearchIndexer.exe	102
PID 5424 wrote to memory of 3696	5424	SearchIndexer.exe	103
PID 5424 wrote to memory of 3200	5424	SearchIndexer.exe	104
PID 5424 wrote to memory of 4108	5424	SearchIndexer.exe	106
PID 5424 wrote to memory of 776	5424	SearchIndexer.exe	107
PID 5424 wrote to memory of 3280	5424	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-01_bb94128ba4ca338c294381bd5c5bd6cf_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe" --type=collab-renderer --proc=5980
  2⤵
  PID:1636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1096

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2924 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2924 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 478b33ae44638403c351a1ee1ea1138675f9e1d02a68fc682629a7428c8f4e8d
MD5 95ea92adea341c992735892689e82616
SHA1 24c28054986fe1d4522f4f5405df7654424a0635
SHA512 ee4222092c83b8d2e21bb4e8764b9fbe248751cf0adbfd7552d61964ada920ad750711a5a1352e4ff90efd67d19f8ae5e0dc04d305f3ca0eafc5e366037cd12a
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXDmg27RnWGj:E3q6HjBoD527BWG
TLSH
T17BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 851dc3c8263c9dabe84cf1de2b9b80e17d9c587ef4f26a372faedd3617a81432
MD5 bd6a165a49139ccdab0597a2ed07e5b4
SHA1 70df5dd9b9fa17869a51fd1d3c6cf723140e623d
SHA512 8d0d4fb403848e6ef71e146d289a65b946619314f1e8a4a1a726730c3eaab40c8335c982de4c16c2a296af6f3aec78ada3c5296f43d3dbc197d9f11bb56b50cd
SSDEEP 24576:sXYfDtczAwsqjnhMgeiCl7G0nehbGZpbD:LtctDmg27RnWGj
TLSH
T15985F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 bb037b42d943a0d0644dd1fe3b099212ed9691c0e31e6399ba6cd3348e2bf418
MD5 e314379cb7a8ab2da82815455d11afd2
SHA1 8a2b9e35db5c3d5b5e83f5ecef1544ce7fab2ca7
SHA512 1919aa6b390bdfe9a9b423469ef8898b4a07ff937d365e28c9f759407377a87a7eebe59788a46a92ccb87386a3cd51f7dbb4493395ecb37e5a1a754e6507441a
SSDEEP 24576:80Le5ji0hmxXrM6sqjnhMgeiCl7G0nehbGZpbD:8Pji0A5TDmg27RnWGj
TLSH
T187A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4db45a54ca6681a10766305ec714e118c0588eab4098bc2d98a68cbe27d6575b
MD5 421e8cb199b5f06d4362b090a85419c3
SHA1 5f3d62f23ce604488c44c8995eec20dc505535ef
SHA512 a52087b5b9e71342457abfa9edbfee8866df040441ea580e7af030f4754c268c1e343df45cbfeb0c801c99e197053ac5ce3bd6f787ae7459238a531adcb90e91
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWE6q8wyuAsqjnhMgeiCl7G0nehbGZpbD:l/ezSC6vUzPvxHjynDmg27RnWGj
TLSH
T122755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ae368b6ab53fc5d38d6dc6418db1d8b269d9d9440255017fb0db9d17365e7b22
MD5 397d3ed6565f7dc5f56511b9cc627849
SHA1 5e3dceee67c16b300a1d7f38e5f1e1b78c31e209
SHA512 13fd33fc3092a060eefb802479443707b6f71dfb958b4ecfb1408c0e5c6d3de50c1189b3f9e557ef219583b6abc120d996583dc8ac0a2f69bac3e88bf9a36c56
SSDEEP 24576:2VbqPb88hv/l+6ZsqjnhMgeiCl7G0nehbGZpbD:2VO88hXl+iDmg27RnWGj
TLSH
T15C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 4e0d3c4af7fb59455cc38d29e7cfcb8ab76fef9ae2237774cccd4eca68fa8a4c
MD5 af07026a796cedbe1c84865eb1f167cf
SHA1 ef57de0ea81c702f60c2f07a404d471f213a0f15
SHA512 e071e07499ffe0ab8927d34880ec58950c79da410789ccf277f13e43b856a4fe41ee9ae70c13a85ec9262eeec292e8a584fb61d895eef80b9bc455f334733283
SSDEEP 12288:S3WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S3WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1627523BF865C50CAEB7609B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 13b308080eb1b313d7e979aabd937035eeb3ce4db42d45b72cb83b773df8cdfb
MD5 81ae12cebd58c34a3bcb6233cde9f934
SHA1 b4666673972900acfb0ff99995f4c4d3bbe62b7f
SHA512 06ff53494e47b8bb3c292f89d97d7113502b1e87e32439d9cf3999ae89665bf185c5ec59fc11126f1e8a32c73d2ead5e7063dedf653eefbbc957cf66d1ce0c3d
SSDEEP 12288:ZeBNUbTVO86UxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:ZJIUxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF85CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 60b97eb76f73a889fae33e5480365c2be5e71a0d3359d09dc15a60c29ffd915b
MD5 cc2384acf5c4773faf423341b090c2ee
SHA1 8bd4d728a8cfecff2ea7a5474e01221e0ecb3b96
SHA512 afb3c06b73f62f3de080274656224f03e459d060bf143bded83e464addfef097eccf31e434b66d3ae59138c6138fb6f4bab584a8d2c88d69518000b7023ce022
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:oQvGAdlCEL8c/yRNw5CsD527BWG
TLSH
T1B9266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 3b689a3c203be6e24b6c86200035b8f71ea4933818fc3f9180407ca61a22ccd9
MD5 da60730fffdfaee7cfc01aa8c354525e
SHA1 82274bf4d3ba77e713dfca60f213390abd9d7e53
SHA512 1ed2dd3bce79e4755616771f7b5e45a24a92f997f8eb6889cd5f4a870044ad62750a9743afd9532f7c57bd5cf80d66e4e641e7779be7fe0689163ff07074986f
SSDEEP 12288:5AwSfxL/2Dc3xDLLmt0LDQewsAjfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:q0ewsAjfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12795E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 92b10b0534f7f11580caf6a4a3995e8e965251f92573de5a1fff0b581c92d633
MD5 017c9bfeb715ed2434cbc197853d575a
SHA1 e737babffd49307d46321e5e4d45769bfe9df8a4
SHA512 f29cfe2d911c55f06ff9f0ace64a73e8a7cf9eca520dad1c4e0aacee9e9b1b77eba3cc0c90911161a4adbc927327c7fc4ab569a90159991484e86074ffa4715c
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7VQBWG:hUEtQevvqc2W1cpV2EI32SB
TLSH
T18A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 298d300adaf874d4be62e4aa49aaa17593ef6e3008dc96dfa90e3db508ab7e32
MD5 725399db177d86ebda0bb09474e648a3
SHA1 6d345bc7052c2f24daaad8b6ef0805a0b22d37ed
SHA512 12632e90615bf5e266c25adae388ae993e567a26b426ba989b10c0f85099cd0008e2445504970a36e7085e1c2892cf88677f4092067d7a7d31be78987426377e
SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zjDmg27RnWGj:coqtVjnmwD527BWG
TLSH
T125D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1b3566dcfe0a8e356b21983ee3e637c8a5217dcb680e3d3df987acff80687ca
MD5 5272d6a3e8b5650f3fe672eb183095ff
SHA1 05c289e33898f833be9844ba825d244a63fbddb8
SHA512 4e36a7927aee12e8a204571cb9390ac2830797ef29573fd6538281c03c462f2a70d131c08b0ead2ab2a64de765c840b5d4c99462cda780321f048ecbf3b6a01f
SSDEEP 24576:QAhGLJIFoiwtA5l7S530sqjnhMgeiCl7G0nehbGZpbD:QAMyFoiq5gDmg27RnWGj
TLSH
T114359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 02f7d5dce2cc18ddee78908e7a6adeb9403c6c059613709a9db0414db8967553
MD5 8b79701991d8b43777eb74e1cee15c10
SHA1 2146f30bfdda24e45c769af6c3d27394c19204ce
SHA512 f0e94768f53fea0d20be705d97b8e90f9936d06b091c7ff53b746c31fd30ed511d6991ab7e343504867bda1b563a973178633bb970e936e7a685b0e64f7ae41e
SSDEEP 12288:dmw5HEjsChNCBFgl0WDm+CgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:YwubOWDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE85F15A72A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 e9a6c43b3ef53136115355fd69bf72ebf5d9b9b6fb18a9bae5aa75ea96850689
MD5 3c32269da83d56b21fb7c7ad236c776e
SHA1 4ae6590f3b641848f7193151b4cacab128a13348
SHA512 34fd4c3a40a51f9559d4c0fc948f83db0f27c7e252cba869d4aa8c2585af7d45582ace1ea452e706f86b738194bcd53e3240eea288bed978bac53378710ab449
SSDEEP 12288:LCZ1IyPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZuysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C47512AA239820FAE163417CC5E5D609E7337C62673003CF16625AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe3b64d732b6caf7644ea776f6546ee4c5b14627a355240a64fbc6b2861a0b46
MD5 1a44391a69f26e3bf2c0d9549c645211
SHA1 a27e32ef33094b2e8b190f4b5629fbf702bd97a3
SHA512 9725b678ce9fe0f5adc515ee7c2a6c187365487f4061ffeef3fa1fbc81929a5dfca91225c409fb44327084367ecd0b4d98882d359c83017e15b2ad33d89c9f4c
SSDEEP 98304:SQRQyi36YOcPQLvw2gAf+PN3JD527BWG:JQyiKayX+PNZVQBWG
TLSH
T151667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 060e52360dfe262ae8e9dff0b61080803343ff0a0cabc805497890f0c06f8e86
MD5 4e20a40e0a2f089aaf98b199f6207a84
SHA1 65233d66f49e42ac97de591680aaa888a7db20b8
SHA512 9c50db4999d9305bd233cf9dc5b99f07e5644525d052c6c3950a110dde854771eaf30e0d6a3311130c608a05076ddff36d8eef0d213b67355e07574b8de6a79c
SSDEEP 98304:ZQRQyi36YOcPQLvw2gAf+PN3JD527BWG:QQyiKayX+PNZVQBWG
TLSH
T197667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b4b748ab3732a29eb929c0ab4c76ffdd5c332429c1102edc350cf33cd81393db
MD5 21dcac5b82612fbda8e1b56aa40d69b2
SHA1 26b5aa63992a887cccc57723dcc40535a2c5a9ed
SHA512 12918f89ba6af44529ec4f27a822533f90654d90f3f5990f496100cd987cc73d8e2458d1481695711ef7f8a36da379ee1264ee3c17534566c528ceec108e52d0
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0CsqjnhMgeiCl7Ge:Q68Qg55nhheWu7PNU3/TDmg27RnWGj
TLSH
T1C1B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 53c80c4fea19b7c21d4ba508854be42e359332ddaff3557bb876b7dcd53d24f9
MD5 8ce02596595803e79c4d00aecc3d0fbe
SHA1 c564df4eb1703a77255c814ffccc4b6a42fc26e7
SHA512 d02c73dd6b0c945509008f33096935270fd0713a858b7db0b2d8ff6b11de7933997592310d9121d8ce8dc5e5abecaa795d2e382f575bcb2481f311a4c9c90d97
SSDEEP 98304:5y5112gYy5azzVvL69nLKnhZaD527BWG:ULIHmWhIVQBWG
TLSH
T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d5690a8940c1f6800dcb34b1852fdf99a3f47cdc9a0347fc69f562cf8e9b6f31
MD5 43d9664ec632d104d8b8dc045854a9f3
SHA1 d9f8fdb900681a1f64c25bc6ba371e2706faa34b
SHA512 5050f9d8489c8b0bd50d005608e8c0da93a5b5ca119ab0c93119c931a46cbd2722fb0c7b1fc337b826964ad3a988a3464fec92ea38fc2ae0d09ff70fed54bdb2
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8Dmg27RnWGj:mu6JmVxd2d8D527BWG
TLSH
T13CD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d6533e9ab43228eae71a8314c88f9486684d6f05b35aef71f6212c2b35fad0eb
MD5 f3e6c368c2e97d25b5548677667b2f5b
SHA1 918c00647b5d7c2c0e150bc1ca9f2d3e18d4bd2f
SHA512 faa19634df4ad61258d8a0cd8d0884986f934ce45c413bb3f1755b7edc0f5a6fa419187b81e0adb39ccfe1c9565d531ef95488ba89b0fd1bf9053966d460d382
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4xlDmg27RnWGj:imifPbRwD527BWG
TLSH
T139B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d30d103c032cc10b7f320c8ae68972c0d03fbb72324eaf07b7adb493ab3612a1
MD5 e2ee87fdd8ebd8f9ddfd2a2ed88f832d
SHA1 25d53192e92d3ef9169db21b08ca867d770acaa6
SHA512 8a8ff5e426832f808309797cba0b763b4303477f44851afa66f116095a65dc35e7b77dc2b4ff0521be076ba9315873ed8bcc96e7adc679d10002a12b3a95f588
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHq2Dmg27RnWGj:L5dKTi612D527BWG
TLSH
T1B1C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 95ad726756773ae08c74c78f00e2cf930ab114b7c40692b4c938e07c9ec397de
MD5 670387c6e64a0cca5eb3dfd42a8db55f
SHA1 fa62c4a2c285065b865fb3d44f0c943c00ec1a3a
SHA512 6d7aa8f9227f039826df0c183a8a9d2165995d5315a9a5f5e8dfc0020a0f15cdd95ddb559e68e4e2525bfcc0d3577f10367f85ebc0490139188811b12955bfce
SSDEEP 49152:bhtSn8EApI0figngiDn0AP5wBDmg27RnWGj:6X2iyphkD527BWG
TLSH
T18295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 d97fcde014acd24d8295e6ef8f816dcf8aac46d571c35e8224ab842d3a02cfde
MD5 ca6dabb32a20cea81e80f13cbb11ad51
SHA1 6d56491a71e128c65779a3da0bf5017c3c24ea5a
SHA512 12ace5f0da4867613ddba8bc03b7116f61e501ab34d0bc43a718e212f92faaa8550c0675426b985a7c4dea2d951a83c9215c4331eb0fdbca336f9fbcbe4fc11a
SSDEEP 12288:4OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1497523BF965C41CAE52649B5C3E5F10EAC073E5BE92004837A577CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 fe2d061f2527adb6ad843bbfe32057e0a7a0e2280b9accee943fd6eb27d29230
MD5 345548b0f9c7081f0353a2271e91f9cc
SHA1 1f3c508fb51dd0f91918deb583ccd84cb4946fc2
SHA512 a3b81a8c64c658df8828b937b6d96c9adc6ed9dfc9238dcb2fb9122e935c8f5cfde7da8e809f2bf02d98f06966aeb9a1188f56ddd584825a1f647f09aca77a8a
SSDEEP 12288:brXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:brsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE7523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 0a05e2bdd9349a35b91959499eb889254daceff2c07ffbb22483820d3cbeee63
MD5 6c74c53ee2c8d3a15fa32b0149e7581c
SHA1 11e2a3ecc63822cc704aaedf1e6ee6a569de2187
SHA512 4f460807d67b4cf7a9375ad597f791aa92a909f1749c286b09abefedca6f83dc190c220a0df308e259f033ce24381d9dd1bcaaec1d006f49bee3263df7ba8109
SSDEEP 12288:5pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5psqjnhMgeiCl7G0nehbGZpbD
TLSH
T1307523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA977CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 60deb1481ba9b81a4aab4611b853f4698b58f5ef878f95941ce8728be034b04b
MD5 196f625bcb120de83e0eea9a76eac737
SHA1 2001eee30697bb372acf44142bf4144064c3059f
SHA512 f40d3c92ddc82f1dc90f2b1d76990402e1b1a9c0a1c3bd0b722ba76859f5ae2b788556579c54d04f72cd596e3c925233ce7c890802892a5c6937b409640615f1
SSDEEP 12288:8VUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D075236B675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CEE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 82ccbfe257abffa5f7f488621cff8ed2aa7d23cfa81b1e5453c75d4c182fa351
MD5 4e3cae2706e40d6dcc773146e1c17fb6
SHA1 c366505c92947a496227fc6a7dc618c11f9af83e
SHA512 c521bd879b5d12ac0f5fce683e83a2056af2700298cf7845a85a19e2a7f02d7547ec777397d3fe5f035cf1eab8deeb8fa08388bb2871c1318ab5d554c06bd7ea
SSDEEP 12288:F8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:F8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A7523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 90c0d268e13f8f9ffbc362bf574546fc4fff157a2037ae06811f5ab025eb421d
MD5 eb311f4451a66511f28daaf377449b65
SHA1 e743f5a3d3d9d7e4850951e199299b9e3c502fab
SHA512 2dc898df659da5be82131189c1f575f855044de31f1221d592fdf967b49ec5f3b9db26b2251826cabdecb2e523885fdc8c5518ee97e0477a476da9b01350e828
SSDEEP 12288:QXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1417523BF965C41CAE52648B5C3E5F14EAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 f7ce13cce7348309331ca6aa78e3a07b5541f95ab30dfabf0ec10093715dc0fb
MD5 b1d332eca0eb318d2c8cc6d1c1392f74
SHA1 b18f2a901cd95ffeee5c7d855aca266947cdaca4
SHA512 a43d60ad02a797d724e9f318da63d8ca11f782c063135cb68df24aa1a111a836a4b863d9ede715ed2ee6f34a3639f4fb19659a139d74a03fbe7cf87683b35daa
SSDEEP 12288:LTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F27523BF965C41CAE62604B5C3E5F11DAC073E5BE9200483BA57BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 abef971a14e8c4bafc9807487f4cb96bd6b93b5e2b3f185d06be7821cd6229ec
MD5 a0fa8bea3bb69d32ed6a24f41e6f4d73
SHA1 588c708074917912bbb136fb7fb1528afdcffd37
SHA512 18df1dfa2372f1c80f4c1751aadd005c5da044f4a338970a115fdd3c9006c09f38c520846637e2a4de2dfdba747c72d889f9b1556814c9a3fd8f563ca92471c5
SSDEEP 24576:EZMzzFVSOLsqjnhMgeiCl7G0nehbGZpbD:EZMzzfbDmg27RnWGj
TLSH
T12D8501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 e9e54221271de2bec44b27c39043867fa7dfdf0bf2cac4f799f6860b3889af22
MD5 c8c783a057b5f687a4e72ae760cd5c20
SHA1 a3fd0b81eed7c1d8700acd3ba65ce0eb2b32e9f6
SHA512 ddbe46f1881fabd6c7584afead6b3e91001da6a623b16dfec07223dbb28a12a2f7acbecc6807a7085cec7579512c6d6e20953a7f76cc5bff3165e0370fe353d7
SSDEEP 12288:5iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1787523BF965C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 3ff1889bf552d68e920c0d92cbabbff557a85f53ba7146bb96bdcafe78700c72
MD5 29902facaf0d459a09d228f18f2847d5
SHA1 117704157bd4388df7a186dd79c06f1cac3bd15c
SHA512 2131758e2feab7c2d75969e586f8d692a78febeb9e370351b150c25bed3c31b262956c5e324d7eddfef4e6a0eeb777e8f1a11899b86ac1cd1224bf099d137e6f
SSDEEP 12288:6GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B7523BF965C41CAE62604B5C3E5F14DAC173E5BE9200483BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 b8ee3c4ae29455e8d0c2e034cd1c3d7f727d6fc7175f467aeffae461ab17a37d
MD5 fbdd0220e5f7cdb8fbcce25dc959d8a8
SHA1 a5b4df55504316fd6d3081c2f171e196bc3c3425
SHA512 71b0b6b156032d42d87b46d1636c821559fd8d1b2206916357cdbd4969636e6284ab7df06240e30aa8833e8b67b3cf8633877f2ef700a34bdc16cfb159a34880
SSDEEP 12288:cyPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FzyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB85125B73A530F9D1378178C5A29A06F7327C3647204AAF17A116BA6F736D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 f523e096e94115f9ed1002633440770d74d4fb4310fbbb7e10eb5d9ee5f8e606
MD5 f14dc57be266e7db74f1c50fd5acd35a
SHA1 31a778045e49814129b24bf61fb8f4b98f137663
SHA512 67446ca5ab8076697ad86a96a0a73074e8eb80a0d2639156a3b6e272011c7346533a823d6467a50dfc158c3bfc8a09a9c781d364b02f4e54d33a7257ec451e87
SSDEEP 12288:AiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD7523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 d910d77424b747a1aaf44f7ce21276a2d6fdba88505fe99dc682a016a38769ca
MD5 b22eaf3d60e4b3888582cde8ebc19667
SHA1 2461fae50db7f5884193de5a8d4b86723b24da3c
SHA512 3e76584a33e4796a6f72d776fe97a9ebcad579067f2cfb8658f8408ffcdd5f9a47cdd885d410c39df2afe7ad1abf3ee3fb7006cef430aa6be82e55cf15c2f30f
SSDEEP 12288:viXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:visqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB7523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 cb9e83dce73795de825bce2e249d575626a5d85d2cef7dd35585085147425551
MD5 1e09c2a3a14bce54a836dcb8a5121c78
SHA1 cec7d9bb4f79550795416f0e2e42da7274a72753
SHA512 f135b49b19032ac1daa4c1ecf2c664d02788cf0ac8313d3fa66b221a179387aa6990a4aad6aef0e73c32f8916b185de782b657815c8049d452e04244d84141b9
SSDEEP 12288:xyPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gzyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A85125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 111cfefb23b21019c9eadbf4aabed1dcc56846c78054f1a06fb2191e33997168
MD5 c44f4ff8f0a3fc77df95fa5146debc69
SHA1 d1ab0529714f18916d5b0cc2469a4d6cc4bbae4c
SHA512 f8cf7f85059b43aceb91f21074ae4656122b657c5f38900ab3ea872d700bb1097296a2f1a17b403c2097fc9c30e676cdd134f5fdb416aacb7edaf204067fd4db
SSDEEP 24576:fToaLl3z0zD5sqjnhMgeiCl7G0nehbGZpbD:fTfLlj8Dmg27RnWGj
TLSH
T1CF8501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 2ec1dc7ffaf910f125991f2cd029f262e00971d25e6f7a340cdef3ba675f4e48
MD5 e96ec72589cb137aafa338752fe727a7
SHA1 d5f89919237dcf2ab691998d76aa86bbcba3bb57
SHA512 6627cb62de5ae3ae43edfa0a72f3cbc35b3497594660196f445ab85c5c22bc3f8f23ec62e6a02b34949bc8ebd6b66ccccfe7f4da4ce585ff18ba17bb92870295
SSDEEP 24576:r3cd9CHKy7GZ1sqjnhMgeiCl7G0nehbGZpbD:Lcd9CHKyabDmg27RnWGj
TLSH
T17995CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 e04da99c8c7b721c435f33dd01f954057bb197f4381365291b1eabcf60206404
MD5 15766db94ad451fb864c40888825d2ca
SHA1 fe7aa06257be02b550bfc4ae11e3effcd605611e
SHA512 95f289317a6ccac65bab5a55d05fbd7e43e7d9e0eafd6a8e313e42cf219ed701c92e47a22e43202f830e20ad42c96c39ac9417541e598ac94abfc45da09848a6
SSDEEP 12288:cJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A7523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 52a016e37bbcffee7914edb6e9fd7c36972d18eae7137c0517b329e6d85c6717
MD5 10b70db42a608c93f82bcc3a9c725002
SHA1 952f24dafef348aeb7210bb425868f3c3a1b323f
SHA512 d016bf6e1e44d7175c48926a39070e36d517ff97fd31cda5dbdb73fb1f2de9e172feee0343e63d5954de5760dbe8dd03733749d22bf9c4ddf1cf3e6c9946a01c
SSDEEP 12288:OvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1817523BE965C41DAE52644F5C3E9E10DAC073E5BE9200483BA977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 1630d6c5344c9b9eb39c0204be18bf40d52c0e48db8660ba8c70b33a534fb168
MD5 d54cd93d5c8c44b0a7ec42d286162f1e
SHA1 b53c5caaeacf75f7d43d18dec105baedff8a50ed
SHA512 d4c9d75f50d88ce207d0529a828299a6e12f10931b6b717828768dc278d6614dd1b4cd628be928a96e14ae2528f0e1c2f76e1373e8a3a27e2988ed94c4fd0e53
SSDEEP 12288:joXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:josqjnhMgeiCl7G0nehbGZpbD
TLSH
T1367523BF955C41CAE52608B5C3E5E15DAC073E5BE9200483BA977CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 ec4a7fff4eed5581d86d83ec7fb40dbcadba45699efa2a15595cc6ef0b5b0b16
MD5 d1dfc3e6134d3c18036de37ec20a2b30
SHA1 db2e214120ea20c09c2b1b667eb8fbba8395ad18
SHA512 1e9e494a63bc32d3609a24a3e593b8f58ecc02c3abdaeb33b49ddb6071dbab1a67885a5936f8ecd6c0bad6b10d7e659241d7cdf7a7d077d00b651a25ef286e99
SSDEEP 12288:9iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9isqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F7523BF955C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 02990cb140306fa37f220507d36a801cb7d0cffa235f73559c377812e07aa87e
MD5 b4600f915c9426ce4dcf8112fe3a42a2
SHA1 75ba051cbd9a149f2ec19b39b31166059e688f43
SHA512 93e8fa1532d6521d37203b40a4f74d2171f9dd550a299d983278a8c472612b15407d4d1813571bcd029e43866e8d92c99b5faea8d084291ee9c3af535ebf5c59
SSDEEP 12288:RJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B67523BF965C41CAE52608B5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 77e6e3f1c26793cc214ff440ae15cb61b33192a22bf20eedcf1fab5bd9e26466
MD5 caefe8f8149b442cd3a058166b04ef3a
SHA1 66d814568cb309261383a99fcb7a6f5c023132ae
SHA512 bd697a519257d1847b8d16511179e8d5eb110f160e1a886002a9882d3ebbaa3cccfd233dbb51a500f34a631edd93697ab7b797f47646ac5982d69dbae7eee0ad
SSDEEP 12288:BKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B27523BE965C41CAE52648F5C3E5E11EAC073E5BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 ae9be6109d64f52d994cb672a40344718e6da507f44db23a0235f7a081769a97
MD5 8a3651770887f56b45f9a5517a74054a
SHA1 4ce727dd7794ba0cc243b0b93e42e6e7e56f0ef8
SHA512 426094fd0b647f2392f162bc11ab243b15a82c2c53f0ca74b912ccd96c9a904352c4f569f0a9b70a97a3aa0d55237c591cf53fbdf24ef5233bfaa082da6dcf6d
SSDEEP 12288:X8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A37523BF955C41CAE52648B5C3E6F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 96399fe651d82d93de5d4bc8e127eea0c3226ac67147cded1707f1fbd65d8440
MD5 670be899c9e2341ec2ecd633326a2d11
SHA1 12ffeabc9c5d04babcc3be54c1778d0441c81f86
SHA512 d6b71065359f79fcb7ca3d18c440515b5bec1345948ce378a26bc02a876aba87be227e2f384350f9bf3de967bea27e00feb45a1f10b94d10f2c752e13cec3c68
SSDEEP 24576:sfwvzk9RX6wkyAI2sqjnhMgeiCl7G0nehbGZpbD:nMnYI6Dmg27RnWGj
TLSH
T19195D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e093f90266eab0a2f9146cdd04ef4e396bca71d304f5181122b23e728839cb75
MD5 992e8d5b4dd1a74d925ef7628e528d51
SHA1 9f842312a93e834d01a0d047fdab8024c8a94586
SHA512 980b87a57e6484ab3e13eada9f4e2fd9151e1d593fcaa8c27bdfc6fb5023628e80a2cc6e72d0cf50cc38753da245dd449ee1ff72378ea015ba39da1ad58ccd57
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hDmg27RnWGj:dySzPpD527BWG
TLSH
T12E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 98fd77a91737857509a9ef3cc4e74f693b7089f0260391c95b8343689953f8b3
MD5 dc5d0187ca6d3351cbb2dbcb13d1caa6
SHA1 ca8cd6c1d7d6ea26bc071c76fd0b304b94cfb90d
SHA512 4d8e3a57f4bbf047d3128e114c0c3d46bd84e142807a28d6bc4af6ad8096feafcdc45c951f795bff09368067d0e5d31e441cc2f58e49d918037105346bd59917
SSDEEP 24576:r47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY7sqjnhMgeiCl7G0nehbGZpbD:r47JUQj1irIhCnDHUPfF/RDmg27RnWGj
TLSH
T1ED65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 8533992fe1e66763551b2efa7bb9bd3813edc5119a7fe021719b876593d3ab8f
MD5 c307cf2208576829b375df6cfe583249
SHA1 0af3d612f18e56ba8806a68977c6e5b9e636f459
SHA512 d97c06d4dae1bd940e753fa425d53ae5743354d0fc87179c4c9b42f4cca8ccd4f02f0b6cce3bc56cde2f59b5ba044cedc26a9eb223738a617a870735768512cd
SSDEEP 12288:O4sfyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF75015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 3a19d0df6468c7e6e95af66b232c14f82cace983faf602da2f9042a3ae8471c8
MD5 241ef6e535a39ee8e2e0fe842e1e3b8f
SHA1 fbd800150209af05e648012d7abf0a5ee30298f1
SHA512 73c899f6e34935271e23f6538aed3ec2fa326718421655dc5368e436fef7b0838bcdb2e73cc95c9fa7945692c67a950c37c21095df842b550ea2c3a5f97ce777
SSDEEP 12288:tkh2lU3fG7T7ZquGseWT9iUjMJ+36t1lIyDR3+TkL8vtjyFN:tkGUPSoUE51iu3+kL4tj
TLSH
T1D8251744766AD78FCA6840321E77D5CCAB707D11EE04AF0773C8873F8476659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 466KB
SHA256 8e1affcd5f15a6f9155d7f5a2d8ec81419a0d82f7dd172295d9e2ab2e21ba484
MD5 394ecc6892795cc02a47bc4181f57796
SHA1 f4b8f62945dc0ce93e5628054156246179718e2a
SHA512 a0028c3af623628ffc8f280e19eb40508bc0be4df99cea4d24612a113eec089bb8ef5ba5f3e32e943da7b38d00135ca124c95d6cc1057bf6c758e54ee3f80a0b
SSDEEP 3072:T+PsTflcjRCPzNvqz+NK3ZT8sVfMl/YRYzC2GTWE7HzY0oFaG:KPsTflcILt6H3ZIsVfMl/YRQTGTr7Tc
TLSH
T1F3A41A00775AE70FC9AD8077123191CEBB787816BF02770237C8CEA8986656F78E66D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 d99d4d419e6faf7459e51c895e0851a506d223385aa3ac2cd7f0272b5b0b5ba3
MD5 b4b6027492f305e4094eb045bb854966
SHA1 7280381574b5774d744987a9cd3fe4a4280f2d8b
SHA512 4a0048d323a3067328f8a3255c88b85204a80c94ec3c3f526aa0fd9078ab605ba6366c535b62db9291d3848c4b5873f725b733b01e2b6ecffdd97b267bd5dce6
SSDEEP 12288:gu7aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E275237B935C518AF93609B482EAE12D681B7E669F1044C3B90778FEF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2304958f4192040562775248d6d8bb0d026a3e3c152a39c5311c8f6e983ff6f1
MD5 69dec4d40aca5acca2ba51578e3153f0
SHA1 e59fe2beb86a18eabd2d62732e213a6e4c621bd2
SHA512 f4618d901b5d095cfb29d6938e16da2fc640edcabecfdd1ba91949ec711ea218ccdaae207f96ea7ef2b22da8ad60e7d356e3f25588d8f174e72d0f487abb0f63
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYAsqjnhMgeiCl7G0nehbGZpbD:Jgb4mBIBhGFvDmg27RnWGj
TLSH
T19A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 1925ede248dbd7c5740f1b3f4ba63529220f4943afb942ebaa182765f1aa3bf6
MD5 bc9cd3660493471a8b088ffbaced7863
SHA1 3ff7f3f63c91140cd045e5957d4b93502e7468f6
SHA512 2c5941c3bd4c08db0824a726a2c4942d938d3d46547122bde3bead75329225916faad09394baac8551a706faa6e25d625ce076f116dc1d086f1433749ff1c16d
SSDEEP 24576:bG88u8FpJqH1Ezria7/mLsqjnhMgeiCl7G0nehbGZpbD:67ZFPqVTa7/0Dmg27RnWGj
TLSH
T14AA5016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 b2af1186f58d2882849ead84b38d22bada875645601ae1f2f4bc7c7067793e10
MD5 53d88377d3917593f52013afaea8a48b
SHA1 668bed07a948fa94a3c56736a738e28342159197
SHA512 21a0f177fd0deb1f62b5428caee57e6ff6b066d402e4fed16442d186a70b6850944b8e2efe234238b29e45eb757ef9b2d07b9787acce4118c7549ce0989746d2
SSDEEP 12288:cHvUrBFrEjwaQHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:cPUr+NQHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18185F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3839a2e4c30308bea630ec01b3e4b4aeabe9dd63f9d45417aa66cc0622088add
MD5 ad7b96824f8680c297119184ec0f3d16
SHA1 726b1ad2aca1cae1fc0633dac6e948cc488af41f
SHA512 406b656bb7afeb87ca91689fd3130068ad0d9fec10db2eb4b933855ec0193244008c896d50836d872004113c70e1c049790f9513412ec529a6217fb642e64f01
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrDmg27RnWGj:SG05lO43bSD527BWG
TLSH
T1CED5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 378f749f1536ec98d48effae31f99e4706d2abde9e288c1b4803568a6ccdd680
MD5 ba9d8e51ca6226a4fa8a988bc6f98906
SHA1 3ec6898589e4ff6370fb21bf533ec9e161883a2e
SHA512 701b95793338bde0e702d87f2de1fee13baa69ba6d4a1f9f26ebbc3c7e9337142b0043767074f7efaf1b0b6476bead9515eaa2105060f486ea14aadf810ce5be
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn9sqjnhMgeiCl7G0nehbGZpbD:Ca5POZ3+Jt2pasx2+mTDmg27RnWGj
TLSH
T1F665BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1d120d57878c0c5f592ee4176228d320d2f927be23571d7cae8d4adc4391c7cd
MD5 959240a300bc4129e782ef6618f2b701
SHA1 c8626e0a0f10b38fb77889eb7cd7815687410ea9
SHA512 e97062e48a126218c4b303c402e132e414f559c11db7856c2f379881ae8c35eebea0d4f04398be621d3eb84f3f95712936f6e94318df6739e6fb6452187c26e3
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkjsqjnhMgeiCl7G0nehbGZpbD:ENc/zEOVHFUDmg27RnWGj
TLSH
T1E9857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 22f48b3ed2b9b59d339fc701bd25c8aa0bc21f05faf333eea161b3956b2f5012
MD5 ebee0f59dd65ea2a4cea904db22889ea
SHA1 b7ca363058c7ffe67a7d156d10071e65a93a6a46
SHA512 bbcd616efeaab6e58d9c9ae05ad1299119805e89c41bdacc60fddb8aa1c967147839ad64265f3f820ca7bcfc491cb835c9d5d0316bd275a6baf0580d45db359e
SSDEEP 24576:I8kNvNnaFeYhJNtmZBmUsqjnhMgeiCl7G0nehbGZpbD:I8MwBtOmwDmg27RnWGj
TLSH
T1F055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 8235dfa84e5b8ff7a3363acaabb8f5f2267fcba68d7b3ce81c6f7182508743a3
MD5 bb4ed62be9ebbe9abf691fe128f831a5
SHA1 888b53392495b8f851fa443e8b8b3612c2aa4f07
SHA512 16ac54e6fb6be7d492d252a99711d341f89bab6f15bd7a1ce2d79857a57bd5e5eccd0a58496ef584f6d4d379af3fc5ac6ed8b9da9cb9a0d26047cdcac3846c53
SSDEEP 24576:0D3FHshBIYQgAusqjnhMgeiCl7G0nehbGZpbD:0DVHeBIAACDmg27RnWGj
TLSH
T1CB95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-145-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/560-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/560-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/560-148-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/560-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1096-91-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/1096-96-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/1096-320-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/1096-90-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/1344-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1344-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1344-13-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1344-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1584-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1584-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1584-119-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1584-113-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1584-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1584-324-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1636-39-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/1636-46-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/1636-23-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/1636-44-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/1636-29-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/1876-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1876-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1876-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1876-154-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2688-80-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2688-78-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2688-319-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2688-86-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3564-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3564-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3564-323-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3564-126-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4388-74-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4388-271-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4388-67-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4388-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4960-52-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/4960-48-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/4960-59-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/4960-65-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/4960-63-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/5424-156-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5424-162-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5424-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5424-155-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5864-107-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5864-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5864-101-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5864-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5864-356-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5864-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5980-61-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5980-6-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/5980-49-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/5980-10-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5980-0-0x0000000000980000-0x00000000009E0000-memory.dmp

Download