7c2c548570faa65faa1ed0299d4924eab8934ee285841e96b05ebf0c93284ee1

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260701-vs2sgacx2z
SHA256 7c2c548570faa65faa1ed0299d4924eab8934ee285841e96b05ebf0c93284ee1
MD5 3866e1c585bf58110f59f7b069899194
SHA1 ee84ebaf6029dbb0b7c6ef4098503e5b346501bb
SHA512 686ce2ca43a6d23600d600bc853c6c3dbf93f52b6237984d93620763fd65933e8c41ad3c8c4b6fceea4d60737d7fce1f1f21c53f791255c45caf6596bedb1d5e
SSDEEP 49152:M+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN7555V:x/PvOBjcXvvOOc56TgK0t4q
TLSH
T128165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4188	elevation_service.exe
1004	elevation_service.exe
5096	maintenanceservice.exe
1732	OSE.EXE
3220	PerceptionSimulationService.exe
5452	perfhost.exe
4756	ReFsDedupSvc.exe
2672	SensorDataService.exe
2412	ssh-agent.exe
4784	AgentService.exe
2024	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\79d6632cc4173e65.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff74b9537d09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3357a547d09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3a2e9957d09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034c39e957d09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6df6b547d09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c37bf2547d09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
1004	elevation_service.exe
1004	elevation_service.exe
1004	elevation_service.exe
1004	elevation_service.exe
1004	elevation_service.exe
1004	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1484	2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4188	elevation_service.exe
Token: SeBackupPrivilege	4756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4756	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4784	AgentService.exe
Token: 33	2024	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2024	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2024	SearchIndexer.exe
Token: SeDebugPrivilege	4188	elevation_service.exe
Token: SeDebugPrivilege	1004	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2480	2024	SearchIndexer.exe	102
PID 2024 wrote to memory of 5152	2024	SearchIndexer.exe	103
PID 2024 wrote to memory of 1140	2024	SearchIndexer.exe	104
PID 2024 wrote to memory of 3396	2024	SearchIndexer.exe	105
PID 2024 wrote to memory of 1604	2024	SearchIndexer.exe	109
PID 2024 wrote to memory of 6088	2024	SearchIndexer.exe	110
PID 2024 wrote to memory of 1860	2024	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_3866e1c585bf58110f59f7b069899194_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5096

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1732

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3220

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5452

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b8be7dcedefeb4da403c098998aaaf7134168b8da6a9d25fac2d3f1df2453091
MD5 efc9bce25bc3149cc5368fec7b777b94
SHA1 7ccbd2eec61a10e088edad24964103ef98296696
SHA512 d3f02871ecf2c5aac16db2451cb3e01664e557d946059f22d3ab9c6e2914e9866e7f4394541bdc26c8deb81eba347dedbaa72629f1e2d5d667fe91d47f4ee338
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnsqPbc+UUBqEf0t4QZH:l3q6HjBwTgK0t4q
TLSH
T119D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4ccd3e02b405deb95f819746d7ed83e237dc7bca1dba7b9fb846568a46bcd010
MD5 5003894b715c84d5f12e58bb7ecf62fd
SHA1 24e05c27d35b6158d6d44e834b87694ad22d4fee
SHA512 7b1b32210d1a261415a1f3cd45aab7949a58145958101330fed50f87ccdc097348cbc145503bc193a2e6d25cfce965a1fd25347c6052d75a96456aa6c91f4d8c
SSDEEP 24576:gXYfDtczAYqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:Xtc7qPbc+UUBqEf0t4QZH
TLSH
T13E75F12977A409F9ED678139CCA28401EA327C544760E7CB03E09A765F377D49E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 73487181bcc15045d1d2fb72b504c348127f71d4372186323ca2e65eac0871a2
MD5 672ae389f011758d10e904af762e28a7
SHA1 5cf2acf630aca0ebae44049f3b05cf816f234c34
SHA512 c8612e9d94eb911a04f865803c86af7c7e698bb04eb44ad80b9eb45a6b1e2619767f5f6a961df207df31081958f1c1f5160f41d2e45449967cdb55a58e84049b
SSDEEP 24576:B0Le5ji0hmxirMBqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:BPji0AceqPbc+UUBqEf0t4QZH
TLSH
T178859E26F6748335D073C0B9C5D2A68AE97130815B308ACB4296D77C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9c94ecb7f71f3d6eb9d09f4badc15b3cf14a7cbc7ac1106d7d9c932ab74bb89d
MD5 30000450878d26fbbb0ebd8bcc47d74e
SHA1 767128fe564e0d215bae24559d0527464d81fc09
SHA512 30e22ec14f148450f845d46b94549773bd9cdf46c24b84fe61b2efcf3b901537e4a1b5e0853c576dcf044a239319b38d5fe71d5f32ca6c887571560e17297825
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyuLqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:7/ezSC6vUzPvxHjyCqPbc+UUBqEf0t4q
TLSH
T1D2755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6c39e8fc642b846659b64786b283d891a78eddd32730489f4752950a06dfb7be
MD5 6d33500f7ab059774e2ac63832b85ba4
SHA1 0371b591ad09880ac6d0d3db806617d85249a80c
SHA512 5e871a033e9cb9779e0ef2f23c17f65e2381376f1401fc4a2f2db3f50da46ca2bc4cf63c4715bf4ad77ff2c24805389847b5e12d75e38a8e1fb4aa749ed7c963
SSDEEP 24576:5VbqPb88hv/l+6UqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:5VO88hXl+1qPbc+UUBqEf0t4QZH
TLSH
T118559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5d8d11b5f1da08fae27a4d9397b1bcac26bc2b1a3162c78475c4971b11e3d87a
MD5 05d8b6f0aabd408145f054cb88b454ba
SHA1 4c6d6b731c96b174633d290eb78f02b79fa50429
SHA512 656c8e3706ce312ea23df18d8b1dec53deae6e9e6be5472a76df868d719f4f85a3f458372343b8bd1c22477f855c6de09d3b085d6af006cdbaa505914563c254
SSDEEP 24576:HRtqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:/qPbc+UUBqEf0t4QZH
TLSH
T11C5523AF6A28A5A7EB3355316CE62C4004385C009D454D879BA0FAFAFD7C611DCEE937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c6fdabcbb48b64c3b38cd61109b55823859bcba33477eed21fa989adfb3cd2ee
MD5 f09a3e1b37e5526d3d464b4f2961e735
SHA1 e7e0416d07715ad1a6661205c93cc7405aab5f21
SHA512 b6f66d19cbff22ff6a2812cbc3cc12a34b859b6133689b3c776c0c86d77e583d6d26bbf79f7e948def9bac24863fad78474376777f13a0ff706deba2dbb6d67d
SSDEEP 24576:CJIU8qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:CJIU8qPbc+UUBqEf0t4QZH
TLSH
T11F75CF7BAE28FCE2C27A9D795A918600977278304F5293CBD174C30EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8c60776c34ac0aadef74003997dc45ca6024988128e0c82473aa6d35e08db9e0
MD5 ac7a6bc0a8283056938df77c0e67a578
SHA1 4130445b3d58835e8a4de56977540615c0d76f4a
SHA512 c4b0506ca4e9c18ba1ffb2e5ed4c2b0cf451835e98e301b69ea84679294bccbc5673efacca8a638a2a30864c7302947234d797e3f2b57d3491b173e945bd7759
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:DQvGAdlCEL8c/yRNw5CmTgK0t4q
TLSH
T1BF266C656BF880F5E0B7E138897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c4431784ec44697af075637fe17dee16b95b7cd7b470264899317c3dd571d47f
MD5 392818e749b99fc734f0ffbffaa250cf
SHA1 54d3f214b06ebdcf01b3ebdee7fbbfd8d45c8f1c
SHA512 c0f9ab38475aa1e4f407b52171384a569f0da4cac60e55d34aa4158f03a4b760b245011dd0174b22fd50933d59eec1957feb4baad3dcf6ccf7a68ff2e1f365fb
SSDEEP 24576:LdewsAjuqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:ZljuqPbc+UUBqEf0t4QZH
TLSH
T18975E031FA74E436C67B0DB21B66C706143C79204F511AC3E3E89E9E99342D2677AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 beff89e1f2bce8c24699433c9ebdcdea58b38cfac2cf9c3c28659a9076cb6986
MD5 c4a779ec646206848cbd694ff4b326a5
SHA1 51701eec0ea3d4cd552b58d989b7d26e2855cfee
SHA512 c6c67245678927f72e1cfd4792c2ef0d1424040e710be88e0845245cbeca12888189cf4e2cc68f72fad54dae7b55a7b59e55b201fd2dcb09240fa0c71df9ba81
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVc:9UEtQevvqc2W1cpV2EI32
TLSH
T171474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8d5dc3e3bc96bdc61d1cd7460d91736ee13a2469f5a119bb25656ea62065fec0
MD5 1053ab2e0b15bb7fba84d74d5af2db27
SHA1 19d693622b1e1374a396ccb03c98ccea979f4fe5
SHA512 f53dd3c0b7f3ac43f54d24180709d28ecb101fb9fdc300dbf5a8c8322bf419af95dd6ffc45ab77320851122ecc1f8cb92f1ff427a69eb7053978d97a6c590a89
SSDEEP 49152:ZCbRquA/m2yL5zifFiV+XenmE3/zOqPbc+UUBqEf0t4QZH:2oqHVjnmyTgK0t4q
TLSH
T1DAD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c853f2934037ba26004d7f9f053132d536e435fd4c83740fe850dcfe5279c2c8
MD5 8583b70cb5358e4e97408efbabdc001a
SHA1 e13cc08678ef32945919286b01fd94fc7a89c9ce
SHA512 b4949baf7ae74c49f7d3c7957b802e2fd17b4d47926103d16d07d8716e69a00f18a1b5442cafbd8d05aa246b488dce94bcbc95a6e75c33b8da6c2e4dde619faf
SSDEEP 24576:aAhGLJIFoiwtA5l7S53PqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:aAMyFoiq5/qPbc+UUBqEf0t4QZH
TLSH
T16235AD81EBF955D4F5B3AA7899B68470EA76BCA55E31C20F2160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0d9596a8fd996b862839c47d7be78db0d3c2c106e191a0022d46b743f3a9b923
MD5 5d7f274e3bfb9866f3525fbcc56a287c
SHA1 ba0985c31306327b9b654cb968022b8cf204cdb1
SHA512 0f99244efccc27a352226f0e0e17c0dc6b417005852e0711d91ce2911607c58f89ce28a01dd0fb8ff6c1b06cbc95acee0d8091989d5da4a2e98352c05487be0b
SSDEEP 24576:UwuoOWiqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:UwDOTqPbc+UUBqEf0t4QZH
TLSH
T18E65F14A77A41CF9E9639139C5978435E7F2BC012A25CB1F1760C66B6F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6598a8392f46de1fe2b5debecdf2ad6df9226a9d808952779f3d722ab1a6893b
MD5 e76d523572e21f92723d2f4ba4390c97
SHA1 22b9964ed811d8b79bbe621f30e3d32637d2bad5
SHA512 c334a7977880b59011f610db86c3aa5dc0c03a0e94fc53d04086edd640963dd8773740e566a45ea96a217870d109e0d13eef0402afcac27beabfb81a39697127
SSDEEP 24576:yZupqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:JqPbc+UUBqEf0t4QZH
TLSH
T12855129E37A871FAE2635135CCE5184087717C106B3643CF166096AAAF36BC19D7EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fcd054ab54098a53355c54a26b2d38b2ecffb060d06e50ed91e17074912384bf
MD5 0de165353232d9db8327e29a533c9867
SHA1 dcc732c83784baaa44d98116eb03a9c82dc204fc
SHA512 ce14d9eb714346f972f884789a29e46391156742704a97282eff49a3ec6715c311c011701917645265ac962a79d4321bbbd516762d3e41de3cfa28f57e528c2a
SSDEEP 98304:+QRQyi36YOcPQLvw2gAf+PN33TgK0t4q:lQyiKayX+PNHc
TLSH
T13C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8f750647f3ff774eb864c7c3f1c6cf1208d3ae8f3bde21ed4977236d1f8f262f
MD5 7573e2d1a5cb5a9b08b556c9c95e9cd7
SHA1 eef72d31e5a838bc2a564f2f104167a83aa6c324
SHA512 c822a1033105284222004f5bf5ff06a953a63c1fbf203a83d733278804892f00bc27b38126148702b2dea4f2fc4de86bb4143eb24edf681d09da00ea64ac9cb6
SSDEEP 98304:HQRQyi36YOcPQLvw2gAf+PN33TgK0t4q:WQyiKayX+PNHc
TLSH
T183667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b735155d6385085b80e46a6c8df9ff68c031f28162628ac315ed0cdd8e2a32ab
MD5 6131c277aecca6802d6664e550983019
SHA1 07a63716eb53ae46232a08f2f57a188e3d30d5cf
SHA512 c537e73fd365d678f13d7437d623884271ae60939b576e98c5b4d6886ebc3f261dcb516538a001a6cd8f2b22f84973e0cae604a6a932d257fd0f008129a9490c
SSDEEP 49152:Z68Qg55nhheWu7PNU3/eqPbc+UUBqEf0t4QZH:nthWRc/tTgK0t4q
TLSH
T1DEB55933B2F600A9C44DE1769F4A872196E17C718FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0559bbe4815053284b7557d9fe73b7b443c6f91da95182082d5a4306b9159b7f
MD5 1b0067bd2cc80249c782f4173d5b50b2
SHA1 afb82e0649b39b36dbcbc7cb9e900387dcf4bc4a
SHA512 40f99a71245bb8bfa776cbc2d84ccef2683bbb9240c40396c458a3032349117c9e4754f8741d44af0854c01723976398c9b81d908fd2becaf026fc2dd532e530
SSDEEP 98304:yy5112gYy5azzVvL69nLKnhZgTgK0t4q:7LIHmWhKc
TLSH
T1B9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ad6206c9a7a0807e545e9d2ba0c46a074456c81a29a13f7365c420d6cc0da12b
MD5 50f53089a656455ce8875f7c7f71af39
SHA1 bf8931f280ba4b6582578068e08e905ad2f48697
SHA512 aaff06ef269eef206cf55bb32c110b40accba0302034e677a6130a1972e7b6975a30e436616cab894968fce55eab204a39d030d95df68c5dedbe6f839db3d9e7
SSDEEP 49152:1B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpqPbc+UUBqEf0t4QZH:7u6JmVxd2d0TgK0t4q
TLSH
T17BD59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d47ff7c661fb600b33d0d8eef73e0f35c176c8187231c4eca8688ae88ade8085
MD5 4e42e1e7452f5b952c4fd93994ae4bc2
SHA1 53f9c2d96caf2c41ddf8c7020d02bcd0751498a5
SHA512 c9769ebcf4d130b6e9453b01669ec95108847bfd9bd230c59a2c8e2bcf9acd5e2802786c839adec42f71d2158c4be6a517457b4ce84b16b807aece8d6a2c6bb0
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xcqPbc+UUBqEf0t4QZH:DmifPbRyTgK0t4q
TLSH
T149B5BE13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 46e7d884836ce95529da193c8581cb4d678d09da9fa06355eb9db98adfa99072
MD5 db7fb5e048443a246af35d4e31309965
SHA1 b168cce9f8382cf730bd0e234555eafb7226d854
SHA512 f0174e03c8d94991a30389d2207a9332b9302b2c897254ae510bfa98572e1b2f423b4d0830e5b49d23b2198c787bd224e63ab3b0cb9baa7e3076c109311ead9a
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHqpqPbc+UUBqEf0t4QZH:V5dKTi610TgK0t4q
TLSH
T194C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aada2d49271324ee2c6b9919ba236f49e3b9c8999aba31807ba892c9477fd03c
MD5 ce4188aa46b0ddc16b530f89743477c2
SHA1 19b2454731a786f399b37895f7b0428dc65d71a1
SHA512 a424394517a463e48ce8b03099807763912049e6b92729e45fc1bd4a5dcd9b71207a8219b7b0a9fce7f82e0b1842ad99b8cf8938601f23c5ad307915ac1f70e5
SSDEEP 49152:0htSn8EApI0figngiDn0AP5wYqPbc+UUBqEf0t4QZH:VX2iypheTgK0t4q
TLSH
T1E395BE13F2D900E8D06AD174C7468632E972BC150B35AAEF0A90B7561F7BBE45B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f504650ca9f6233dd33cb09847860761a32bc5945e66cc65ed016f10407b504d
MD5 8705e2abb5def917a5448fd748315279
SHA1 3eab63ff85f78f39245d9d76ab8c7c804bc04e42
SHA512 a745735709091ccd239a721a5d757928594dddfccdba1860c899569c4231e85be709db9a3c63fcdc231bf64327e9f2caaa2717477a378615a6c4bfdb5b62eaee
SSDEEP 24576:j1qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:ZqPbc+UUBqEf0t4QZH
TLSH
T15555236F392996ABE62395319CE6184004381C00FE4645C7ABA0F676FE7DB11DCEED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 06389aa7afb48da0e50d92a0fd6dc7358409ceb902e3bdd5e91b8510f2e648db
MD5 a8cd7b38a3185ebb080623ca454ab3d8
SHA1 aebc5aa1f1304a6be55875cbc43843f0c095d53b
SHA512 65a63f7cd16deeb28db719e433778baf976d6f85a32b8590bf78f3e4729b0b195aa759f5ead9890b0d3b28b6bac59cf3a4ed9b55b1981a3c2392dfcabdbd6438
SSDEEP 24576:LaqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:+qPbc+UUBqEf0t4QZH
TLSH
T13755236F39299AA7E62395319CE6184004385C00FE4645C7ABA0F5B6FE7CB11DCEED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 380797c6fdaa28c32ab67929bf81cf4aa1b22cae121e94c89cfee594e52143dd
MD5 db01caca59c87d4d0a0fb799b6497ba0
SHA1 25c35a42617b97efb1aa3116c603a400944e9523
SHA512 31bfbebdab60dafeb3bb896cb92dd4314b6fd102b69d41abadf38d00d9e298a0091664f36e452e51ce774483caff20a9692dc2c71e347431f178a9e3a1d544b2
SSDEEP 24576:NEqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:mqPbc+UUBqEf0t4QZH
TLSH
T14155236F392996ABE62395319CE6184004381C00FE4645C7ABA0F5B6FE7CB11DCEED76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 aaec1abbd344fa4809e6d9d69851d7795f4c438b1e4de53f9997c7a2bd355ddf
MD5 a6e6b04df7a9c1ba353c5591dbd110f0
SHA1 c84ac402867f4ea7b8d1421a02d60680ac38d307
SHA512 3628229435d38b5872ab5d53b68cabfd54bdf470a6bb6ff68ffa24e6d7d725fcb4eb08254cc335569c5e3052a62d4abab32f96fdd2e89d69e8ba5d0bed609eae
SSDEEP 24576:JqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:JqPbc+UUBqEf0t4QZH
TLSH
T1D055236E3A2951E7E933D131CCE2184085787C10AF2246CF9B50A9AABE75750DCBDF36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 58c7c87fa5e9b0e7a03663e7ea981380ea122b0ca55f13490ea8dc07b8082ae3
MD5 c5d772a59f1fbff9b62836841b482666
SHA1 4f1128880668afb7515eabfccc257f8dbbd92547
SHA512 fa423acf1ecd53a37e2616afd5e1a505b6d9e82c261fcc3d8363afaf7b9819ca3c177dacc123f18d56b30d5e571ec26e3b2c0e4b84151db0ca857bfcda26dba6
SSDEEP 24576:onqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:qqPbc+UUBqEf0t4QZH
TLSH
T1F855236F3929966BE62395319CE6184004381C00BE4645C7ABA0F5B6FE7CB11DCEED76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4057fa479807d235643db543069dab2244c9f22091851d2dddcec9dd5f38713b
MD5 e3c81fe34a4e277c8bc8c785174c8dc3
SHA1 39345215d6653aad140512b74eb599543ce0871d
SHA512 b32f1f306d0966f561b1739b8ce9a9661a0eda42ae470227ce20fe731cf6df4bc1d8279b7ccf6aeaf51488fceb651baded812cd4aebf5aa86bc764e5e60a7efa
SSDEEP 24576:K2qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:1qPbc+UUBqEf0t4QZH
TLSH
T1E35523AF392996ABE62395319CE6184004381C00FE4645C7ABA0F5B6FE7CB11DCDED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 af70e45f745280e0b2726cde8c9d59e7f5739509f159d94ef0bd66ddfd6797ae
MD5 394280cc68318c7a40a246864722458c
SHA1 5f3e2a4b7b3fb1f10fd76f4f6786a7a562a6148e
SHA512 4dd5f6e9679f102b81a3e736b60accaa1c2a7a00594175d3fca86be693b801595b29353b1bc4852cca48dbf9577414c67694afd3fadb8e4e3e8bd569db081f19
SSDEEP 24576:USqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:1qPbc+UUBqEf0t4QZH
TLSH
T1FC55236F79299A6BE62395319CE6184004382C00FE4645C7ABA0F5B6FE7CB11DCDED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 22f64b72393c9730889cb0ca424153a79b6293845973b41d7f37520442ae0697
MD5 98115b82c6e74346a74e0e8b9774ee2d
SHA1 4b3931fe8adb2ef65e288e9fc574c50b9f3e7e33
SHA512 dc4e184115fdb077277331e391a48b0b04c3f1eece4173f1bbf9251c835537b0582761886f4a17fb1b90b172ad077f1194d7415cb87c3b6e6c4ba62ec07ad4d4
SSDEEP 24576:AZMSzFVSO6qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:AZMSzfGqPbc+UUBqEf0t4QZH
TLSH
T1217501A9B36018F9EC63813ACC654805D6B27C194B60C65F07E4366B6F373A15C3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 db2ca189070cd5bde69026f2c3268806cee2309bc2586d01a998941fba057493
MD5 88c7c03fba565d8abdaa40c83e9a5aa7
SHA1 078265cc0ba5fb4ac3e958d3e39f74cfdcca1b6e
SHA512 963c0178ba9683c6d338346492d7b47eb3243c488e1a6b8c62dded5d8ada86876adfc2d8e415e879e6abf796047fb819d4f5548582ba807cc07da280dbfd985c
SSDEEP 24576:05qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:cqPbc+UUBqEf0t4QZH
TLSH
T1035523AF392996ABE62355319CE61840043C1C04BE4645C7ABA0F5B6FE7CB11DCEED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 68a1032b66535debad29ec78fb1fd3438eefbf197c604093acef1d9a6d62c45f
MD5 f874c225ddbe258c8ab8767d71110200
SHA1 6065af583eea23d6a316cd78ccb0e3d31e5fbfbf
SHA512 016520db05b8b35dee5ce70f235aa6b50abe9b72e714083ee37c725e739d781bd426fc12f00a1196fb50c1002cd2462a20e2554284418adaff6d6e2247bace14
SSDEEP 24576:79qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:hqPbc+UUBqEf0t4QZH
TLSH
T15155236F39299AA7E62395319CE6184004385C00FE4645C7ABA0F6B6FE7CB11DCDED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1611d10d19ffeaf4220701e8175ea2c3abdac1cfaac0ea335753a321eaaa3795
MD5 13598aa393f9a6e2968cfc7f628e4b26
SHA1 5bbd478d480f430985b1f9e80c6a3c8e6f94f6a7
SHA512 661e811016d93227bb88db3ad77d0e32984deb17f26cbb8d0be061f012880605d357dab85b7c6a7cacb55914b65b3b4518c07e693c3d87045cfd3936c9c8e76e
SSDEEP 24576:7zy+qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:7zqPbc+UUBqEf0t4QZH
TLSH
T18A65015B336530FAD1339234C8A21901E775BC315B208AAF57A097B66E377909E7EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8300b22da83a7221451b7b8cb393321c5a1e4da8c09852b09f9595a037817ba2
MD5 d7928385107e999dd67a65e3cb0a0668
SHA1 6210cb8e2f9f750e6ef1d81269b9b7f8c96e8b3f
SHA512 496b591e62d50830e49b0bde3e252fa17e30aa42a28605372f17672e350d0d7fc25cd4268a673d790a945bbab80f9d6d486b9fa1115bab40701643966a433388
SSDEEP 24576:s5qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:UqPbc+UUBqEf0t4QZH
TLSH
T1D15523AF39299667E62355319CE61840043C1C04BE4645C7ABA0F5B6FE7CB11DCEED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ec10dd483db0f0af2d30fa0ce5b233fcb0afe911e802f9495840aa76a215d506
MD5 505491ae9ed9cf2e627fca444a139e8f
SHA1 28445ba21c779b147892da087bf55cd5c018d57a
SHA512 8bc9209868a1ddb7a958c0187559e95d0792b44253ac990945b2b05624faf60a87c9ebae14e97becec4e99abee9812a3d622ade48b797c21499ae651dc638a38
SSDEEP 24576:S5qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:SqPbc+UUBqEf0t4QZH
TLSH
T12D5523AF392996A7E62355319CE61840043C1C04BE4645C7ABA0F5B6FE7CB11DCEED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 667213a099e50810a73e98f377d2eca0109fb35dd0021b35eaac3c98676cebd2
MD5 76c212116b65d56eb88e170eb5efa4ac
SHA1 35f1ed270f5a31baabda6932a6960ef6a71b635d
SHA512 3a8b0113957bd2ceef6456a2d1bd295c96039e04f13094754ce588db8f126468d8543115408ca590e82963e8be8cc782ce5f290977b3bd4d59b9e0d8d85a8efa
SSDEEP 24576:Xzy+qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:XzqPbc+UUBqEf0t4QZH
TLSH
T1D065015B336530FAD1339234C8A21901E775BC315B208A9F57A097B66E377909E7EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 26f5a1783ca6133b5bbd5aab25a1522f4d858c560affffa45edfdd5b2d67844f
MD5 edc0b8147c2dc8f9ddb08f7cff1be385
SHA1 b87041f76410ce0506ac559b3c65cd1ce499152d
SHA512 efe474f2f6fc1b796a94f70e3d2d0a5401cf63fbec5d4fade987996bff8a9132a04ece065e2f3eb986e5a5e438884b6834f2f1619c4f56863f34ce385bda4aae
SSDEEP 24576:yTHaLl3z0zD0qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:yT6LljLqPbc+UUBqEf0t4QZH
TLSH
T1FA7501A9B36018F9EC63813ACC664805D6B27C194B60C65F07E4366B6F373615C3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 18ce3edb495b165d45a6f0d771c26248c5824995b056e4c02b443e24f448295f
MD5 7b6233ef06935efb303d00bd794506c8
SHA1 9eaa0360bcb721a820aea177f4238eba0c1bfbeb
SHA512 4c25b64b18697381ade132205c950fd612a1fd79c00ea6f404646b5b3aa06e6d14a379524cd5558a64421c8f0b01d9d000a3c59d8ae5cc21a02711aa72bd43f3
SSDEEP 24576:+37d9CHKy7GZgqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:A7d9CHKyaGqPbc+UUBqEf0t4QZH
TLSH
T14385CE90B3E814E9F1B39A358D765501CAB67C591B21CE8F03A4666A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b070cc12423f9d96c41e5fb2305d238341a5bc96a32cf3085835c96678a7f095
MD5 23dd698b62131fa3b098a67c39408da7
SHA1 d0386f25ea3f65542fd1a2f339a43013ddc6a9ae
SHA512 12008c35cef893f48ada305944211f25a58ae2dfde2690b7b79152138ab57f17998ab9658b1741bf34dcf638a98381580f41bd9f2a0f94205582118976430051
SSDEEP 24576:jkqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:4qPbc+UUBqEf0t4QZH
TLSH
T12455236F792996ABE62395319CE6184004381C00FE4644C7ABA0F5B6FE7CB11DCEED76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2a29e194b9aca35126cd1082a3d6c9e0c040bc9eda3498826b6a7dcad899f317
MD5 bc88da9b6dba5a6b23fc4a10fc39fdfc
SHA1 8f8f37906e8e3eb537ed34187aba341518395951
SHA512 fb364921ad48377e2ff30afb1018674438ab3cfc3024125515c997e02c05d2852cd464b0b4a0b4042e31df24ca8ba8b76c8a3d4e2ebd89702edafdd1aee15725
SSDEEP 24576:keqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:RqPbc+UUBqEf0t4QZH
TLSH
T16255236E392996BBE62395319CE6184004382C00FE5649C7ABA0F576FE7CA11DCDED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 87d6683cad73cd624eb77731e27c59e37c6e7165b54465b48760f6282bce4d08
MD5 101728465da0936be23cef897a8490ee
SHA1 f6dc659b4ec46b4cef4f21a7680c9c6d4f4069d2
SHA512 3a0d223116e00b64abcc6f8d1b18113c7f783623e76eedfeec3b7e6eb49d3204ada169ef7656fb2271746d5cb6dd3543c2dd63823cc04c41a02f1e77e86e0c04
SSDEEP 24576:YDqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:eqPbc+UUBqEf0t4QZH
TLSH
T1875523AF39299667E62395319CE6184004382C04FE4645C7ABA0F576FD7CB11DCEED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9e54ed380f5e15d6fb98f0b1ce34ff097c35ab92959ab384cdb5f2de0c3e3112
MD5 7eeeeccf7146dbc79b07cc00ccff0f2a
SHA1 743284732ee5f141d9315a979d7275ff88d93231
SHA512 74640124652424f89699172962d5942f2140f6fda4ae5ce490fd69c3fb54d351cc26f3938fa109d9acf0bb7cfdfc84791d29bb4bdf7f34dff56d2bffd48d728c
SSDEEP 24576:25qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:WqPbc+UUBqEf0t4QZH
TLSH
T10C5523AF3929966BE62395319CE6184004381C04FE4645C7ABA0F5B6FD7CB11DCEED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c55e38047170029b49c9f08fec6366c9b31b0647dda063428c049fcee7c2f9e9
MD5 36bf0bc2af23313e0228b80973d8385f
SHA1 d440f385b4e83e631dd50ceff7f2072c3de05760
SHA512 91a2b078334564f8e19d3d351a9cc0c761ad25a9e3d4a1176ab568b71de3329719aa74af5af0d54fec175d092b29c9ccb10db9c10fb5444e83312438f86b6ede
SSDEEP 24576:ZkqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:aqPbc+UUBqEf0t4QZH
TLSH
T1615523AF392996A7E62395319CE6184004381C00BE4645C7ABA0F5B6FE7CB11DCEFD76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b84998722837c34803f7a19c63c54bb15a79e35958c28803c446107c1cd510d4
MD5 de2076cd1e1819a01c57778e61cef553
SHA1 6a650b62e623a66fc3ad0e710114f9f3dc29b985
SHA512 7d19a62e857385448bfc934b78474fcbe14a5cfa4711ed14f1b929ae4c0389bb20997d9efd02424227613c9d11d5b7b49395f353af07777ca99075fd58e8d437
SSDEEP 24576:ExqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:EqPbc+UUBqEf0t4QZH
TLSH
T18F55236F792996ABE62395319CE61840043C1C00BE4645C7ABA0F6B6FE7CB11DCDED36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a0cb70294870e6269a4e280f965ac6f7e094ff18a74f7f1d0282e68f9900a929
MD5 ebaa3d65667449c62231fb10ac924ffb
SHA1 91329918562a0795793c82202201c6bf02b7fc0b
SHA512 d8a318d5cf03a96497d58226cea93b21df813820c56f4b8a7618462183e4bd43a51852a4a52aac4ef665e4c800b9f4e3e1d6a59eec71eaaa217d182eb75fe812
SSDEEP 24576:YnqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:6qPbc+UUBqEf0t4QZH
TLSH
T1425523AF39299667E62395319CE6184004381C00FE4645C7ABA0F5B6FE7CB11DCEED76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ade6aa0b09f114a5ed9909df42f074e978ab3e9e9ad0e085a53ab77e1055e3f9
MD5 5d431f61b323df083da7fb3c519c8ca6
SHA1 6aac285f78a8f300f46feaace2b7e307381541aa
SHA512 59cc5b902f70d7ee8ed0dc0402f4a79f6cdcae841e0025247b9d23c74957ac65de36435f6724651742fddd528e2c324391799edb7f3bc7cd1f17caa00214ea9f
SSDEEP 24576:5fwvok9RX6wkyAINqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:fMnYINqPbc+UUBqEf0t4QZH
TLSH
T1F485DF29EBDC44E5E177923C89B7460AF6B178581B31C6CF029653AE1E37ED09D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 06344d1b9e6bfa29a3d676654bbf4051dbeaa012f5978d096134a83b3ef5b40b
MD5 c61845ae2423c4b75394b9c479a937d6
SHA1 1f320a964e7307339a458a71a0c20de4c2e4e410
SHA512 9b9d3e1f01dcd59c31e4821ae4ac5b2f23f59ede7d7e43dbe6babc9e89c9275fc3dc5fd43b325d050cccc14f2cf4a4de417e99d836a6867cc6b2b7bd7e1d34a7
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04qPbc+UUBqEf2:9ySzPXTgK0t4q
TLSH
T11E066C96A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 19f17e338d6b3f88a2865f065cc013a190a6b7ac7a60cd640b277c39d1a35bdb
MD5 7418fd03d9eace8144e7a2c254c23270
SHA1 c4a327f904a769847abb2e04fba7dc4a5b1bf364
SHA512 6ecc754ec3e741298868bf7476fd87c007ea906f4b95fab974ab04a18b1db38520497457d95bd2ab3376632743aaa9ef6141b821a0816d060835f140dfa7b40d
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYKqPb5a+UqbBqEue0a7wyY1RYZqYuWe:a47JUQj1irIhCnDHUPfF/IqPbc+UUBqH
TLSH
T14065AE1EA3EC01E5E17A927885554A1AEA71782D1F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 df5c3dd54e39cdfc60d6ffcbaeba6ca8d4330587dbff81626ee6097fa1c923e1
MD5 ddea9acd23f38273b0fd30e2bc991416
SHA1 3742cc7179f06b2686d3f2875659d25f5e75e618
SHA512 8aa5db5862c12445bc82b271a3fa0331f3285f6ec29f768240113038edefc19941c3e3ffcd727c8d771740604e2427ed1ae84ba21c171ad4667167e64011d053
SSDEEP 24576:ApqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:wqPbc+UUBqEf0t4QZH
TLSH
T16165F05AE25812E9C02E6135CB964940B3373C249BE1C3CB57D0F57E2F7A6909DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 a7f6de5da1cc68bf3f682d10e870695a7797c224c634ba946ca9e2577ba657c2
MD5 952eb849ef9ed721c72ddfb649a48c2c
SHA1 8440a5dff0215cafa11e8d537b4c413ce0f9002e
SHA512 31ce48d53877558c0442929b833e3582861498c7b0621fe9bdaa5bb15a19f2958fcba2095a716eb04998dc502e79926540e47bd471d4d788e47adbd0a9a06b87
SSDEEP 12288:L492m/jU3fnGQFw75ljIPnEXv5/WHT8JVxrnEKr:LM7UPnG5jIP6v5uHoJV1EK
TLSH
T168350605766AD78FC66940321E32D2CCAB707D11EE04AB0773C84B3FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 0d9eb7b49d199ed30ea20bb48b9bd91b2a21c7ca5d1143af7c20e0b8a99f69b8
MD5 d4ae3eaf3bc10a6b1cab4ca158a27527
SHA1 add610690eab15e28a6be77293f8857651aed30c
SHA512 d187ea7c60d1bb0848957a8a57c4b275694e94baa30044c3812ba374e371b8fece0976cca054ded72df4d20d416bd68eb49621912768d9b68fa8a33e34e82bc0
SSDEEP 6144:jEew+Jkg1y8pj6nIuO1zTr5XYc8fVTDetMxnDetMxNEnuQ1CrB7/5NBaa7+8v2k/:Ag115z8fVpQk7/5t7+MmW9V
TLSH
T1A475F9445436A38FC5BB6072073A9B4CAB74EC16B7056F23B3C8493AD86AB1570BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 55fdff91063c63d458898f57d069ac87a61f55413c2c2c9fc5df54365ea56aa0
MD5 a03c2ac28254388f3eaabcbc0dd236a0
SHA1 eaa7b95f86dd33e02b04722a02942986de923bb3
SHA512 861e6a45e6f9cb571c16d1c3f55a6afef93a220f24a0bacb7209d514f6bfe24b2d4b7936315bf23a3e21757585b9f12dc7e3e582654562d76a871779b0fc7724
SSDEEP 24576:DhqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:DhqPbc+UUBqEf0t4QZH
TLSH
T1FC55236F662CAA67E933653058EA5800043D7C109F0584C7AA50F6B6FD78A81DDFEE37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3d062c66d3dacc4fb0e2e555b97c6ca722d279ab99673e731a941208a51fca4c
MD5 7b1e16214cf6faac3ea7e46eb40db935
SHA1 7aeceaae18d9b297e55afac78445535d116eef2f
SHA512 5f17a9b4a37b655d9b952d6e9741d2e7362f0b046c6915fff1f23e5ac79b586105c233afb0083545035ec96a90fbda6ddedfa0a6c0ade3888248112fe4bf55d2
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYLqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:egb4mBIBhGFKqPbc+UUBqEf0t4QZH
TLSH
T1C965AE1E22EC02F5E0F6E2B89DAA4417D6B278160731D2DF1251427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 71433043d9884992c498b2a13a5cb786aab5ea0a768f2609f63be0d97c04cf71
MD5 75eb1303f44d09cca93a8d066db4c7cd
SHA1 73c85bd5d23825389621af361e862f6bc9757dc9
SHA512 2055e17aa57277d5ca7c8d54190232aef9654a46c8743e348eb3a536d104e463115389f48c0f5590de5b827c652f2760290cef85bd3e824d80772db2c0b07c5b
SSDEEP 24576:aG88u8FpJqH1bzria7/m6qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:h7ZFPqVea7/jqPbc+UUBqEf0t4QZH
TLSH
T18B85F16576E101F1D477D13889864663F6B2B8201364EBDF07A88B652F33AE14B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 937ad12491e3273a8c45dece74e07693fbd68648f691589605840dfec65976d5
MD5 e4d3a8f07b7b4a63a68c1c018dadf96c
SHA1 94dd7e4a017e279423f5db9faf458b849588d604
SHA512 fc856585f3ddce9fa2bb47776241eeadba40201e514a8439b31516a10adac7ad22c18d0dfd06d5e40f4d8d3d06653ccfc21b3f8c5d275a2372198d16b3a3ee97
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2qPbc+UUBqEf0t4Ql:KG05lO43bYTgK0t4q
TLSH
T136D5CF6E62EC11F9D1BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF0997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bcd1facacf98972f1ba1aff703922bf2ecffd6d43587c7b35ef7a3087c968293
MD5 49b733e333bb17f96781d403efc0cbfc
SHA1 d9af6007fdb3a89db55b4d107d4476f7b64215f0
SHA512 3c87351c5e670e8f0e4175e564f16849c94d8f47208e48d3afb8ecb9f5916197e30b19c7c076697bbf34fef0e3e280da2da4cf5f0c183904e7943f54d975c30e
SSDEEP 24576:5fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn4qPb5a+UqbBqEue0a7wyY1RYZqY8:pa5POZ3+Jt2pasx2+meqPbc+UUBqEf0J
TLSH
T14D65BF5EA6FC01D5E575D17DC5834A1AE5B1382153329BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e08097c0dd04bfb072db3b3558ea82baee57e0474ecb222245324de898988145
MD5 346a4915faee9a3614d3dc2552c96da3
SHA1 9015ca9dd31af87cd0eb76f8f820d2679a8f5b25
SHA512 f84a21941823c695814f862a0c3191a382c00ed6fac0c7b226d828cc22d3d7fc7d1bf06c4e614d757ee788d20a8ded9b354564ee2fd327b6905f962d5d4f6970
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkCqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:ONc/zEOVHFDqPbc+UUBqEf0t4QZH
TLSH
T175858B2A23E901E4F5B7E1BE89779546FA71786457308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cb81406bc7adba499302ae88765c326848766defd4e9920cecdde56149b9f683
MD5 99f099cf2ccc2983ab6acbce1addc309
SHA1 b72bb59b1790cb17cb31b410190a998bcb069b0b
SHA512 5934867cef417f6f5d69dc55edce4b816b07d693fb7ba57b843fe652e694d119f170a4e8394ef01a05a22428b29ceea4ac307ff549e3e8c0154a258ff66028d0
SSDEEP 24576:J8kNvNnaFeYhJNtmZBm1qPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:J8MwBtOm1qPbc+UUBqEf0t4QZH
TLSH
T1D855B02EBAB846E4D1FAC674CD238512E6727861073293CB5390C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b47a0ddf8e603da71414ceeea6a04dae3a065ffa889eaa4d7a5489aea75cb189
MD5 cd0ab55e0373b54842b10e20fe888408
SHA1 33cf84927c9be2df7b66e8ad2b5239d5182b8964
SHA512 cf3117c8798a5380d83cbdf1e69430656145ad1e09657e379db773af9e4e1ced0469cb58e70ef95b975aa1205bf142d92f19d52659d7e7fd061230e6300a88a7
SSDEEP 24576:VPUr+NQGqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:VJQGqPbc+UUBqEf0t4QZH
TLSH
T17C65F12F36AC18E5E676E17D89824609E7717861171292CF02E0817E5F77EE4BC3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a458cf843a171a017097dbd8d8d2563f36bdcae34107dd497a7dc12631e65f0c
MD5 92e9558da22cf1d960be8cd242b41fea
SHA1 bf609d3bfe850d2de79590fcdb9aaab02b4acc18
SHA512 1ab4da85985a358114b759783a68f4f9743e5335b2c77575c6061c8419a2936003b093a0bf34fb3219a5af49287f601f55ae9b6f1879c6d63797ac9f737c5be6
SSDEEP 24576:sD3FHshBIYQgAVqPb5a+UqbBqEue0a7wyY1RYZqYuWIyg:sDVHeBIAAVqPbc+UUBqEf0t4QZH
TLSH
T12275E17EEA5C04E4E577D1BCDAA34906E67138A8072255CB06D0C1BA5F6BEE06D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1004-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1004-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1004-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1004-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1484-30-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1484-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1484-8-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1484-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1484-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1732-293-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1732-66-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1732-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1732-59-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2024-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2024-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2024-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2024-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2412-125-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2412-119-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2412-117-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2412-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2672-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2672-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2672-112-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2672-317-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2672-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2672-106-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3220-78-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3220-70-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3220-311-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3220-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4188-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4188-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4188-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4188-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4188-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4756-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4756-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4756-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4756-332-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4756-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4756-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4784-132-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4784-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4784-140-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4784-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4784-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5096-52-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/5096-57-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5096-44-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/5096-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5096-55-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/5452-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5452-82-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5452-88-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/5452-83-0x0000000000830000-0x0000000000896000-memory.dmp

Download