a63470ac895bf0f623ce6f2ffc3fca6deb5b360c64b499720662fdecde68717b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260709-xq2e2ahs4s
SHA256 a63470ac895bf0f623ce6f2ffc3fca6deb5b360c64b499720662fdecde68717b
MD5 a98f70453552050f3d45aeb593b3458a
SHA1 41ad4ffa379049ed28c88a175a6e658eedc93154
SHA512 d9515f9d10d138109d6b7efadadf2030efd79e365f0024f2e7480c91d496074f40ef0c18f0b0383a21216a9fbfa3eb5ef76e40f382d2bd8d7cb61bef8f94da7e
SSDEEP 49152:z+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755O/:C/PvOBjcXvvOOc5nLm
TLSH
T107165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3732	elevation_service.exe
2080	elevation_service.exe
5624	maintenanceservice.exe
948	OSE.EXE
4632	PerceptionSimulationService.exe
4772	ReFsDedupSvc.exe
2748	SensorDataService.exe
5900	ssh-agent.exe
4908	AgentService.exe
1904	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\32d090ade62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa2068cbd50fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0e76ccbd50fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c4484cbd50fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001167c3ccd50fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e15349cbd50fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000037b320ed60fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fe6beccd50fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011c0bb0ed60fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
3732	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4348	2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3732	elevation_service.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4908	AgentService.exe
Token: 33	1904	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeDebugPrivilege	3732	elevation_service.exe
Token: SeDebugPrivilege	2080	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4460	1904	SearchIndexer.exe	99
PID 1904 wrote to memory of 3968	1904	SearchIndexer.exe	100
PID 1904 wrote to memory of 1100	1904	SearchIndexer.exe	101
PID 1904 wrote to memory of 5600	1904	SearchIndexer.exe	102
PID 1904 wrote to memory of 616	1904	SearchIndexer.exe	105
PID 1904 wrote to memory of 4960	1904	SearchIndexer.exe	106
PID 1904 wrote to memory of 3016	1904	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a98f70453552050f3d45aeb593b3458a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5624

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2748

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5900

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 57fe6f2822b2bf949be40f39014ec157391f768f1524ac0ef3cc64854c5d3d80
MD5 f99567c83834a926e316685094225059
SHA1 8c5958785fceb9bbd084283367f5d5024aaf40db
SHA512 5f5abaaad6b88d3a9a6443aa1eb9bdfc65bd7bb45be2979dc40e4211da1b0252f2ecd9ae8161bb22cc8f419c2d3c695a3690bc6898f88a93014c95312541228e
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnzQ/lFTjN4:m3q6HjBzLm
TLSH
T1E1D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bdbcf6a7d8323901e255035f5f7b42c5dabc21dd337808888f507a1d0b1b7021
MD5 30781d7910d0f456576cb05cf606fec6
SHA1 c20afe4b7db43ce0aaf71ceb948a3a535a8db820
SHA512 6fff8111a6da5a2d5247675ffbf9a5651f03421146369c8569931a004787f894d5411cf3fe3497e2099908fdfce6cb16645f1e8c3bc32e1fe259d8d5166dc8c8
SSDEEP 12288:V1XLsswWkxy2lRq2czAMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:7XYfDtczAMnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T10D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 08d6395ac3c5023d1581a6f06223fe3dbe812394f8aae9f9efa3f4ed2c4b5273
MD5 51f5448359fa6777a603096670a3a2cf
SHA1 69e3e10546fd3fc2430e3865022c4f9050b66540
SHA512 f857c4682da7739fd2e7c6d6abb988a20b40010e1f1f30adf64d92dcd042d352d8dec427109e0c2dbc1ab163da23d0e462db14acbbabce9f85d7ef141f7bc85e
SSDEEP 24576:x0Le5ji0hmxLrMXnQ/tbw/2Mkjy6Fr7g0oi:xPji0AliQ/lFTjN4
TLSH
T11E859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6bbdc5e471d5e45a09d22200d861dea4c968956c0362a5d0d2e0823a86a396ca
MD5 f7e754fd8c7e472adccf3331ba36a3d9
SHA1 2f8583b37bf960923f03fc4a980af610abde8a50
SHA512 450807e1c92c9333d2471ff040c6e9d5794c9412787a474548dcb9b93abd83f8008861ed216c575796c48fee11a3e485f947a614eb488558547859a93c3f99ce
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuNnQ/tbw/2Mkjy6Fr7g0op:O/ezSC6vUzPvxHjyuQ/lFTjN4
TLSH
T108755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9e337df754841ed435711d2703f9880eb13d6a8fca250b73d336d78c774e274b
MD5 68231ce2f52807d05464ee9654d10484
SHA1 60b71f67dd87218cfe9d46cffb145de95389a736
SHA512 3e768410646038e1c8f0b2da52958a33c035fa4486f3a7dbbff4106a09b90f5e1202fadd5a8284fc25502f66e3ec91e7cb7df8aed316af9f0121088f8fe6b474
SSDEEP 24576:mVbqPb88hv/l+6UnQ/tbw/2Mkjy6Fr7g0o6:mVO88hXl+zQ/lFTjN4
TLSH
T1A5559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 942f0abde3e8f6ed00d84a5f4d6f1a2e38f67324cbd386900c83128e185f261e
MD5 6a1a9dad0fe80c2be337af8f69869585
SHA1 6d916409912c762ac6496966cf5275f13ad5ffe1
SHA512 dc4ecc514733b58be198f8429ec0581083ce7213cd966e2df0fecbed9a4f2540b0267dd1b20511e1e048a54fe454cc195bcda492b87e16e82e0546b1eeb9500f
SSDEEP 12288:VzbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:VzLnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1FA5523696A14F89BFF2B06B15CC284826B7B0EC1BFD4E74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a3da1878cde3d963b5fdda029ef8b5d8e767ba891295390235a7f55596bbe11d
MD5 7d6d312d021433747ec084c12477f4bb
SHA1 d80c9a1107ce3c5b99584a9bb94a2a8d30929dc6
SHA512 3c6d1ef366ca97bbe43e6a086342cf2de6412e1e1d2a2a76ea4461c9f19d98575c48a03733da7a7001067a630f461ec7021661bd93e9bbf464e55449f0061864
SSDEEP 12288:OeBNUbTVO86U8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:OJIU8nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1A675CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aa2bf70c431b4dc16ee0230f5f6e6947f23cfc9b0a8d502959010ab0dfabeb83
MD5 1f0134b7137e5975ced2a5195d3b1ed4
SHA1 a70f60cef11225a602b3179ad9132361f96d126e
SHA512 81582bddd0f95d91d4d3bb4626ce35a7f659e75e834ec0e06bf912f18e1657c7cb7dff65fc0d56aac63916a245775ed77ae9008562e06d1b0d9c151ebdf38a08
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:SQvGAdlCEL8c/yRNw5CSLm
TLSH
T1CE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e16f3a76cfcb526bfd63a321058f07c94cf05894f5ab39422856110bd9d0b06f
MD5 5cfd2d93f9f14834097dcd5b299ac522
SHA1 c3387f957b217078668cdfbe1351d09cd73f2374
SHA512 df244b2beb0b902bd28bd1a4fd78c3d22d7c19f5ec16991613c28028bf333320a30c68b93c8dd92525345e26cc912afb8d9d4b8371bca9fca6bd66f8ffea9364
SSDEEP 12288:WAwSfxL/2Dc39DLLmt0LDQewsAjyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgf:rQewsAjynQ/tbw/2Mkjy6Fr7g0o9
TLSH
T11475E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9f099b641398fb95ded34b5b0e0cacae130b533afd6c8fc4a8727bd1f0b937ff
MD5 d2ba7886a1b4c3b07b15483a9cf19dd5
SHA1 40cfa5e58b147110c149c3d47660a6fa2d0df420
SHA512 8d3279081ac9db504f511068e1f6f9e726a88574456e7ac68edde116a63a22e2f90cdf46c475ac05dbba844685b256a13c61ecd2b275954f457cd188c267e949
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHFL:/UEtQevvqc2W1cpV2EI32
TLSH
T176474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 80f7b437cfd6cd2ad0a760ca31d0cc6750a5c4f27cdbb8f3a9e63a45b4c35177
MD5 7def46647742c90d189a72b79808a583
SHA1 025961995c4e51776498257fd55be9adc7e68978
SHA512 8af81c194a4dba8e9e28ee919d09d3e40040536f4074dd409f6105c70bdff154b2b32202bd61c947f4817f20c3c8135ba0132212090e31f7afa4e37c7935f824
SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/zSQ/lFTjN4:loqtVjnmeLm
TLSH
T1EDD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d4f4a8b0bf885ad62987750b1586e63a7944bdf9bbf847bb2c11f04f20e01619
MD5 3a3eab5e6ee7578dcc00dd5917215719
SHA1 9e83248c7ef4c66185c11d2f1570481caf1ad143
SHA512 5ea2757c74609e890e1e303b6dd93153fa59f35b31d4ca7e55354ac4c3f2b31cd59fb1b9a2aaa94d244dd1a0309956582e10609faa865f58f28c6f55330d5a06
SSDEEP 24576:gAhGLJIFoiwtA5l7S53JnQ/tbw/2Mkjy6Fr7g0oT:gAMyFoiq55Q/lFTjN4
TLSH
T19D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9ab18df94cf6e0f4c0f6ba203b1e947729adbbac0506200bace6ceadc994d050
MD5 e97e5670209ff2fb5b59e0f340e8d25d
SHA1 caadbada31b79ec4b48259e2252bd9e75700ee0f
SHA512 81d0c1b24670d2a2bc4471915e919f3bbc8ec6462b311f4564899c886bbbd3c17587e1fd2487cfc04504258e27e033884069a16b2630f0a14846f19dcbd25542
SSDEEP 12288:Cmw5HEjsChN2BFgl0WDm+CdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMi:bwuHOWenQ/tbw/2Mkjy6Fr7g0o7
TLSH
T19365F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 680a90f19465aa31d78c3426b8579a0c614f1af848f58c6c441889ea291ec126
MD5 9315b6b1f2e8d0dd6a490a5e9212e7aa
SHA1 014ee1dd6e2456636aa1c12891023c8b4a506320
SHA512 bb3223a51419da82c1c4cae79b18fc4a96918d2fed2a7f480e2475509feda205658f71eb6c245610e09882c2a8fa3b509514f71d3819f0169e0d14a7ed3c13a4
SSDEEP 12288:uXZ1IyCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:+Zu/nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T10F55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a8d1b4ab6160c7deccc9847a3bb0fd34366cac90062b8dc847e9b7c45b599fb7
MD5 04dba62f10d272103c43273f57bdb975
SHA1 09eaf40a67e39cd26053b50b3ac1781b3f57b7de
SHA512 2bc424313b9cbc4c732c77ccf919f76c305044e12f82ee2d179ca8cfa02a41eaf878b8baab067361155b2e632bca224989b0498373269a3187303003670b917c
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:JQRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T15B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fae43423fe76fff0e5bb10982b0dfec5e093dcba5ea474e0c0708f542a4c604b
MD5 2ca383fc3c85a63d13e2bc9cc88bf616
SHA1 7baaec32e4385a94a44cf8b7513c066a9705fbb1
SHA512 fe403076a1d90c2757ab7ae40989893264011b3d575660f3d50bad7bf2452a53e267044d7bb2d118ea2b19fecfbe1eea0cf015542cb7d5ddbd83c6889a395d9f
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:PQRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T151667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 823dc1c122c5e90ff3e1734df8a53313b7f08c1d8f32359b5df90921121f21d2
MD5 739b5ce76a93b863dfa40cd9c8b736e7
SHA1 46ed1c85a01590c7672a3138e56c98f1e37db0da
SHA512 6e5a90266cf94a29d604c59873e11ec6399b49bfaec37530a96fecde3e644f91159f4495d4f17faab18dc28800145243f961bfc6ea660ce24aaf3670a1bbbef1
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0vnQ/tbw/2Mkjy6v:v68Qg55nhheWu7PNU3/iQ/lFTjN4
TLSH
T175B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ce5d3b97f07a7b5a52e251a07b8c952af71e48da61574b76703dc00a0ff2e105
MD5 a1dce90dd1e261f5245e0506fe0baf67
SHA1 7d90e4b8b2eb1d9f8a87b91a02a36d87c5d83f5f
SHA512 4877c30f806f4fe3076bae267363748125d073c0e329a4682a0a5e9513be0314c034d075f7cc74cdbe48e45b60f7bd54e542b607209d720c77b4d085ad709889
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:/y5112gYy5azzVvL69nLKnhZALm
TLSH
T18E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 98fd399810507ea03e4aa02b2df39706b8db22fe2acc8c7e4f462124c5e77498
MD5 f25d0bb87e24473e7d3828abaca82c29
SHA1 5927f6d04a4d82ca4a9915a1dcacbc7bd93e41bc
SHA512 cdfb00925abb78b15cfab7c3f7c595f105c7f3c749eee4cc5f35f5186b9f21bc9e553b768f604f4a577aa7c7a409fd29eaf01f43c286ff93223c5b833d118cfa
SSDEEP 49152:3B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8Q/lFTjN4:Zu6JmVxd2dfLm
TLSH
T172D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d6b23681df741c40f6891453cfad20beb80e602b16341c33058a20be3b422961
MD5 874ab63c6f221851427fd2c54501652c
SHA1 143ee80015deae16aae986d25b9b38443eae667c
SHA512 e37a908fb97f4f275524156826d66eefc641a97695de989b538b6db0d9680a615176c44c8047255e53c80da3c4c82f8d404ea15390702e75cc4117d534410d8b
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4xcQ/lFTjN4:wmifPbReLm
TLSH
T113B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8a0c9717bb3ad30f7fd7e0b36ebc87a1432e37934f9d0562dfee4a07f2c282ea
MD5 0d739d5a5e75b22c34fa95850daac471
SHA1 3483d37112c028278cf223cd1acbbee152a59e2e
SHA512 a4041bae12ed9a186fc9b98d0cd0e4317c24e2b0fa6cb22fc88eda577997137f9596d0a6d99aeec14cd5bbbd2a051daf6baf8e343ba6df328f73adf221a804fb
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHq/Q/lFTjN4:N5dKTi610Lm
TLSH
T140C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7362655af50bb27870e592fc6228a2d0a1b8914ccda995f1fada852ed0fa97cb
MD5 f9f522b1bce78531aeed3372106e52c3
SHA1 3edc846c3b25ec9cc332c74266721ef2e914555d
SHA512 c94b9512aacda352913e5f29267f718675a5ef5b4891c2c90945e43e93b80cdf7765097ea87fc5be51542267e0a4740d8a076455d1894cd1ad3860437b68e82f
SSDEEP 49152:3htSn8EApI0figngiDn0AP5wQQ/lFTjN4:mX2iyph6Lm
TLSH
T19395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8ce0398d883a041466e66a23d6fdce7c06632445548cdbe2623336a1e3ae28c4
MD5 a48b700782fd5e58f7a6ecd2ae144e06
SHA1 af29df821a92a2b442d8ba52936165e50c2cedd1
SHA512 381d1c7d68f88d9f9eac3fd7edb3b7bbb600f0bcbb38f539820aa18915338f75263c269249ffb9f2366c083a41ee2023dfc409158b10bc45d0e36ef30238630e
SSDEEP 12288:IDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:IznQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1CE5523697965F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 75645dee9a32ce2037bfb1368b94fc446b85710190872d52ab1ebb0fde59218b
MD5 a9ce144bb1f82e33b80fc8601b5b6401
SHA1 8e7d43890402710fe44cb158a74e3b5646bdc053
SHA512 48ab1cf67483b6bd1af8f1d5b677edbb3fe7fcd2071748f2423a56e7535edbc00b030d8095e82768f37a9b7d8c24ee79064611991d060cf4fa1a93a0789ac0c0
SSDEEP 12288:NGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:NmnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1D75523697965F98BFA1706F14C828182973B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 46a612ce59bc437f7230677b745988ea9ad0cf6d984d7bdbfb1466ad257e7e60
MD5 26d0bbae15fc131d9957407211f1c43b
SHA1 d7bb4561ba170d787031ec15db43451a6308bc44
SHA512 6cc067f4c5d9a45de0b23c138d04e5064c3c3af4ebf08028848f272414bda22efae3122a3e41ec7e38d47b9ee5ccbd3b034eabdc3827a805995d72a7a6993eea
SSDEEP 12288:8kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:8EnQ/tbw/2Mkjy6Fr7g0of
TLSH
T17E5523697965F98BFA1706F14C838182973B0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3151a874df9f8d0038aebe925763928b3a7d8fa3c6b401fcddac3d5380fc5c16
MD5 80dbc23699cb294fe01f1a402826bebd
SHA1 81c0c7ed5a22863b0ad4867308e877f275a9d245
SHA512 8e7bf1cc29273a9ba592cf78eddca76d96a19eb5c4d832b150847a83ac2f23fd019f10820bef1f043db35adf6b78a4770a52a1b1d14f55710d4e9d7b21ea10a9
SSDEEP 12288:5VZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:lnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1325523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d5b1fd3f5be9ceb9c394c80b41928d1a2096b0e5ec234337f6f0064a705913c3
MD5 52538d6828dbc9b2bc9a4a69316987d1
SHA1 679eafe9e029f4dcb33092d0e67e62f2a69e9acc
SHA512 421fa86148a0f31f337256be2669715c95f0be9366b3788e4e850ec79f5fae816f057f80b11ea405dbd07a196edd5987d2d72e9c2ec1edde88a181c5975e8d46
SSDEEP 12288:wRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:whnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1C05523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8e967f4c740e334f0a267b55ebf419aa5ceae21076d2bc44a6d5d4301978c358
MD5 3315440ae1846a7dd8ba0898c72440ac
SHA1 75d5770ae9a7476cab33ae5a04a847fa6a29a0ba
SHA512 c59fa67281e29f4321cffcb38149fbb52ffb2fb37dcb099414ad47c01cb1bfa1008ba12b9d3324cbe79cbba6daf309dfbfbfb67dba4c0f663ba0b5ac3ab45a18
SSDEEP 12288:paGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:panQ/tbw/2Mkjy6Fr7g0ol
TLSH
T17B5523697965F98BFB2706F14C828182973B0EC7BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ae57b8ad317390bcdef1d2eae012b5b832ff2cf1da4cca8c014fc2df5d8f0bf8
MD5 e14030be366320741df1b7e24f1666b9
SHA1 144184ad206841290049fd73d441ef28903f1c56
SHA512 c88801c3d4476545edb608c89a95d3b1ce9288cd0006a9a962dde03605c359ccd56ea53c48c4541a55580664b817107c29b995c6ad2107bde48d9a948418b4ea
SSDEEP 12288:X+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:X+nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1E25523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 aab43d75367058edacafd98af929912fa8461700fd497302c8d0aea43b30c766
MD5 59cd80c860aefd760a5bf4ce13cae8d2
SHA1 67e35dca93e105df515a740cf64e9576802d8001
SHA512 4018750539c983800e3e95ee8d8dc941b4b30ba42a857e66710c7709cf5d8d04edaf30bb2af670b9cdb2f35245d8df261df8a3c706b5da0788819c6ca6a4c993
SSDEEP 12288:1iZwbDzzFEoS2cPvymGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:4ZM3zFVSOGnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1AE7501A5B35058F9EC67423ECC518906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8553be97f6ec39b008c019854bd8ad38d6ece4608fb0d1324ffdf3c3531578a5
MD5 54f06b662bbfc5655d7294dcbc33964b
SHA1 ad90c6e7ad739f2ac587e427a2bfad6ae1894a34
SHA512 0c444aaf5692e9c57b97d7f4ecb244e5046b15cb7c93e13da4ae8924b58124a3baebcfd6a0eb7b847450c0851a851ceeb1dccc24daaea75266498bc2d95f73b4
SSDEEP 12288:MvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:MPnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T19C5523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f898897869acbd2715ffb362a2e7f2b63e7d391d69516d2e08dd41af5bdb0306
MD5 3f2d56d11bca02b027d783fd6b945b33
SHA1 c83e31ddf54e8a07fbbf8ddb784ef1d39f7d5120
SHA512 d71e1f1521cf0c099593231290c66cdaf6e02f7f501428962d870de29f18a7056b537c10d51cd5c6fcee8918fbc057688934bd0d5c6ff6ceed1dc8ca86c9957f
SSDEEP 12288:LrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:LbnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1285523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 34496cb9a27ca05b0d7bda4764935b2e32c36ce09b744150a88e29ebf7ecc5de
MD5 f33a11e641b7467f9b9dde9df56ad784
SHA1 51f54492bd83b3dbffe9bc2ec20c66d4d467404b
SHA512 40638368fdb8fd7c1abae679574a52966b9cda9eef183b56f16c4aa6f4def3f7083ccdd38c9876e9f86dba6823df051bb0838d992afeaf3ab4e43e0caf10f36f
SSDEEP 12288:TyPz5L8CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:ezyCnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T19A65021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 12dc1cb7639209a03124293031454bbcd00d5acfa8d2232d7640ab1d801de9aa
MD5 369e028d4619c29090058202a1d20094
SHA1 08742f6fc5c4626017544e9f8d07dfe779cc0dfe
SHA512 adef2ad2bff418f25a1bfc6f9dfb62edfb170372d0f585fec3078f98dffaf4e607ade310ecfa317627d3cfdc0749bf126f372123fe8f637faa3ea19d41dd3961
SSDEEP 12288:avGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:aPnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1375523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5c209967cf2740405cbb73149555468536d6da0a6619a9fb812f2a5e96d0e225
MD5 b4b6a8dd29877613459a4e557bf8a108
SHA1 b3c4fdb2697f80586b991b312fbd723f597c1ca1
SHA512 1731e673a2f622ec6ebeea7b99c4565792342d9606ebcad122283a3fada6ffb6f4d7208370c8acd97b9c9ab31015734025c63e15ec1f10472e95ad6c1cae7c82
SSDEEP 12288:wvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:wPnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1AA5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f00ee904e2960aa2709b5c4b8b79b340ad060b462db534e6e34ce1469a16bc03
MD5 8da295c3096333a387a75118e59642ee
SHA1 da7bbaee560990db7ac572850a0ef07f8ebb2d65
SHA512 707381ae72c6aa4828e193043cdfcc0f20f35464b8543035983011c5766e1594a52ca0db50b64da94940ba2c918a177d940b4d72b00b7372bf78fee1fb9f1bf1
SSDEEP 12288:XyPz5L8CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:azyCnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T15965021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4f0dcd3783c277cb12fb0c870927740914c3f170e2e88e613e7e1a8b8b58a291
MD5 800c7fe6322ad5405c55df7f61de78b0
SHA1 4fec4da4aa53cd327666b1440869400cd2467a10
SHA512 51034b6bf3d7fd2f0fce1650399fc42f49e2b5b4f5dcc319b9e3ddd7fcbeeda94eb5b98731c9fb6ad99d44a8bc65492f1d019b04a4d5de38a5deaeb45c96a59e
SSDEEP 24576:gT0aLl3z0zD0nQ/tbw/2Mkjy6Fr7g0o1:gTDLljNQ/lFTjN4
TLSH
T1BB7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9db88e1180d9976a3cb1aa83d9e6b3e1d4afcbede2308f490181ac25110c08a2
MD5 8651775cfa2b5bf41c154b4f280aebec
SHA1 1c941b3056700917ebddae5a19b3256352fbd02a
SHA512 858c644cd11a7df42af82d69513a678faa99b71a9ceecd43284266b44f39c256b7ae85a5854e61442c64fc6c185e6c11f4c5c893926cef06aadd4bbd8557b0d4
SSDEEP 24576:K31d9CHKy7GZYnQ/tbw/2Mkjy6Fr7g0oC:s1d9CHKyaqQ/lFTjN4
TLSH
T13A85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9c3891b9c95a5b437f222f01253c71968e34105bf60dc9c7c18c5adb1b34f29a
MD5 03e94208b0f3697710b1fcdc256a3777
SHA1 d3cd9ad3fdd95163fbdaa796eb5ce5cf65d0c327
SHA512 eec986dc1f3b9c59524b47d73a03359cf919d2d15f5d5d3b3ee7a0c071df4bc5ca8f10a804b71433f4a45c82a23675e73e72bfd406afc9880f6443de87172dbc
SSDEEP 12288:8EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:8knQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1015523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 34c6fa65928138e28bb586b388537c92cb24085cd3221246b420aaa7c80053fa
MD5 ca6e6918a2c4826f457c5a647590c121
SHA1 69a3feebc39bbdc078b6fff5004f0d1508917627
SHA512 fc1a34ed2f83c0c5a943cdec3438286c2be6328ce7ae695d399a17d6bafdf2f6c42ce9d0a17999056babe87e72161f9afd33039d8c26fcae9f7a534c1a93ee06
SSDEEP 12288:/iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:/inQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1635523793964F99BFA2B06F15C838182A73B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 18075efb9de45fd07a5aa7cc38235ff035da3b6476f798ec8c69e29dc915bb4e
MD5 7b0db4664f57bc5ba18fcda77851cd13
SHA1 f30693e320b16bad0237123e5cba525650065536
SHA512 2c82eaf42d4876f794077f61350b5ef7e8430dbb1ddd3e282d3175f638dc3d816e0bcc8d41879315c6fca5430cabfbeeca2808ea6ac09c89a69ee0134e275691
SSDEEP 12288:BFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:BlnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1345523697964F98BFA1706F54C8281829B3F0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b828bc3d1379d213449188c8932de72936c6c70e0deebd3261ae474598c27a4b
MD5 e089f00c8750c17e9a84a32e8df94198
SHA1 bf4131281e02635a5f0f491ea81aeac7c1b71cac
SHA512 ca9cd9cc00b213b49c909a126f49c4d4dacd3b000373dfbfecb4fd45aaa1562ddbea00b046131eedafbcc4f42bd817e06f699a27619542b9ef8c3977265d2066
SSDEEP 12288:TvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:TPnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1385523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 dc87b46a18a39ef7c9d9fbf80c752b5057a7a54fd7c332ebe488d699859a9691
MD5 99142e255ed5d274d23acbbb177c56c6
SHA1 05ad57d5dbe0f5f85c0deebcc8f09e89ab096b3a
SHA512 a8d43892d165509d770cb1f43f9090bb48bd54b40f512f0e4befa16b00b6799c686dc97430420bbacc505c7ac5e104e721f20fb863c3edfee4730448fbac2bac
SSDEEP 12288:lEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:lknQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1F75523697925F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5daf2f497504c47239bc30c0a4848b69235919829403f3d0c99152f51ec5133a
MD5 358e8ee528487735fc1aded6075d35d9
SHA1 c5add0c0c364a09af191e816e22121f7e411e1c3
SHA512 67b60b7afb5a0a9adaa49eff44adb970f699a2fd5c8ec777512cd38efe5b9965d4ea04300a87f3e5f580d6cb4f0b4eef17b96b06374af91ade3006782f968fbe
SSDEEP 12288:4nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:4HnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1E55523697964F98BFB1706F14C8281829B7F0EC6BFD2A38F7B481119967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c6797325ea847647d09b49e3ae3b407ef28650a86a0cd2111c0aec4eca491c45
MD5 10713fa1fa2cea346bbe8d3db773ef01
SHA1 30a59ab8ea8bb46b1ae48e74be8457bcbd680f48
SHA512 e80a8aa4da36282426996579b73b32dd75ff2a8673ff42c706383186f8ed023249c23297251fa41ccb0edf8220b5650bcc535577deee5823290e3b8f0e4e3ea8
SSDEEP 12288:GRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:GhnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T19F5523697965F98BFA1706F14C838182A73B0DC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 167c5d0939d65551b39e314550c0f0949a89e30730fdccffbf81a46703e3d17d
MD5 125006c14fe116bae3d9ba3a4e159d4f
SHA1 3ddbe68fd5fd726e730eceecc88a6e337c0c66f3
SHA512 a38f90544a26aecf48a452748e4d1d0a3cf8cfabd6d917a36c3d30d6202a8d8ce8e5e3b14b48558f9584975f319f9f4bbed7075b78dcb115e93a4d120a2ccc8c
SSDEEP 24576:rfwv/k9RX6wkyAIrnQ/tbw/2Mkjy6Fr7g0o+:aMnYIrQ/lFTjN4
TLSH
T1C285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 41fca0d81d8ea7f2fec4517ff3506ead61a71087e1efab2df53375ddcaa9a284
MD5 b8b8be2249f01fb33aa22d896a5bbd89
SHA1 0e6d780f49cdc2d2c56a01f7012b3bdcc441a318
SHA512 c2551bc23135ada03bc4fea0c9b859da0fe1e437f581e9dcaf4878c195b256dabdfde312c0d548ca64efa3044cdddaf9d426a09935780dbe6779a3d0077f853d
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wQ/lFTjN4:zySzP7Lm
TLSH
T1A8066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 390f0d2b85f1fbcbc4ad69af79616572b93b0b8caef4dd90b5d4fc666df6fff7
MD5 8390d46e996c6bd51a1f7c03fd586876
SHA1 ff818a95c270d5df562c4b2ce0ba873d73cb38cd
SHA512 9702da4ae68dbd09c541c18873220ccad40d00a44f7bf5e4a86b0c08d5e6c3a1e2829b9e4837639b4f3774c3209f4ee068bac88862541645e1b7e8cf32d3060b
SSDEEP 24576:547Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYWnQ/tbw/2Mkjy6Fr7g0oG:547JUQj1irIhCnDHUPfF/AQ/lFTjN4
TLSH
T10065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f63b058b4d738e5ba64f2f0b97fa89619feddcbddb203180b1342d0b13f13ffa
MD5 f0dde26efb99e21de5630235f6399793
SHA1 b4e6debfd59eeeb6cef88b6f33cd742d5c2c955c
SHA512 e20fd6d3f7b9b3fb5901e8b37a3ef1dcda07e3eb6844c44878817bc0e243a80b98015cf44651ce1b3554f018b3bf77143eccb9b63419ada554491206274a2570
SSDEEP 12288:IssffGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:m/nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T14565F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 bbbbdb4d285cbc2177b0f43c849fe4e7803aabb0d22947f37466d60b961f8898
MD5 9489f06ca66771cc475864ec9a77590e
SHA1 bb1a90354e11c162a38ee960c68b2981aa9fb5a6
SHA512 02f8705b36472e93f132819e3a121185622ffe84a8758dc38010e827b7942dfcd48bb6974d3770141592a2a156ed9a2568b4f5ed08607d748a0c90ca856b77a7
SSDEEP 12288:uWd5dUU3fDkZFC+sVByzejDq5E6O4kjIJRmlD1xBj8aI7U6r7:ua5SUPiFOKat67kjIJsD1xBjNI71n
TLSH
T144451740762AC79FC6A950325E36D6CCA7707D02EE056F0773C8873F9476668B6F6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 4143ec33548a05aed0bb2a1af2b414941bf73d0021ade24e273d986e580a3fbe
MD5 51323bb7f9fa3bea813e92a5146876b4
SHA1 65a2e9f4c13710af027ef791159d36f1c88e2ed1
SHA512 53e3a70a618e77bf4428e7497b4ad2a63221f79868ff3d635ea71b361fe81b2e5633921da50cad1f89a42ccf4f509af870ba58b921860c266665552da80dc13d
SSDEEP 6144:gcm1D8MdfpmfupxfWpYfpTYfsTYaHT6a+Liexq110cx4iTSAXFoKe9bINYNHD72x:gc2OuXW0pusbHl+x20iXFoKeol6ga5zU
TLSH
T128552B01A5A7E31FC8FA50374632C6CDBB786C07BB452B0573844A2C987767EB5F6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 1.2MB
SHA256 117f2fd6b0b375dfb8f7bbf229962309ef72f15ebdd15a6244b555ae0130b18d
MD5 3f74506afefdb2526bd4237fa01707f5
SHA1 5ca985a13739d042601d10772b55b56eb5d3622f
SHA512 f9716b5061b65addc86c95c6f9a93b9f1f67c25f64cc398cc6b52bd42f4bfbb4ed7eda53c6ca3ad3971f731d89552899f9029f26e4838eb3acca3810bbcc96de
SSDEEP 12288:k677GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:vrnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1FD5523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f11319071633a70b3d36d7e598a4ca9c4a26eb0cc54b073bb42b7bfa3dd25630
MD5 2b6e05b29ff36f0c364f7d6be33a04fc
SHA1 557327f6c8984ef145141e91c4bfa1ade9d2b32f
SHA512 d29282d62b7fd0f85fd3948dfbdb6d22d2cb6c9f0977834f28b7baaf0e45d771993aad7acdae852f36b1e7e6e3c18584b84f698b53f55381334353a9ecefb67b
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYNnQ/tbw/2Mkjy6Fr7g0o0:4gb4mBIBhGFWQ/lFTjN4
TLSH
T15365AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 56212cdf70327aeef2075ab4c56786701fd441654a7462c96b627d33db55c995
MD5 d5bdd425860eda4f2e90618a16b594fd
SHA1 b7142515fe8330a1ebdc93c4bc3103d4858d38f3
SHA512 225fde3b8670e224ab7b5da28c44ec3d4265c64a0b3c976770b3621fee8774737b7aaec05b3d3103f9baf583efbf8c59d5d2365b1238d1b333f63fa4ccd6c6a9
SSDEEP 24576:VG88u8FpJqH1Qzria7/mGnQ/tbw/2Mkjy6Fr7g0o4:Y7ZFPqVva7/FQ/lFTjN4
TLSH
T16F85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 98e37f544f4dcb428bf47814b36256199794c79b3a58fd67b814b9fd24c9aa20
MD5 7ea55ae95861bfdc72ecf86a29394629
SHA1 f56209e10581780cb1c543cd6859977397c4cba6
SHA512 dd659b97d3cb79d9ff4c8f726ae39e555b2346dc9390d0b096bd34f827fb3bec0fe54af4e226bbca355ef956e17278344fb21e558a20e9562f010822c8ee1ee2
SSDEEP 12288:XHvUrBFrEjwaQKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:XPUr+NQKnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T13265E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e0350f9ef5f2e8553fc8154a0d108727c98ae82f7371df344c22bbd61b3403f4
MD5 50ee2d11cd91648a46277aa21aa36c1b
SHA1 f0730292aabb8ea057546c5ccb34bd554a516f62
SHA512 73f99e183542d66b2f81f99bd95392ba35fc296f14d63fb905c64cae95f4bc721ac55275e606128566decf39087f5dccbd59aa5f891edbde3bb1a58a0c208ace
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaQ/lFTjN4:XG05lO43boLm
TLSH
T159D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ab19eb66a774d5869c6c1945db0842b288b9d6110275696b55caa7b808fb9892
MD5 bb56ee0f2dd0cc4f86c611343f46cc15
SHA1 40c7f1c9408cc4f2aa8598685016454e32b28265
SHA512 3a426542cba0e0c2da1b2e4888a6827300a3319a2bd5baee87425c1984a591365562ad0d1bc2486ccca6be200ccb8296523a92b43b82e11a30fb2dee8c315a05
SSDEEP 24576:Cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwnQ/tbw/2Mkjy6Fr7g0o7:Ka5POZ3+Jt2pasx2+miQ/lFTjN4
TLSH
T11165AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c45af44912c6bd3b54800005b52606713e17c83155632d7f04914f79448e0aea
MD5 acf27ababbca97c5dab0ccc0216446ea
SHA1 137bb0dbca4167f08a44028edddb7fe23119fabf
SHA512 ac1839b0a254f46eda77f4d1e5a629847da9ca9444a88f5769229795e218eac2ba92184adfccb13f93206e0842ca126effe5552741335b9dd48d608a50b40e94
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkunQ/tbw/2Mkjy6Fr7g0oi:pNc/zEOVHFlQ/lFTjN4
TLSH
T160858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 aa5b65e3db29b3e799bae60a793160f993560d6fa5f79f9dac1e573340bf38ba
MD5 dab6e42a82ce8c454ac9ed512f3937ec
SHA1 3a6fddbaf1c9bd67e1aa803cc8841f7a28fb6523
SHA512 ea06c4ff34b3199464d852993573c6f5493e349076d1af0cf71a9f7036a2091eeb00dab779bc432956d8d1aebb4595ddfe757ee1540ed2b9de4212b15c5fb8ef
SSDEEP 24576:g8kNvNnaFeYhJNtmZBm4nQ/tbw/2Mkjy6Fr7g0oX:g8MwBtOm4Q/lFTjN4
TLSH
T10255AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 df42e8945b6b2adaa47f5b5918e3ec24d30602423d6704aa6fdfd7971eeb3d02
MD5 ec88c28bc8d677a64d513898c4a29305
SHA1 83bb13634644784f28f369db13fca9779f22a936
SHA512 db78d24a13e020cba65d6262dc45857cb32d3511f7d79858fc51c8b3aa2d43ccc1e86124e239a00b93788df3a85628a13421bc7ce1295eb0f0e58f404bcc77b9
SSDEEP 24576:aD3FHshBIYQgATnQ/tbw/2Mkjy6Fr7g0oQ:aDVHeBIAATQ/lFTjN4
TLSH
T12975E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-277-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/948-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/948-57-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/948-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1100-390-0x000001AD93120000-0x000001AD937A0000-memory.dmp

Download

memory/1100-322-0x000001AD93120000-0x000001AD937A0000-memory.dmp

Download

memory/1904-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1904-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1904-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1904-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2080-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2080-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2080-109-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2080-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2080-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2748-309-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2748-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2748-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2748-97-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2748-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2748-104-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3732-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3732-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3732-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3732-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3732-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4348-0-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4348-1-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4348-9-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4348-66-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4632-303-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4632-75-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4632-69-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4632-67-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4772-85-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4772-91-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4772-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4772-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4772-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4772-324-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4908-123-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4908-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4908-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4908-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4908-129-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5624-51-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/5624-53-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5624-48-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/5624-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5624-40-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/5900-110-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5900-112-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5900-118-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5900-307-0x0000000140000000-0x00000001401E9000-memory.dmp

Download