b7a80695c65d8d6497af2508f0f9308099de4241c0d4a4e17840caa1d1f92746

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260711-2p2fvsc171
SHA256 b7a80695c65d8d6497af2508f0f9308099de4241c0d4a4e17840caa1d1f92746
MD5 414606ea75446651e27ceb0b02aff629
SHA1 78ec8e4832d56294c2accfef47a7d5933a2eba9a
SHA512 2b0a55f61c1d9e6e4dbbc009097a717a1095005fb977d8b63209932f37b47a0c44d8d35502e95d04f0290035f35fc9d86442be7b914465db2fc015cc7540b6ab
SSDEEP 49152:q+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755N2:7/PvOIjcXvvOOc5nD527BWG
TLSH
T13F165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4420	elevation_service.exe
3228	elevation_service.exe
3300	maintenanceservice.exe
2716	OSE.EXE
3924	PerceptionSimulationService.exe
2240	perfhost.exe
4580	ReFsDedupSvc.exe
2996	SensorDataService.exe
3280	ssh-agent.exe
1424	AgentService.exe
5240	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7935d8828f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a75e771e8711dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041f82c1f8711dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001288161e8711dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc17c7608711dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000368c321f8711dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb5a4f608711dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2692	2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4420	elevation_service.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1424	AgentService.exe
Token: 33	5240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5240	SearchIndexer.exe
Token: SeDebugPrivilege	4420	elevation_service.exe
Token: SeDebugPrivilege	3228	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 476	5240	SearchIndexer.exe	101
PID 5240 wrote to memory of 360	5240	SearchIndexer.exe	102
PID 5240 wrote to memory of 4144	5240	SearchIndexer.exe	103
PID 5240 wrote to memory of 3344	5240	SearchIndexer.exe	104
PID 5240 wrote to memory of 1140	5240	SearchIndexer.exe	106
PID 5240 wrote to memory of 3788	5240	SearchIndexer.exe	107
PID 5240 wrote to memory of 1196	5240	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_414606ea75446651e27ceb0b02aff629_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3300

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9264341bca3827a351c165f07364d1a2ca945d3ffb4ad44306d21e187d13c0ee
MD5 08b645116aef309e99c5907949a70b51
SHA1 2d7f5cfca3e055b1b2f4b7b7c7f156f00eef53b5
SHA512 31ee6ecd613594f42494992f913254e4e529a18662d8eab569c0023a5fe628f1d148910ec2ec478263e1dbc8ac482014378cc65892a58ee939111cd0e5df4422
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnbDmg27RnWGj:x3q6sjBsD527BWG
TLSH
T16FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1fa46aed2fa3d99a3128370864054543365effac09fbe399846c5b5636ee78e9
MD5 ecab96ecaa794b7fc1808b446560e252
SHA1 378d9a87c9338ac12cf3bb6fe3540cf89fa328ff
SHA512 ed82b13ffb4e2784bfd1a3ba9f9af3f85cadd9423fb371a880c2f7946e2d47311183c4392d3c0aadc294411de830986b8eb7417977ec38e350c657b10d361a5f
SSDEEP 24576:1XYfDtczAUsqjnhMgeiCl7G0nehbGZpbD:gtcVDmg27RnWGj
TLSH
T16665F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9c334fb8ae99f8ea45a244fcb6a72501661d3511fe1c3e6c8b7a72aae94b8242
MD5 384ea6343938081baec0a3df680b6e1e
SHA1 b3271cdbeb1f960904190b835d36ae138ad7663e
SHA512 6f59718cb0cd18d9c18328b82ccb44a73e9cae2916ccf26fe258dd8ce78ce52fef3b59d3d7aa45c0c398489e21eb17fa7fe85f6102e81a37b6099603e00b0565
SSDEEP 24576:u0Le5ji0hmxxrMCsqjnhMgeiCl7G0nehbGZpbD:uPji0AjDDmg27RnWGj
TLSH
T1DB859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d29a96c7d6e878d337292665f9672a7dce120fd257ad499d9fff50680a147510
MD5 beebd0473822324182c5cdacf2f2cbbe
SHA1 aa1330c0d65e68cf98524bd146d30da9966dc946
SHA512 bbbb0d7f52976e269f62129179e5e0113d7febe9bb931cf3e10c231c3b7758da95986a79a5bf783ae33faabbda429fe07661e6da28212b1e621dc2f05a815e7e
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWn6q8wyuwsqjnhMgeiCl7G0nehbGZpbD:o/ezSC6vUzPveHjy3Dmg27RnWGj
TLSH
T1A2755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f7cb34e7031ff2787eca536618dd39faf58201dbc9308538ac5249a8b093170e
MD5 6749ed9d0eec3d7604801d23b556cd8c
SHA1 58dd4858313ad4a36d69c7725c0b8401f80ffffb
SHA512 4535b57f719b143b6f5154edce9dec99b8126ae750c11a4727d51f841d04dcafb1e8d9621d68ef512d94e2ca0b9ee5db033f3aa1ecd5412d195540d93207a3da
SSDEEP 24576:aVbqPb88hv/l+YBsqjnhMgeiCl7G0nehbGZpbD:aVO88hXl+kDmg27RnWGj
TLSH
T1B5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1e790f74a6cb26537c15254351c4931dc87d3c814698f29a9113d781bcb2bd21
MD5 c6a446aed81440cb9a1f419750ef4920
SHA1 e017b510279105d6169256cb355a4d02c16805b2
SHA512 1131de862cb2a5ee49bae3486f88ea32fa94988e0fb8c14792ac2cb6338d4097c5b3e58e42a4e5f9b51fd8ca2fe3d2c5ef92c9fc232ccbf6216692f0fda0f5b8
SSDEEP 12288:ZLOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZLOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BF964C50CAEB7608B5C3E9F11DAC177E55982008536AA37CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1367813769d08ce0c2ceaf1baacbf4713e8c58970aa79d4fd109e08d37b04aa8
MD5 f26434bb150f9ce69735ac7ae68b8009
SHA1 d712e52055c5f5d15ae6bca81e4a8dcb8cbebcdc
SHA512 8009fd8b832fd77fd976597b3883081b1fa2e30c56e7b4dd5e8860c3cd657becb34815abcdba8b76ea31d76d7ced770f467b09eb0feaf9a77d202fdc0dfe5170
SSDEEP 12288:TeBNUbTVO86U5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:TJIU5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB65CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e4c9b9b738254da1de4a6ac542da38a8f220f40c71bcf2983b0307e57d83bf60
MD5 44bbb5f7827a4171a0697ca531e1e0c9
SHA1 2ddb976b9129b30732eaaac79a525b6546d9a26b
SHA512 31a62bbc4db2f609703033065969070d7d727674034aaefa1b269ab1b34523820c04511a58548bd2def831b86ba018fa9578b1fa888421c503eb30c472042987
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:3QvGAdlCEL8c/DRNw5CcD527BWG
TLSH
T16C266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 efec8cd420f6b468ae50b5e26e0af84b1a1ad2745b01bce72166d2b070cc3f70
MD5 1cf21891bb9386f5590143b1666b6672
SHA1 66d9e9f02529d7dbbbf369bcbdc65863f3cce0c4
SHA512 c9aa10e2d041f123da7125323519706604f9bd81c0a943a8532f36207ed1cdfe2ed6c754ae51ecc6e0474de90058fc69d7a60c737b490c67255d0b291f5283b2
SSDEEP 12288:OAwSfxL/2Dc3RDLLmt0LDQewsAjPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:z0ewsAjPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 26724c879d932493dceb3cc06bd0f6061543384f31c26aac193424fc4aea4fa9
MD5 0e5450e3834e95a1dfcf434d46848b68
SHA1 05ef1916ee6a1430a14046e903805c7357479e8a
SHA512 ced697292d82b31cb50f54438efc7bdb1aceb923896ba11f83257ddd2487c1e0b0b2545b06c76218a1209a6ae3b4e5a3fb2f7649cc052e01b5fa10bbf8aced73
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHLVQBWG:IUEtQevvqc2W1cpV2tI32iB
TLSH
T143474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e9cf2bb6d9edcf0e9dd7c84a004e31564845dab45999a47ef1c3e390c7c7ffcc
MD5 31e0a661f876451c74806898d4769a55
SHA1 9e3436feb6f748a951bf396ef8986be35e8b2c09
SHA512 b79415394f101b031e08403bd4bd214f498861de124ef70299f469211ae67345fa0fa0ff74c7be11ff14a951814041dfe7e8e67159d4005c18484bea45ff5484
SSDEEP 49152:lCbRquA/m2yL5zTfFiV+XenmE3/zTDmg27RnWGj:yoquVjnmQD527BWG
TLSH
T1D8D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7276dc5ce494d9ce650cd665c75b165a717aec5f4b25d42d3d1e866481d597bd
MD5 35933b992e8d984f06b3cc361834ce01
SHA1 5abd13cf8ff09a48b0fc96da0b07c8d4e749868d
SHA512 43a1d9d257bfc7ebc5a8a448e63bdf8bef675268e2e447cf3c3a62fcc4cd87a18f952499436298b8a8044c32346f5da1bf0975a5fe81a28bffedcec08b84b681
SSDEEP 24576:sAhGL3IFoiwtA5l7S53UsqjnhMgeiCl7G0nehbGZpbD:sAMUFoiq5ADmg27RnWGj
TLSH
T10D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2228cfaf2ee9dcae797fe73807f0ff78d84f325a2aa35dab0ac3bf619bd2f231
MD5 34be3507e2b7c0c7a669b4c7e9676b40
SHA1 80d9e5a871a81d032c65bda010a0e2240d71a47f
SHA512 1c575adee122c36bc4b7fef53adb39b9bab629235408c38694342eadf01788445a24d1a4fa249eb93c2644242ed401b9960d6ee065904546a448e03bd5d47780
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Wwu4OWOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 db698d514e2fe8d59c5975844d6fe2fed2833d61fb4414c861187dfa75bf8ac1
MD5 b00ac92c891eaff8951f49c6fc63da61
SHA1 32847132a3b7185e867e8bb74f77ac3303948f31
SHA512 62f359bf579885ad827b389fd3d01b409c936099091e83ffaa1f7963d3293077c5e6a0cab775bc4b769723090858b64cd4d4de71f9cd9b617123b94a95cc946e
SSDEEP 12288:YeZ1Iy/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JZuasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1335512AA239820FAE163417CC5E5D609E7337C62673043CF16625AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0b027b7c8e71676193ba689d178c93c28b714cf17073f30df664e14f890db8c5
MD5 2a81896665caea69850b64ab2da23af0
SHA1 3e56dd0f34c3ccfa26e462ecbc749fd60824549a
SHA512 43775ac31b2486b39c9817aa53e77615c64a002a67ddde2dab60fa766047e75bdc569bb7e0269bcd52c6166286baaad4c594afc7eea99fe2e84b57a56cb9167e
SSDEEP 98304:/QRQyi36YOcPbLvw2gAf+PN3hD527BWG:OQyiKa/X+PNxVQBWG
TLSH
T16C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7e7a8ca4006c697c93e8daf587a25957fdf2722e8f38ac53b795cb6c42b487ca
MD5 022bff517a9c7b8b5d62ee02d76b8513
SHA1 01a1c6859a80af099d5700e462fb5e367c29a415
SHA512 ee4ed8565d1a67f205db2c3e3c60bfc1ee49182c2224cd8c16e501bfd73381ed8d95de772f11c37325965e2676ebe36d7242c32c423ad568884e1d7b5d14f8b5
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN3hD527BWG:YQyiKa/X+PNxVQBWG
TLSH
T155667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 946032c7d5a318c99e6d2cd22a95e050f7938e5e2d80716b4d5a4ff4d366aa58
MD5 79ccb3bcff13b2a576752d01678cbf4f
SHA1 65acdd1ed6e3b1ceb0fad282ea717378e9d57e9f
SHA512 56fd709acfabfd9a7d4d7281f05247c3b70834b4c34d9bda18b09c66616e18b47f948ac3d33e38cbd8988bf4f6fb330332633f3f761b30640ea074336bd9f28d
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0qsqjnhMgeiCl7Ge:e68Qg55nhceWu7PNU3/DDmg27RnWGj
TLSH
T1F0B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 efc6602b7414a79fe2889a0c79471c0a0424e4c2304cc858c247ee63e8162639
MD5 9713c92769abf37117183fedec5f4bff
SHA1 4448f0ae2c56ac81ee164e06ff7440412c7ccc19
SHA512 eb35b44d1c7f6915969f759609b48996ef68749fed745086c9034c5f77198d185917b3852a07578ce3ae5ff7af290616169e5c7279cd91cdf37ad5b7b92b4e54
SSDEEP 98304:qy5112gYy5azzVvt69nLKnhZiD527BWG:TLIHEWhoVQBWG
TLSH
T13E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 41e5a857fdf3888a1fc42c124ad9f8cde0482a7ea1e27258087558b5650d49a3
MD5 432fa79ca6877ad72f2fab2870fa7d8e
SHA1 6e4136c084239bd2bd8bf3f47ce95d5b9f678cbf
SHA512 f763234bad67d742876b1c7518e023e2893b329b439051c5c7b7cce5f1c78caebc2553baa6bb31edc0a07421aa55d207aa55ce534f465f55bb330b8917628102
SSDEEP 49152:fB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glgDmg27RnWGj:hu6Jmdxd2dgD527BWG
TLSH
T14FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 607306f976da10379444db197efba51a09c429a74cf343742427172c6423d85d
MD5 64580d15fd714bfd64e47c2861e9194d
SHA1 0ce5457afa01237175f70917c190f4962ea5a4b9
SHA512 6bb0e89b328fe0372efe97ce52c4a1fb2ec88a447f67a277873fa7aad440fe74ba9d0bd1515e5a026625d87b8931123b4341637637db47ad7f42a0e10bfee00a
SSDEEP 49152:a1hpsNoJpF1A63U44CwH7R4xdDmg27RnWGj:amifPWRQD527BWG
TLSH
T182B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 17753bc3ec2d7597939f82d2a16dca759102f5bb4577b5cbd1c847c9e9977a63
MD5 e7bf3c6972e6c7516f536a65f63d2e2a
SHA1 e9d8c3fddfd57ba1277c9269b701e45ad206901a
SHA512 47fe5a416ef5338f9815fe734f0edc6b6b790f6263a9d1d69f9c1a1f050c72ee3e8daadb5f1dc5cdc640c0bb4ea3458bfeb3fc53a8d2ab266d59768d2ba35358
SSDEEP 49152:rSuZQIY0Be2KcRVtOnks6NMHquDmg27RnWGj:55dKii61uD527BWG
TLSH
T19EC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2392c31baf18acff06900842b9fdd4b112672a9998e8d34135fdc2019e4a6fe8
MD5 a4c0ba9a8af156d1b98591be04f4cd2d
SHA1 d6388fbd9eccd5d3ab62b5b4dc2dc079c13fea72
SHA512 d4ea7629aa645ba3cfbcf9db0742ce65b625e37421f5e977bfafddfccbb5e84e482b052d98973b92848faf7525ae71f6e6a01871c8ba0f8ac22b8d7cfadc171f
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5w5Dmg27RnWGj:hX2imphUD527BWG
TLSH
T13B95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b107cb341f3e03ada1008d33b08ad4aaacaddf8b792e05e65df390939bd4356d
MD5 fd8fb735a150d2d37c321cf260782d35
SHA1 a197bc3527a00850f38992d0845c002276ad4e5a
SHA512 eb184228d056d8b93e11de7fa5e976af441ce99d07bdf0d314ddd7dde01bc6febaa0d16a3072ae9b91de14933a2d67993266342364647fdd2a1428e4bda76a81
SSDEEP 12288:nmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAEBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dfd5effa187640cecf50f6313f0676e4261adb99005969a972bad0bc197f6e80
MD5 43400d89f26b8df7fc1c566d5e4063d0
SHA1 e89bbe50b0e02cde4f99b94a439252c15b523731
SHA512 958388e846652a0a3a62f75ecbeaa6132b0f93ac1fa8329a75138f96c0f925c2ed5816d6198b24e70d53acca0fac049e643f49ef51d121909e0e7d8742933a86
SSDEEP 12288:fbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1594523BFA65C41CAE52644B5C3E5F10DAC073E5BE92004937A977CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f7d78398ca88599fe76fdbbb7f295ba5ef375203e89c1e705cea4ebfa3b51358
MD5 43b80f8ad13ef34a9c9b9db5a51f97a6
SHA1 12c45e5f481a91d070d49137ea59f9a0ef0566e8
SHA512 5ca2fc76a4343ecdb8e62d552b531e5e59b9bf36dc06b353f8b67ca8adece141e7e77067259e6ca701f7ad95c1a33576405fad0a1f3795ce8a31eb864567e3d4
SSDEEP 12288:7RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1144523BF965C41CBE52608B5C3E5F10DAC173E5BE9200493BA977CB9FBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3b5a89af7a0080c9ac89a180133786a6b5265083db0012bfd77e5f8a80b4559a
MD5 f9d87524b20ac43d33a476787e1145bc
SHA1 ac7525d080402a7c9ecade29fa9cc9e309130615
SHA512 cacc8372e6a684a3aa7f716adbd434b591e29e915a5b5766c3f4f6906d314f4b60900907c5144659bf2122bfc8a47d1f7a47704dd4c89102b9309329873a667f
SSDEEP 12288:QV0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11045237B635C01C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 60213c79aef6756d4e3705ec32a794ff2f3a54e366bf2ff5b3e600069bc7cb9d
MD5 546d769b58241432e3edc2a11e10a85a
SHA1 00b34a6b674a7d88abf3d722f93b52b0d0b90438
SHA512 d46920176369202e444478d2298a515f0fec7b20a65b7ecdf589e4cbf6ce00d81b5c4ddf3562c303e7bfe779c16741eafec62ce618c4714e738ca45f563eb35b
SSDEEP 12288:7cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7csqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD4523BF965C41CAE52608B5C3E6F14DAC173E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fa9242bd8fb422dc3c34e5b31bf70395180ac13de40f0f1279f392b603d0317a
MD5 a62b6320643ffc066b8aea2c04018a02
SHA1 e9a416c4c2fb312aca81b3912adf2412d2e39207
SHA512 716653563188bfcd3df25849425cd424bdaaca5e0a26aae0919b03ea83ca12ade72bba5284a3927c4b131ee3e0f863a20459613509d8d4beac938201cc68f792
SSDEEP 12288:MnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BF965C41CAE52644B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 df17aabc7c5277a36db53129e2223cc2c5748c9f1c1fa6d14182e9ccee1fa13a
MD5 768e191b6c14ed11f0a492fbf1e1835a
SHA1 ac1a84a4da8015e3d19af3f70dde42215e41d85c
SHA512 f78c02336b28faf127c3d83ea320c36bfeb647016d023975f31eec8d09c9980572a80e39cbf6a6a32f9b0240d3766d39420c4bef211a74b5c0a34847f51f7db1
SSDEEP 12288:cjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BF965C41CAE52604B5C3E5F11DAC073E5BE9200483BA9B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 45f9fe0e941817dfb7ccaada24a760d988ad447bb126f929d2996ebc64ea1806
MD5 7cc08a9b0a6803b8fe7df89e5ff3be24
SHA1 81649c5209fe8b7a7648733306e3d8581a599602
SHA512 b3a9eb6e7a158b0184ceb7df6de865500d7e48adb3a5bf780f5e53868c5eb2b42f3150dd56af1b6cd29fded70a1592444c125a0591ebedec60d57b5281e9de7f
SSDEEP 24576:NZMRzFVSO7sqjnhMgeiCl7G0nehbGZpbD:NZMRzfrDmg27RnWGj
TLSH
T1176501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e304fa26d5cb52b599943e4724000f19893469a3688caf1d459ada720cee9945
MD5 242c41f7bd64fe2540018feeb54d082e
SHA1 3c5a7c048e62480283e5032a145cbbd503fbe8fa
SHA512 b2c9cd30aa5eb8d22d8d80399e2e38e483f2218f981f1883d75e2ae432e85822742e5150c8ff87a9f72a080131aac7b6b36b50c66ab718a76cea72ff39c3a61f
SSDEEP 12288:oKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 32b36350ed914dd6a68a143a6d01b3c52d1792c88807f8107cdb34219bed5991
MD5 b13f59bc63e44ae77b9b8e2fe3770d73
SHA1 9a7ef3d5477fbf0a82dce99c47eac69fce79468f
SHA512 29a51e8a773958064dd71ed2172c5d74b29e39e6c4ce5399c3dc681fa9240c151108819977cf70e5590dd6cbaa43f51ba43a1541c8c623a9aa51e5aba6abb2be
SSDEEP 12288:y+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E64523BFA65C41CAE52604B5C3E5F10DAC173E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 39e905f9eeada0796448869b5d7f1e6313e1d5d4b0b11722bb13949677139e19
MD5 3edb037db41a13e66ed04bfbb4a7a3d8
SHA1 9298fbbcb6b6940fc1e0e701abd011a5b44134d5
SHA512 67cbebd6a4931f9499a2d5a77b9d2af14500c20cb2a1886ac430bfaa1aa44987d470100ebbcf9c419520ff742e760049d73ba68d4ef5c4557f7066b1e3d94842
SSDEEP 12288:2yPz5L8/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Lzy/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13755125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 59978adc43ef86f16bfc443971beb7d6565483aa8c14d1bb4476f0658a219de4
MD5 db4e47eec2c086d1d5158384eabb7049
SHA1 56b9cafe4aaa9cdd27d6e66e245f06fbf7e959dd
SHA512 844d6f016e59a494cc482f4894dd4fb4f530831a4ea61e9f8222f2f7175c488ca67637b4749dd57de771b5f532e0a3ba99bb14dac2f58096389190fd91564c83
SSDEEP 12288:dKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 296a79aa0bbdf5485addce6ae22efbab12dba33bec5dadb86a251d3c51115e93
MD5 f666752e331515d33e924409aa937879
SHA1 6131b955d7f1f1ba9e628075082a4af7f65bef83
SHA512 bac34f49784c8aeff5975bd6d2f80e5d382a97651ee3b3cd6e3fdacebe86b7877dc6fda21586d0afda97ed95727d1f2b681ae68e3308236be604cc75b9c4e3b6
SSDEEP 12288:vKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BFA55C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a634e0597f3c0423552c9e73cb546a85343d27c780f14938a5d8e6c6360761df
MD5 14a31d74c79af0f8d809fc5b5cf62e10
SHA1 b927bcef55093d1261c9b70d67f5236464539e90
SHA512 6813640fd29a80f9d276db61514e63254831b4c355e71bf4dee9a1d7f11ff83c6087c64e7a677de0a3bed47d8d4fde14c6bd277774eb1a2b857348f25f32a89c
SSDEEP 12288:tyPz5L8/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Ezy/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C855125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3564000a4a337bab047776699e378f2e7de52de659c7a6f1e44a275e04649de2
MD5 3305ae60a34a804c7c30791310fe8a50
SHA1 da8be2e658cc84d1df58708e78e1c2540053c86e
SHA512 910901dc1c6161c8648611a0ffd5e3f87f5c08e9d0d0f9e44c60321ef0945574376e94f720e01dda2ac782de5e1d785ec7b7a59e9107a9ef21a6b3c4d15e4fb3
SSDEEP 24576:QTDaLl3z0zDhsqjnhMgeiCl7G0nehbGZpbD:QTuLljsDmg27RnWGj
TLSH
T1FE6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6f7230a718bb4f2c2a7e69de9b4d52db8b43fcdc7fc863996ad06a3a9760c31e
MD5 26acfcd19c355c18600629cefcc51c50
SHA1 9974d75c1bd8a2a4b05923d6f5a823034053866d
SHA512 598047808dab3c4244e6f2c620cf519945fd695a4963e5afec185a00ea71bf1f573d529e30b86052704829cd0511da9887ddaeead02a0a74dde12e7c84e5b4b9
SSDEEP 24576:c3vd9CHKy7GZdsqjnhMgeiCl7G0nehbGZpbD:Gvd9CHKyarDmg27RnWGj
TLSH
T17A75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 60afea8b37ae92368ae382855ec913d260bcda7bce7e5e74e30aa5663d7d0717
MD5 950b1cd5dd5e0ece1a74089fc9175bfe
SHA1 257b5f91c7ba315cf8f6499f6082167f8c8a28ef
SHA512 213a3fad1439a36785a4ad526da307cf33d14080ca29b7f4de2555ee0f66a37b652f73ac03d2bba985ddd142682d89f75c329ee7f633773f65ac4a9b7bc7e599
SSDEEP 12288:DxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d5eba994ec6205849918ad2771935cb2995c78cd80b74f050f358647ee04a2a4
MD5 9bec15cd8edc0dcb4eccaa00f069d89f
SHA1 55b471f1e2a4445d9c1fbf7295ed9a8066e581cf
SHA512 9f898bf35759e1c91220a97ef7d56f212d8f971c7b582e1e98e60d6b2970898107baf89782d0f95c8e9096e0e188b35374572dd9b385ed30d65897126b3e8d59
SSDEEP 12288:XfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BE965C41CBE52644F5C3E9F10DAC073E5BE92008837A977CBAEBB54584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d76bfd75cd0486d8a31dd3208539da0dc31baeb6f6055ecd09da7a99362d6ac9
MD5 afa4a42fafa3180b8025e0b90ab8edf2
SHA1 fdd3bc161ea456488a831113d037188961b6df24
SHA512 cdc21f35c0eea8b0ebb0b58c42e108ec8a5db256cefd97f86459e049e95de5a970c6f69043222ee6ccdc02b61edc91730f29261482325dfb32e2e94116f9a96f
SSDEEP 12288:MYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BFA55C41CAE52608B5C3E5F14DAC173E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a5a4a7f8f4206fdd5d7f1297aef5b65957ae7ddd85cd21d28f9b21e887c716fd
MD5 f3a53b235280f820a24ad0f4030ad3d9
SHA1 f219785620ecb0ca90945ac974be5fd043f9c269
SHA512 330f13aa3b671fcb93cac81a4a11658a3cdfa687e72c488eef3fe0b6888a2d142da386b5ee86afd12cb1ec83a65a2c9f92361181122d91d644c6d67cb4b047bf
SSDEEP 12288:ZKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1814523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b9a2ee6e83e30cd2cadc3bd5ba511f2d7eb2cf35c63f6c64fc850874477bbc22
MD5 28c8eb7ab408a41aa32c0cb3eda663a7
SHA1 6c22baf7da63602ac255dd7da162a795fc5a1c7a
SHA512 4ed2ee4df8a4991da5e33b1f0e289cdd10a482d7d3696127f8232fdbc70867762f6901a967eaa1efdda73eed780270366828fee5271de68b39b474065c756811
SSDEEP 12288:hxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0ac4a0ba65bd3970b872a8f82baba38f59d9c1a6c7fc845fab474059bbc2a1d1
MD5 9d030909425f35034ab616cce943837d
SHA1 9d00068130d4ae54a232f0641fe7a4d0f39b1612
SHA512 b6a0be242bd820b115a0d8595cf6dd4ad27e0f8543d6aa3d3235d03f8730ef9a06d971487be392e16c1a80c8b9a7f8bda7bd405788a89f73a1d71eb87c9950d6
SSDEEP 12288:ySXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BF955C41CAE52644F5C3E5F11DAC073E5BE9200483BA977CBEEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b89de3aea17684605a7dbcd904a78277a2b8536133688ba36f0e72cfabe4cb01
MD5 b6c5f1b6d35d8232f31dfe54a84238de
SHA1 b7ac9c8aa247f4cda399bb65a121c5668f95cfa0
SHA512 1dafed3f9c8c5e83f96c292f94cd7aae672b53cede199e9daaf0584ad81396fa21ce43d8c106a645db35daa64abb34e4583d677a8a15f8ea431b1c029963bf8f
SSDEEP 12288:TcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BF955C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 951b927f75ca521efe3b204f284d60e5dd702090c72e1c2f15b028c236b5e882
MD5 fa8d498f1969e372c48ee4fd4799d75f
SHA1 d604e5dbe2d6a6976b702a7fe16846df83eb8bd6
SHA512 6fdf85b468e4952b7a4087a510797150962f0ae09be15512205dfef4f4a9e2e6d4b3f74c2846c265751c0d0a92caad61065bd599b8c3df1dba4542622727840d
SSDEEP 24576:VfwvUk9RX6wkyAIusqjnhMgeiCl7G0nehbGZpbD:nMnYICDmg27RnWGj
TLSH
T10E85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 611a6697f4286feb1bc39d808a0442d08bb3cb69a0ff5c351fc2d108d8a9db2a
MD5 c3f22c1d6d26aac2726aff4a143bcd0c
SHA1 7868bbe4beed8b87ffefb9080d5233e6231eee5f
SHA512 9ff06664ef4b619b22c7edc897db2efe996f75423ec2f71e5bb533d3cb1ad29aed334d9544fb4d589f57349b1506c1357b9154effa1bc1cefd0b766a67ca238d
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZDmg27RnWGj:/ySzPBD527BWG
TLSH
T1D6066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9c656f18839f665c5b38a06105b8dac718370aed37a09b90767bc145a85436ae
MD5 8f87341fda28339b814971c1f9ac6885
SHA1 645a6cde6520136326dfe7597b2c5ee83650dc22
SHA512 8b79f45614281a4ae006771c7800fd51ae431200a31319978f31ce671d866a567816a83f78c78507fbf93b0367beb6918fe5714aeef4fc20adf7ec812ad7e18a
SSDEEP 24576:747Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYrsqjnhMgeiCl7G0nehbGZpbD:747JUQjTirIhCnDHUPfF/JDmg27RnWGj
TLSH
T19065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e858b05e332403e3df4d8ffde37b84ecb62007acb4fbd9d02fff1aa9330c2691
MD5 00b78ee05b85c2ab2985f795181d8480
SHA1 2b375da436bd0b85fb26e5e4fed7571cbc674c97
SHA512 b35da6a8e2c08e197f2a6584206e6e562504fbf8315578322a91c4f79fda59d17e6955822eceea5609c4175dff68ddc46245a202aa2cf660a5bfc79408fe31b8
SSDEEP 12288:0bsfaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rasqjnhMgeiCl7G0nehbGZpbD
TLSH
T14355015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 abf773211c3d17eed8a2d4e5ed173aabfdce1adc43d5724cc8b11fde969755ba
MD5 96c56c39f6044a7cc1cca0454761360a
SHA1 d759e60bf15c29b849b53be0fbd70fb84332b10f
SHA512 5515849bda214521a8d4df783c6b61d5be51cc430e99d5e44df7a910f790168871a19c6e45b2aa55c06ebfb08531acb37f054ec58e9ac09a5479a9bf607d4c64
SSDEEP 24576:H6sUPZojmdopp10/pPjry/IQtcDAF9gW4W7+:asUEmdopp10/FszcDAF9grW6
TLSH
T1413529407626C74FC66D80325E32D6CCA7B07C01EE45AF0773C89B3F9576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 c875609fd5bc3fc3d370eabf42c912e5208f1f6a486e71c194a48159d7ec2ea2
MD5 a1deb6eec1b87d5bffd8d4992ceff635
SHA1 65e7aba19966307e35314150a74e9b800b2648a8
SHA512 c5525e2c10c80e8f3194e59b4a8c00f6bf7290e6641f0c2b31fe8cd0da0d76d4b4bd0e1f7000dac71d62ad80788a613262081007175d9761c5f6c735e620c6fb
SSDEEP 24576:Q04mdoppg10Wmdop6cipp10ymCopH6XAFM7G/pp1NFyzmdapp1NYFmdSpp1NemdC:Q04mdoppg10Wmdop6cipp10ymCopHKA0
TLSH
T17365E9405137E38FD1BA6032472A5B8CB7A4EC0677496F27B7C8453AD86AA15B0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9f67f31debc60b18e1dd44547e83a8e5e32abc180411690b6f26276ce3813fd1
MD5 ead019626731a287731de59e29ee77b9
SHA1 88462ef0ee3c512c81cca85e82b61b53c76dc917
SHA512 182bea01e2700c51168d39e80f01250ec462be19b6fcc19ff47249ae2bbcbe8413f065f7f01232cb30eff31acba010591a1a8595f0bc4e0b36cb6e3dface7b6a
SSDEEP 12288:807iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BisqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C45237B934C518AF93605B482EAE12D681B7E669F1044C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d4432a4c7bfe882233e053862d1163ec19326c2821378fad8e1efe21b66c568d
MD5 fa39080b06b3d7a35f8f2461c521fbc9
SHA1 8153def79f1924784a58dab906fe63da3abbb2e2
SHA512 52baa2712b8fb95efd91d97630898836bb94c81d3d88c176e2972efca7fe2cb1b31081e5bf0060682f2a9adc1218e7349bc6a338c6d6baa52f127f370bfabfa3
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYwsqjnhMgeiCl7G0nehbGZpbD:zgb4mBIBhGFfDmg27RnWGj
TLSH
T1FC659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2bae8c1bb35d79e2fe82bcab2b60ffcba8f8963f5ba06a6c8961db759f2f678c
MD5 2a851246b0243a065df80a398924365a
SHA1 21d8a3359ffb4ea7fbd6c934bb136c9eb4ae1148
SHA512 b120c7fc4a4b6ff54bc755c705ff4e6def688f3d86b074c067f070533d3415cb1bcc41a1ff7ab276c79b2f5f88e78475a87f487bc968f844c5e5b8cf8fcb4b38
SSDEEP 24576:sG88u8FpJqH1bzria7/m7sqjnhMgeiCl7G0nehbGZpbD:P7ZFPqVea7/kDmg27RnWGj
TLSH
T1EB85016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 da19cbf88dd627be05eaed5eb7be81852850244f2bd5ef6acad94d827062523f
MD5 050d646a1ad7a36f38000d12f671f65a
SHA1 663885d14c22c218ea458400957c3cc9d98b833c
SHA512 cc15d83d99152a12d9a05ce44ed744b929a22752bd3cd962ed2323d9c1814d126491f01197e1d9851e39b4d4a06853abd286b556846c43d5b24af2fc79c77953
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7Dmg27RnWGj:gG05lO43baD527BWG
TLSH
T165D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a2974486abed9d3ca53c83c2f52fd2463095253f80a5e2211587708fca32f95a
MD5 2bb5fcccf8f3f51ee8dbbff9a66ee1fa
SHA1 f3efafcff0ce25065a937abd41e14b62308be22c
SHA512 80650313255e0441b5bd7ba6f32d77ed85253cec9baf700fdcf40f88cbf904f59a78ac38669b079889d8d1bf380a4ea4be53ed66a1b85d88bed48447fc704ecf
SSDEEP 24576:efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnlsqjnhMgeiCl7G0nehbGZpbD:Ga5POZ3BJt2pasx2+mDDmg27RnWGj
TLSH
T15465BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 281e5e841ce209a7e44240015745866b1453f58231fe15a25afb562466eda346
MD5 0684fd420042a316e2d1d36e1c335926
SHA1 a73bd2ed6e43802fcb06fbd78caabb70637785d0
SHA512 52c0e849a1c8f1f4dcb80498bcb3a0e26d72cf7f8121330032dc0281584cdf147f23989fe14883073145165d3667bf7ffa5710cef47c5a680c6f88caa4b54f5b
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkzsqjnhMgeiCl7G0nehbGZpbD:LNc/zEOVHFEDmg27RnWGj
TLSH
T113857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 79326949f3328976958ec327e7643a2af3a6d3ecb0c80890823172fdeab82855
MD5 498936ebe26cf9094b5609669450eff9
SHA1 caea2d411f00e1d287aa432af94dd3832d63caef
SHA512 926a017726627c6eea88b306ca4635c3538a72c4e97884e36b868cc1bd9a68d587ed7c44f54ca71c01402c1e07eb399f7f14475cd22e305abfa9ef08cbec693f
SSDEEP 24576:YTkNvNnaFeYhJNtmZBmosqjnhMgeiCl7G0nehbGZpbD:YTMwBtOmUDmg27RnWGj
TLSH
T17955AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 467cddb1184fc40ff8c4b9467f0b49433ce10d0b1ecfe480f2bfc16937c77907
MD5 98723e16beb4a7621dbeb61b03df146d
SHA1 22b9cfb94d7a2e0ead45fc5affb446ce527d52a4
SHA512 ae2f53fc79d6d9628677603059669f101760e72e8a4f57349e67d89729a8b2f373cf74b496e3685908864b2b654924f0a13c19869edc9533d201a96d004d8d66
SSDEEP 12288:7HvUrBFrEjwaQXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:7PUr+NQXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F965F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 be8de5ecc87ddcc5b5040e8c2934f338060e70d5728b2864e134ab17269aae08
MD5 d131e5dccd1173b392c716a7278c745e
SHA1 e0428e8c73b898609545c60492eabb6a6d0a843c
SHA512 432a2ca50cf3da2a0681c0df86739eb3967993e58e9cbdb6257efe827aded0e6d3bcadb38689cbaddf218e87371515e309d32e5c69d7f2d6a4445f225a2f3fc6
SSDEEP 24576:gD3FHshBIYQgAGsqjnhMgeiCl7G0nehbGZpbD:gDVHeBIAAKDmg27RnWGj
TLSH
T1E175E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1424-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1424-126-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1424-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1424-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1424-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2240-305-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2240-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2692-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2692-65-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/2692-8-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/2692-9-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2716-291-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2716-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2716-67-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2716-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2996-106-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2996-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2996-308-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2996-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2996-100-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2996-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3228-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3228-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3228-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3228-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3228-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3280-311-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3280-114-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3280-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3280-120-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3300-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3300-51-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3300-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3300-40-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3300-47-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3300-46-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3924-79-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3924-73-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3924-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3924-304-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4420-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4420-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4420-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4420-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4420-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4580-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4580-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4580-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4580-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4580-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4580-324-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5240-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5240-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5240-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5240-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download