a19d058e1883a58419fe5bee1fcbd541d67dd801395ae2c3a1aeca241df6b79e

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260711-dhtknsc17x
SHA256 a19d058e1883a58419fe5bee1fcbd541d67dd801395ae2c3a1aeca241df6b79e
MD5 64e08da147fdc7b73c0e458cecefa4f2
SHA1 0c915733152ddbb4d5798b3aec87ce78046c00f1
SHA512 57daa713b4eaaf87cd3526533089c5d034fde69895744a10ab3ce0eed5131cec9c8e5339ae31f0e38d62799e7635a6e5d3e4c9abc68f33f3a65c7025eea9395c
SSDEEP 49152:t+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755c2:w/PvOIjcXvvOOc5yD527BWG
TLSH
T1EA165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4152	elevation_service.exe
1760	maintenanceservice.exe
2696	elevation_service.exe
1812	OSE.EXE
5048	PerceptionSimulationService.exe
2128	perfhost.exe
5564	ReFsDedupSvc.exe
5104	SensorDataService.exe
2392	ssh-agent.exe
1372	AgentService.exe
2580	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d5163a498f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bef2ccce110dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075fbbe8de110dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
2696	elevation_service.exe
2696	elevation_service.exe
2696	elevation_service.exe
2696	elevation_service.exe
2696	elevation_service.exe
2696	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5944	2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4152	elevation_service.exe
Token: SeBackupPrivilege	5564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5564	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1372	AgentService.exe
Token: 33	2580	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeDebugPrivilege	4152	elevation_service.exe
Token: SeDebugPrivilege	2696	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 5660	2580	SearchIndexer.exe	99
PID 2580 wrote to memory of 5144	2580	SearchIndexer.exe	100
PID 2580 wrote to memory of 6056	2580	SearchIndexer.exe	101
PID 2580 wrote to memory of 5956	2580	SearchIndexer.exe	102
PID 2580 wrote to memory of 4364	2580	SearchIndexer.exe	105
PID 2580 wrote to memory of 4260	2580	SearchIndexer.exe	106
PID 2580 wrote to memory of 2228	2580	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_64e08da147fdc7b73c0e458cecefa4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5660
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 1884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 1884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3ec3383f046a79dc0ba76365b08a97e4513edacc3553dda8bd2ec132ea4360e8
MD5 75076231288c544d058f8a96aad28e92
SHA1 374c8ee33f500a621a83c71f5e99696fb8f29ed1
SHA512 b62dc3f1ca1e0f5822032fac2f74d299dd5f94d4d3d83b055d74a09fd1a779f91319341e55fced4c9ed51b94173cd150786dd8d02791d9d84554bab955cd1286
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnbDmg27RnWGj:Y3q6sjBwD527BWG
TLSH
T15CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d13bc4a84474770772f056d26412563fbbe5fc0f216e57dc8a5ccd63bae8bc0e
MD5 8f98eadc171aee86cd361ef37188a3b9
SHA1 eab3a2bd8da86833ca6f03f3f55cbc0390965299
SHA512 059151f3edb61591a2972ab63dda954b5cfbf839475a50c437ad3a40b81ed0ca3fbf4960fbf7b1995519355b14b16626b042a960f428e9d7d917fe84213c8989
SSDEEP 24576:SXYfDtczAHsqjnhMgeiCl7G0nehbGZpbD:5tcWDmg27RnWGj
TLSH
T1C7650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 01eb330200068a10a2bd01730ebc4747295bdc9fd4368a46672ea6bcfad62b2e
MD5 95fc1ba24fcbcf3d6cd0445d0150da3b
SHA1 f413f988d4ebe2b4eafaccbd3f982041860e601c
SHA512 251b62d9a38fdd4bcfa1478318a0cbacc6641c695ab827211acb96566f602fea857d898f87ac9c7ce2046e078797e7672ae188029675b17c15d1bca0e7e795dd
SSDEEP 24576:V0Le5ji0hmxxrMgsqjnhMgeiCl7G0nehbGZpbD:VPji0AjpDmg27RnWGj
TLSH
T1B3859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c1762a484183ccf8e6111ee80b4035dc669fd558f7e59662f60ad3c1facfed19
MD5 7261b6cfd5ea3dab8a181f6a8bc87bfb
SHA1 3bd82c8454a552bc93737b2c30b0505b91d3a96c
SHA512 43cedaf59e8593e6b1db7631fe524c15738888f7d6ef3d60f0e2651da289c84cb8d360a405b6b381e5995c1541cefb34489e134374c69dd2966981e644995fc5
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyuCsqjnhMgeiCl7G0nehbGZpbD:r/ezSC6vUzPveHjy9Dmg27RnWGj
TLSH
T1F3755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e193a006ff997cd4c8616fedda592db536fc37c0e1d50452d4c26fc5145bcfc
MD5 37a1f6fea29a2eac01d6f7ab5a47efc2
SHA1 bd8ab41f8653e73d2051807382a7aa9f06dd83e1
SHA512 4f263b1fbbcb53db730bb0c34a5c3f88806758a083e7790f7fa0b9ebb036389b361fa289c85c3b04156aa1dc208536d4441b860c37f7aa87c4209237358744c8
SSDEEP 24576:dVbqPb88hv/l+YzsqjnhMgeiCl7G0nehbGZpbD:dVO88hXl+eDmg27RnWGj
TLSH
T10B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7c07ed28638129f597f5c86683f6ff08ccf62523508a3a7a25868f24086fcfe7
MD5 2b4f7a1e56410272c20979e83db4e794
SHA1 710d721fc377dd3a151bf61eb3e42aa0225a9551
SHA512 6e7da5871e85e12b2fa947e7caae4901979d4749e59589317ff7cd9abe4f6eb9dc43da3b9692d5a27aae8e3d610ea3eed4b76c2b3e87e1271060f5a24f495994
SSDEEP 12288:LL8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LL8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E4523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 68e649646572704307a19026bae5ba4870da0ad88238ab673f3d4b70c1059e55
MD5 966fd53d5e494b66ba8f7367d610844c
SHA1 ea75ff6e128678936c0ab77da4886ae8a98a9997
SHA512 9b0aeb87bcbe1dc3d025ffe68350c822edefd3f0de531f9ef891e3c4aa2a965c9ff302b7726bfab9cc9ae762ceda7feff02da3433ecf494216776f23317f3f38
SSDEEP 12288:/eBNUbTVO86UrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:/JIUrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19665CF7BEE28FCD2C27A4DB95791C600E76278314F21A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 25cd757dd93a5aa65bf2e43f93237df906a084de6628a76e252bf39ba2a20a6d
MD5 c8b07d2366133de5ce0e7318ceb3da29
SHA1 fffc0f9a03c12ba984f303d89d0ad9ace8a428dd
SHA512 9981e9112a557356baea8bfa98541eb6843fd631167174a2983c23622ff60199d75e2ca091382490b51602d76ef684dad21daf3503aa0e492d077131b5314756
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH2:NQvGAdlCEL8c/DRNw5C2D527BWG
TLSH
T1CA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 403cb2898a317083d74a566946b396853bce14197a63c8192a5f010df8e77222
MD5 31fa95a7ca5cae409acbbbd36090fdc5
SHA1 7d4a3c46592306827ad00aa26db49b3fdec8bd80
SHA512 5a410f11c85105831fc2ca880c20fff5e18714b9b4b3adffb926bb86f7235611f73a242782e613dbc09ae41c53cfb018200b12aceaabdeaa20d8f6bd3e27e7ce
SSDEEP 12288:dAwSfxL/2Dc3RDLLmt0LDQewsAjlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:O0ewsAjlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB75E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3993b2b2434bd2d03f10cddee22b09f99e515ce63a40a0c4c4e1ddd780f302f5
MD5 35c884d2e386b59dba9ef843d69f76cf
SHA1 643dcf613a3131de33f5de73bd7c4ed865cdf3ed
SHA512 8df409b94372432e87c2801a898c130a417526928c8c2631db72b24e09867bdf54f41c405d2fa812e5cee4358cf3ff7998eee3124a18eb6152a48d636f70d871
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHxVQBWG:5UEtQevvqc2W1cpV2tI328B
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ed92bbc3daa40054da9e352af14f350172bec211e536ecae785d79dbe1977411
MD5 5a3308927fc06db32458223352df7d37
SHA1 294afb8e5187b0d6ce61766e81fd12f3254674c0
SHA512 bcce2cee17fc197e1e1039ccdbd0d7393126a03d5efea46d4f8d40f1e82bf19ea61b678407d426e680151ae7199f25c54c4b7a4dd258f413299eacff6117a47b
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/z5Dmg27RnWGj:loquVjnm6D527BWG
TLSH
T134D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c7c6ffc0ef24f78260599f15da432d47ef56a313b4a41455c69cc2b0246702c4
MD5 1b9cf93adf0148485b864077d1a39eac
SHA1 7bb6c952ca7f3f972b552bde684361ad3dea49a8
SHA512 476420665ba8e8ac5e04c122bcbef4df3f79799392e9c2ef309394a1510001434987737428d26a6dd9f6214aa7621fd1dcb597f362d70202d09ce1114fdd0c35
SSDEEP 24576:aAhGL3IFoiwtA5l7S53WsqjnhMgeiCl7G0nehbGZpbD:aAMUFoiq5qDmg27RnWGj
TLSH
T16D359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 425975f32218e9fbe9a1489cfb02724c0e4cb711226f5d57db153ca50a0d3be7
MD5 5a4b3e3b07c0bda5a400a78dc60b6187
SHA1 c1522535bf2d1ba1deca328f4bdded112991a4f3
SHA512 4e6be000cd4334243824ba91bb0bcccde7f53dbed5c6ae2389b91da2281561dc9b7a3a146f2d279b4f503dc1bd2a9cca2bcbfe5d8d255884a919b95118d7a157
SSDEEP 12288:bmw5HEjsChNVBFgl0WDm+CiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:6wu4OWZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A465F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 45f37b65da1f558e10f9215fca7cb7131da38a8573ad13d17097516a4651237b
MD5 f963cfb3c19a99604fc6de03e27b92d2
SHA1 0c88fc1437bffd41919a3242e84bbf0f8d820e64
SHA512 d8c499e9150f9c951252bd45218c2fe028b3af4acf8397f244a9aff927a6cdc5dc410cd1678fb96417dfe1e4582315dec69d6b0b57ce2b2bc4c335350e7c6413
SSDEEP 12288:VeZ1IyVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gZuYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1825512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3ee6014b19a6939c49286f768d2eda1ffa9055fd9663a8f0889efcec1632d11c
MD5 c1f95932acf5465998de417c45955d53
SHA1 afbd83cceca2bc9ceedbe8b68c7e0d2d719c25ef
SHA512 ac82cd1b4e2081492bdb40a4944955a5821bf7dbff7e83a4be077cf8dcea1fe6f35f5b13fb05088dec8483707e402a9e29a452836c8b0dea92dd35d14a0db050
SSDEEP 98304:SQRQyi36YOcPbLvw2gAf+PN3jD527BWG:JQyiKa/X+PNzVQBWG
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 66a1841ff97e3213ff483df62dab624b805992c7624a5cdad7cbee0c2539b2f4
MD5 a9888ea5c6642008077e0e465c461878
SHA1 4e5ecb998a340099aad12e31685ff994d3cbd590
SHA512 217055f81f7aaba0e803d7682a831ca337252cf3c689a57e1d3c083dfd20473b35dc3e04c64de9f2f68c3781ac2ee1f7d13fc436311a9e8e08b0449673f96409
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3jD527BWG:XQyiKa/X+PNzVQBWG
TLSH
T1B3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1aa19f2fe5ea20747ca889ae6a83fa43fff4606fb927c38eae7ad2c17386d991
MD5 81963ca92b0351cd2548d205eb9a7e85
SHA1 375b76e4f673d90f3e5baf2046ca44e3ce5b2ae4
SHA512 95095cc4e3f56c11e74acd3f750088e7cf4195cde79b6d434cd6aae421cb619794ea60bbe857cd4ed76dd077a7ecbc249ba581e522807802a095d9b8789229b3
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0osqjnhMgeiCl7Ge:g68Qg55nhceWu7PNU3/pDmg27RnWGj
TLSH
T1E1B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2f92ba3622e1bb115ecf1c5afe01ea9881a1b81c92cf8c6eda95f49f9557906e
MD5 9dbcd53c573dc283b7165cbd65d1e334
SHA1 d4f6362ca5ed5d3f3452051de41b5e37feec83ae
SHA512 a6c042cca0f8bde9d96fbb19c0943210765c72c625a3b3285198fed36142ad93719de211539f00b00188a2006f61ea35828bdb8a4bdc581e05355fff3919ef9e
SSDEEP 98304:ty5112gYy5azzVvt69nLKnhZoD527BWG:QLIHEWhSVQBWG
TLSH
T1A7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 753324000d36983dccefa798a50eef3f71c6c0d025145c9b0718a040e5754a0f
MD5 1c2ac2ce10e5150e900d6d91795161bb
SHA1 f6bf5202deabbe5f2a5cac47e92eb69a047d0704
SHA512 c5ff60414eeda39d752f81772fb975b6ef402c9de21c45accb4af763e762db936d89e39d551424b76cca828cd938f98827204cf9e42260c55293d752c8efab92
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glUDmg27RnWGj:3u6Jmdxd2dUD527BWG
TLSH
T1C4D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 83f5ee9deab113293e9a2dc1f9ee46d1aaf5e7e76125ff351b8dacce98420e84
MD5 9fe3cdb75eb00e74a8bebf550832c9f5
SHA1 1761e2a966d0d4024dd6b29000af7e4068c5ddbd
SHA512 bfd8ae6c8d1d91c6b98f97139956595f7606e720de0932cba23b42bee91efca5c854ce67fe3308745d74154c48e36ef4ecfbda5444636670d8a64e04134b9968
SSDEEP 49152:Y1hpsNoJpF1A63U44CwH7R4x/Dmg27RnWGj:YmifPWR6D527BWG
TLSH
T1ACB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1f7277a4e7368523c04b15856385ac7270855d635e51f89fe4fd2778e06221e4
MD5 3bafaeb97c872d742f85f01b2199e3b4
SHA1 f0a44f38da5fe41c8e7667aa1c108dc59fa5e841
SHA512 05b15410d9ed53c9947bfa78a45ad959dec6a1b6e436d9902a2a37ef4dfbf379d4e9f77a51d227d5cbcc5a49abde54766837f450aca2795b68b16a90aded2d1a
SSDEEP 49152:oSuZQIY0Be2KcRVtOnks6NMHqEDmg27RnWGj:y5dKii61ED527BWG
TLSH
T1F4C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ba2a6d5f857f356cbc9825ca7d64721342e054ca85d913e2368e69497b74f148
MD5 6a6400d1ada034296494641edc10a421
SHA1 5b7fb52d31b5d951db8a92083dc102aa79affe97
SHA512 abc0df73469e463f7dab61e56e28cbbc73550f4c92bdb54a895ad5f03d73d2d037ca9cc4334e19ebf1c6ed19f300c525591fb6f9f86b6442b5d506da2f2a5f93
SSDEEP 49152:IhtSn8EApI0fig3giDn0AP5wbDmg27RnWGj:ZX2imphOD527BWG
TLSH
T1CB95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f0713abef7aeb472ff1b8e901f0ae8641aa7ed4c78e6267196f43ca29921acd1
MD5 8481af05fc7d230b0d9dbeaa88acf600
SHA1 4b5d8fcf1522f5d4349e1f71f81360c7f45b05f1
SHA512 61949f885ec3887b872e07af5fcad0bc9c61f71219eb280a8d4a0a0f1984ea0d0a9de12030785ae3164718d218e46cd6ab867200bc7090135a922ce4be7fe7af
SSDEEP 12288:8UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BF965C41CBE52648B5C3E5F10EAC073E5BE92004937A577CB9FBB24984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c121d98d781bbc77b19350c569b8fb479ee4fd2e54c07d0731a1273fd655adac
MD5 8e905688d4908020591f107c3b59b75d
SHA1 c05f028573319b5e43446ef42fd69adfd8b1a1df
SHA512 a3c4d2b5010262dd9037c769f6ea3672dcf6a6ef1e3bfbec1df56b60c0fbb98750dc44139c032184ede5b2bdcffdea8dff1b6ad3bcd2759d887f30dd95a277a4
SSDEEP 12288:GBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A677CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b8467471bb0a88346b495508acca6e043a56135697bada7a5b61e5420a126d26
MD5 90ec236baf76534fddb11a3d78cd5c08
SHA1 fc03bdf9b96ba2f8555ae55524385db888e10ac6
SHA512 d639a3d202b971e3e7262dc4a42f6781f6e5425e12784d595e3ea6bb49d8b5fef5d882e223859462749c217820856bb092788ffe3cda0756f5d7750bb3599d9e
SSDEEP 12288:1DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BE965C41CBE52608B5C3E5F14DEC073E5BE9200493BA977CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 eb2195557c13211229cfe5e54b077caaefcf7e1c2544de9b680ff614e32579fc
MD5 f67a007b23309559b3663a705c6b8c5a
SHA1 d9d7fb4723a02e07eae003785c3e788761d98c29
SHA512 201e176317037db08189c47cb307e9cd8aa4c9b8a968842e08f7fa251372f826476c28214fa3dd560d9d3b4a7b1d6c1afee4c15571f6152f2ddfa5766a2b6045
SSDEEP 12288:PV2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B045236F675C01CAD83285B5C2F5E11DE8237D96EB3005DB6B532CAE5FB12944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e7c6506aed8b79359736bc3d46fda48cf99ebec4df58372513696ab6428260d2
MD5 1a7b17db3317a467b0219902e43664a8
SHA1 5f5d0e1304ff14e3a528d945c16f9dc96330a9f3
SHA512 2bc578f2c8a6765f2338291ec212b79618bb64acce8754a6a06219a01fea1236fd9d429e6f15f1ff8fd8a99e7e2780663ddf9b9ebf7c232fe7a4dddb174092af
SSDEEP 12288:0eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0esqjnhMgeiCl7G0nehbGZpbD
TLSH
T1494523BF965C41CBE52608B5C3E5F14EAC073E5BE92004937A9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 975eb5350e76953a4ead3ee85d88c7a046ee348c7d704dad590c4262b833f244
MD5 6678406a226dc90c8e1e631f8c38cab5
SHA1 58ca05ce4ceaa2fad8f6a629b3e4996d9b1f60e9
SHA512 455fad9a11c5f9e9f6aaf0a29a64dda4853ec4575fd7a5a3eeae70f27e1cfdef5530a64ecb95761d10e4cdc2f0295a28940a4284fca298e9c6a952209acc6bf1
SSDEEP 12288:Y9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C4523BE965C41CBE52608B5C3E5F14EAC073E5BE92004937A977CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f86e1df542e6805f7db4282046b6c4501feb19b900abca7f6dcb76f020c885ea
MD5 e3e6bc7e7b444c70055ccde74ed7bd90
SHA1 3ea78f09d5925a206712e522b4496cf7dd76832b
SHA512 88247fb172ccce3d82329db12ad7d80373122e19fff94aa191f631e4e86761af1d2c3cd4e6b444623a2f6c41d8bdcc16c19e4da9ad08981e562578df228abb06
SSDEEP 12288:0pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0psqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E4523BE965C41CBE52604B5C3E5F11DAC073E5BE92004937A6BBCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8172e7e568b610ac6bc3d3ba181dc018c343a8216f2068f5c78b7c7db337ff7e
MD5 82888cd3e2eb357ae93c9971e532c5f2
SHA1 a2bbb684d00e0a6c4a7aa4ec42798528c3188d4e
SHA512 86b7fbcdb75a1c08a24cf06c032064f8e4695bb45d90dbd03b0cc8074baf7091ff3b6dae08b14e004def21e24ace986c8b907de46c255089101ae63c9642696c
SSDEEP 24576:cZMRzFVSOhsqjnhMgeiCl7G0nehbGZpbD:cZMRzfRDmg27RnWGj
TLSH
T12F6501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5fff4bb6831fc3b9cecbb13917626cc7cf00097cd71d6f0a6d9c8499700ca189
MD5 1dc2d46d02a8ad6f5472bb61a497d90e
SHA1 a646409f0eb69ef847ffb2663c89187e4037a28f
SHA512 95b5280d0b492660dbe90abf0629a499c8e115192d7d3bb57e6bcf6f7216735f899a5591780ca283cbadafc5abc375b76f2e76f952aea3553155d64d49a43998
SSDEEP 12288:dIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BF965C41CAE52608B5C3E5E14DAC073E5BE9200493BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 75d485886077d8c58d513200662bef4d0f62c93a94d8e3e4b7c9774499732739
MD5 53d6f11285d753f7c59d5d8cb7e75de0
SHA1 9f1d42c0fe100a550f0a788b6cc704212c59db42
SHA512 4f97fbfad3dc756659d36414b045ec32e67a802388ad39e7dd9771a5ccc9c22ef5eae9cde114eabab8e674c5bf626e4916c427b31293536969cde7c60772b16f
SSDEEP 12288:csXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 183f3e20f2f391dfc67d4d0774ed762cf073320cfd2f3f3b223e6fddc65985e6
MD5 543613c3d09cf53a0f3ae2e9d4a1b5b3
SHA1 5c2099bb63ee290a0a2fa40e61b91244f0d8b2d6
SHA512 9f7f8e381e5788dbd046f71c19553907a8a3fd5eec230f86a506be612af3e239c3e40f41820f63eee113ec0d4ca9545550e017e6e4545f1264cc95ce91b8960a
SSDEEP 12288:XyPz5L8VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azyVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F55025B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6ffe80e17719885c336ed8e117f3a09ecb650d45c96a9f754f9610a64cfa23ef
MD5 adb4e357eb5176652bd132ace76ac6b0
SHA1 ef5b8cec460db39d6e8265bf95633d2f800ac903
SHA512 4d8ee79d69f403628e3abe83d5525f59d78f3cdcf1486cc2a70f8485a8da3495040f983bba55c634a00c07f9b221ef90256a4371b7733736554f07313e79b3ef
SSDEEP 12288:mIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 65918462cf8597594ec23719fd74244bfa6a1f1a093d7785d8410a64d04114d5
MD5 01681e00df090252d40739bd3b9e3e35
SHA1 f1fd326e4a03c69428bb26622a1dbe3db18b6573
SHA512 d2c7e59eedbbef05d4a2a95085d92e8d328e248aadfc47cb6940c3da21ec51149cf103ec91f0dddcab46b2f157de5eb9856f9230e73d6e0943b0584afea3ffe6
SSDEEP 12288:/IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b1afcf657db3726a07f73c634603930cff5159b902a953011961bd7e90abeef0
MD5 4cc5e21b209d70bcc78f8a61f1164339
SHA1 725a9bb0cdd827ad3bd017b7424596705328b5d4
SHA512 f663388924a27835f01754cd4ade698d3d77adf268405ed95190c17ca017331531d09611cd8d6d491b37a51f8cc8126b18cb480483f49f02e93fea3dcf062dd8
SSDEEP 12288:VyPz5L8VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8zyVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13955125B73A530F9D1368138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ab7ba761ca31998073cc42ecb3c96a31d96ffebd7f8b4a100ca317f0cc416ba6
MD5 87ee0863810bd29841a171dbe473ce1e
SHA1 5fff2f9a5ba365c68da725512fcf7e8ebf3a9410
SHA512 0aced4b85a95ac36415cd8d9e424015c131f8ed9fcdcd0d728c167a794601c040f74da644abe8b98ecedc4dc23ccce5d2467757eee6db1cde4d9c9a6833f1cad
SSDEEP 24576:HTDaLl3z0zDTsqjnhMgeiCl7G0nehbGZpbD:HTuLljGDmg27RnWGj
TLSH
T1CC6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c128819a3f4b14a8ff923726fbf715432e3d3cb974cc650a32469a556a6d17eb
MD5 febae419aa2da6df56c43a63ac4a50a8
SHA1 f1ff2fbaa0fc2931beb017da4928aef748a60b0e
SHA512 63034d9724b054a5ff1ce9a19381c6b6b64cca9f804218386e3b7d0f43557e4bcbe76e28f5f545126412e7eec80734af30b46364fdfc5d8eeceecbcd32d5726b
SSDEEP 24576:C3vd9CHKy7GZfsqjnhMgeiCl7G0nehbGZpbD:kvd9CHKyaRDmg27RnWGj
TLSH
T1C175CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bb33ade766495d44fd408419f970ba688f757366ef8c17e6f9ee6a366becc2c5
MD5 82fc13fec7863ed16959bf649bcb1c5b
SHA1 7dd3c70353d357dac3d4135a4efa72cdd5433ff1
SHA512 bce9b05d55ee89bcef609d0afb45d690407483b0b91fc2ccc3713eeb6ef72594bc383783c36a0c853d2b857a293be3db5568548ac0d26d687059aad6d795cd34
SSDEEP 12288:GjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BE965C41CBE52608B5C3E5F14EEC073E5BE92004937A9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2efff2266481513dc39ed5806821aecc27ffc06143076a11819154b00c1020eb
MD5 e8b4fd896379a9f1a0f227052dda82b4
SHA1 3a6b17f85af7a43496d338b2f925e1d26a2c6ad0
SHA512 8ae3d4b02a7930e37f0bb8e8d2b8ba38893b52d6d764d469a6d3c654fcff272217899f831cf2b8cbe700a68a88ef464ec13eabaaf1106a2883877d539d2e7824
SSDEEP 12288:X1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C4523BE965C41DBE52604F5C3E9E10EAC073E5BE92004937B977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f99152fefd58d99842a96b365e0786774d3e999d7a4290b11f3a060ae4a466f2
MD5 e2d524d85a96e327f9a9d6f7fbd648cc
SHA1 9093d5457643e7127d5a64989bec6dc3698c77ac
SHA512 d87e9fc9bab6d8d1a258162186d5bb763e5aa49719d60cfa68586b056a86eedbbc06f07c95b681383820fb8240ef7c4448624612b129e27f9d7afaf2336005ca
SSDEEP 12288:0qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BF965C41CAE52608B5C3E5E14DEC073E5BE9200493BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 39c9bba08ddc79de659fa8fcabc003c23c225b5c1fd1fbd8bbd71e251503f623
MD5 e06d92cdb5a3dc073a2e26f3d4b74c58
SHA1 4d6e1c47708a93bd83a70f706825be4f67aae406
SHA512 02061a3559ca397c2bc1d3cb3cb9f5801c4f66e7a04b17b2604715c33e7fca62e251670597fc7f4a49cabf5b05b9263d55716cbc08218cda2a6708cc123109f2
SSDEEP 12288:cIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1814523BF955C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8a683884f96ce087839462d8f703ced7dce2cd1442cd88a57ac3683abe47fcd2
MD5 b11d836b99728aadf20527aa385adac7
SHA1 729f7dc2a99661be5ebcd8eaaa944171e1c917bc
SHA512 a46a10418becceadfd6d44b2749c01170050d6fec1a342b95cbf3e5598687913ee271a9bf5a842743598ed1f88cd24076d640b5d82b390cdeea08daa19223aa2
SSDEEP 12288:UjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC4523BF965C41CBE52608B5C3E5E14EEC073E5BE92004937A9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 741e713f3a9c0c733c6dcb2e54eadfcb1048590dfb33bfad5f54438a9e369f2f
MD5 1555e86503d9967c6b3850e1382d9021
SHA1 4025885b863caf89206c014cc010580e20612c74
SHA512 eab3049d704228aa1a0d00652703cf11d16a8fac2302d65ea8017d68155b29b06a923472a5e574e82c76ebfbf64ee38f48e4cd0d52eecc08c600740cd35e265f
SSDEEP 12288:nwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BE965C41CAE52608F5C3E5E11EAC073E6BE9200493BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 69d837df9e09f619a09df82666d6a64c108c3936109c631ca90718a1190fc2bc
MD5 e38ae033d7cd3dcebb7a2e888e1e4c48
SHA1 2637c1c509dff6dd9db44846077e2f75b0fc2f38
SHA512 8a0788d0c1a4f46ae58011afc0e29bd7765208f1ca29b52fbe09214fc8adb3fd45e396af50bb5de56277e9236454108020f20f62dc56fc1677af4952045fe86d
SSDEEP 12288:beXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:besqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F84523BE955C41CBE52608B5C3E5F14DEC073E5BE92004937A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4cb82cf4d1583117c5ff0d33dd2d89cd3b6747837f025ef27244b86c69a04186
MD5 594572d917306ac67f83a2774fe27ecd
SHA1 9bc1ad2560068c4eb979d59657b0df2005a33676
SHA512 284db0501e1344d88de081c619dae75c6082227c64e893bcc8a81949cf049cbc01a70499a1e163b8f134359be049cecfde8d2d7f6a559998a066db0dbb2af19c
SSDEEP 24576:cfwvUk9RX6wkyAIcsqjnhMgeiCl7G0nehbGZpbD:YMnYIIDmg27RnWGj
TLSH
T12185D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 38e0e2a3fbf3a73e5cde118bcd70b28dae2f7a1237c4d8e7f153a272d4795087
MD5 34e384ca523e617c95210bdf6faf5797
SHA1 b320aa2328dc24e7313f73cb00b2a99f80c491bf
SHA512 f8ab5ce70d8358c4a104104a95fb5bd4f25b5ad3854fd36abc4b08e9f0b39e990b570e90893b835da612a222eeb5d87453455c864b99d1fbb3cf02cf69338986
SSDEEP 49152:HYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07Dmg27RnWGj:iySzPDD527BWG
TLSH
T120066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 93720f8b0d1a295079222776f23e52336918435dd6ce4c07c259d29f4685574e
MD5 692c9988afea265e04de0151d4fac72d
SHA1 3254a6c997824def36b2f9d417c1853b6b3fb696
SHA512 f3a5e932ebbab6dd07e653260b587e4ab6dee74ee54df3e210858143316ba37f8e8d29c3d7ec493101d077c9c66632dc19bdc2fd2c9a236042d70c5a3d43fa0c
SSDEEP 24576:o47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYRsqjnhMgeiCl7G0nehbGZpbD:o47JUQjTirIhCnDHUPfF/rDmg27RnWGj
TLSH
T16C65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e2e428bdbf4590f768cfc4ba07803e159f6dd2fa25fa459e2a75f97beedc372e
MD5 835ecd4bb0f33e23df51deacd0d0f6c8
SHA1 984052c08beaf19c28a6cd33bcf8a20c324d62ac
SHA512 f87e78666d8ed934541386c2e5ff5c79106a2852dc194a7b0a7daec1d997113e502ba2d5d67127b7b4c3f3241b1d0e77fb99910dc72dd62e6260565ac7d0e519
SSDEEP 12288:3bsfYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 eb9263f5ba81711d996d15f1592d8d58710a783c77af348788bb913546c72369
MD5 83eea2c50f61624cff369bdf64a68ea9
SHA1 2d09a5c6eb256684c74df322573bf055518d62eb
SHA512 9fe71a56a34e6a4919f0cae394bccd9babdf34b2e508b37ec2ef77f01dab5f883372e24094ddc1ad105b4ef402f46a8b4444b40910ae9218823414e4b3917fef
SSDEEP 12288:dl05U3fv0EQT7/odRkmMaJQwm/gHbhgzr2tCh9OckESCkLy7u:dlsUPDC7EzmiOr20h9tkESCkuy
TLSH
T1CD2518007666C74FC6AD80325E32D1CCA7B07D41EE456F0373C89B3F9576A58BAE6682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 9c0b5d21d97e291b7f21a5b086b08a4e5c2a39039f1db3c3b398eb4a7456ba6c
MD5 c56198bce11f45667210498c245d36e1
SHA1 d6a1b3729e202c6cb259134111603436371bb5a5
SHA512 91c89fc51871a4d5baf0bb64e5ebfe8d4175aaa52a2835b0feda7de67826be4db7f22e44a7933ed0074ecc8dd7fe6dcb53cc3c205bf0139f11ea6681eb7b79e9
SSDEEP 6144:zqnw5RRRFcwT+sKHFDFKAB1LpGodRkmMaKfnkF3OsaqKfF4n/EB2xBuA7/lSqtMD:K2KHBMo1QodRkmMa+eYvagdml5HraH
TLSH
T12B75F8405137E38FC2F66032472A6B4DB764EC16BB056F26B388453AD86BB15A1F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 300001bc8b11ff39971a305ed7d25e8da5f7cfeb471ec8dedfa1e3414312a080
MD5 ac3a9598567d177ecda67e5d2379f3fc
SHA1 f57378a2684b8c5429769b1a0f6e9f68481edc0e
SHA512 7e8626af02b3f0b7e753dccaf83b5f040b7b2b8caffc6e6b2d9136cd13ab4248c6eba907d186c3d6de8799c73895e3a9b24175351440acc6fb383906c354e5cc
SSDEEP 12288:607AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E45237B934C518AF93605B482EAE12D681B7E669F1004C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f609392e854100cccf3bf8c7d5b7d2be5aaa85519eaaed4228a48b20d983eab2
MD5 00aae3d2f34fc0df195f108892a954fa
SHA1 71ecb07150abd5be5ee1fbb1b6cf421482d99820
SHA512 0b198014ce922eb990e90ab3cf9a1e93642645607ea1dd55bf4d6d4871941aef94ac3f538dc688d67a56831651d344c826f0402ab089a5e8e6b07b60cd8bbd9b
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYCsqjnhMgeiCl7G0nehbGZpbD:Mgb4mBIBhGFlDmg27RnWGj
TLSH
T17E659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a057a9c83cc45861ce5d3afd58a34acd38e7b30e9be0f0ad8c78d77efb661912
MD5 d322fef94645b25752f77848c26917e4
SHA1 88a232abb9c2a57e85e20dc336a506d0d92fe523
SHA512 583f959124007946e6918584ade8f77c0cd1c08c6012954962672445473cb8c17da7587a1863bc66606abe8fe22e89292928ff74c5c4d731997fc41ee4ed714c
SSDEEP 24576:lG88u8FpJqH1bzria7/mhsqjnhMgeiCl7G0nehbGZpbD:I7ZFPqVea7/eDmg27RnWGj
TLSH
T18285016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 563fc549fa8236374ac0945f23f92784614fd8398acb38e991893ca3d0247ec9
MD5 6ccb315fde79874a71e77de058d0258b
SHA1 336d9b960247648524d8b38552cd15b314c30cdf
SHA512 340d215f518f1fdad7d271769ef3ceb40044ee3886758b10697b94d07893633fe7996b96287b3b333cfcac6fcf6e4ab66a2c4e539916ce8edd734f51f9700911
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhDmg27RnWGj:aG05lO43bgD527BWG
TLSH
T130D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4fd2a3f7ccdf9261d4890367546656669412439ead47d12daf6f08cad3f277dc
MD5 a59606f0ebb02e14d8320ca551570003
SHA1 c055dd30c8e9ba5bcef754d664c64c49710e1b0b
SHA512 b1236e5d8c987d4af773ee47e19a6ba62424bae2a7b832c25c14eddf89f1303888f358467db45be5bccb4dce3c2da18f1b93e2e73d2bdf5ef330e089885d37a1
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnnsqjnhMgeiCl7G0nehbGZpbD:0a5POZ3BJt2pasx2+mpDmg27RnWGj
TLSH
T1AB65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 135297f1e93509ecf601e9fdae9a4d7412b4a7c5ed8827ea8f02070f93c66e19
MD5 a4b9439a6fa027fd7394b621590ceac4
SHA1 36edcdfc15d2b81f5f5abc92d87031a864cb30ce
SHA512 34f28b32d9a622da28ed9be5481aef3fcb2ec02243bd5aedabe16080a09e55f8bbd9cd9ee2ca96f8bdd6eb7fd95fa2fde11bd0da20818fd7c0765f968e982962
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7Fk5sqjnhMgeiCl7G0nehbGZpbD:DNc/zEOVHF+Dmg27RnWGj
TLSH
T13A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 00e5ec9ac275540f9be3bd15594f481d21a5fe3f81112d5682bbe25b1a6b5e8b
MD5 48c4e9ab2bc9fe8381c83220ca7bd256
SHA1 d5a7d6d7065b35685a3548fa8f054768f470f3b7
SHA512 d5ad4418df584d942348d179e4bae6d6e0b4d47748c907bb6cbdc7af90ccca1d300aba9a30d3a166630f9f0fff09304bdd649fe2c18f54102e895c3ba15302de
SSDEEP 24576:WTkNvNnaFeYhJNtmZBmMsqjnhMgeiCl7G0nehbGZpbD:WTMwBtOm4Dmg27RnWGj
TLSH
T19055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d7b4a82252b02f00392285d92a343913b3d75a62ed600b8f59465554faa94315
MD5 3701fd16ec8262e1fbf1f4b2785c6671
SHA1 d58d5592d857b471810d0216a7e7f6f6c6b12297
SHA512 f11ea30deb158ac9e8a714623a893ca3a86d2afb1dbfcdba722e2cbe9f986d66dd50318040a54c3d8add6a8b453e276df378d57771b326492772113d7786d48e
SSDEEP 12288:9HvUrBFrEjwaQtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:9PUr+NQtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12765F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 304918f74d376b56d69065b4fea0984dd030b7c8bbdb724c681efa1f87fd092b
MD5 7f9c3e1edb9d3c93c19ace521e902039
SHA1 369be535265f2fae4fcd5091f2e22a0fcd456cd2
SHA512 305e18b945590ce43ac3cbba30e2aebaa9dc75f317b31c8f6ff98cb31d42da5af9d7ea5953ef935caad797a370224d81e1d321e842c1d3e65244ab42814a8a0b
SSDEEP 24576:5D3FHshBIYQgA0sqjnhMgeiCl7G0nehbGZpbD:5DVHeBIAAQDmg27RnWGj
TLSH
T1CA75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1372-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1372-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1372-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1372-124-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1760-39-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/1760-32-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1760-33-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/1760-40-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/1760-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1760-55-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/1812-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1812-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1812-278-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1812-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2128-305-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2128-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2392-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2392-119-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2392-113-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2392-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2580-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2580-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2580-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2580-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2696-162-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2696-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2696-53-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2696-52-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2696-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4152-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4152-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4152-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4152-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5048-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5048-78-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5048-72-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5104-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-105-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5104-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5104-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-309-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5564-325-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5564-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5564-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5564-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5564-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5944-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5944-29-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5944-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5944-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5956-323-0x000002939A110000-0x000002939A39B000-memory.dmp

Download

memory/5956-324-0x000002939A3D0000-0x000002939A553000-memory.dmp

Download

memory/5956-402-0x000002939A110000-0x000002939A39B000-memory.dmp

Download

memory/5956-403-0x000002939A3D0000-0x000002939A553000-memory.dmp

Download