55ffe5fee8185f4e19e488e73dd3a72a6e9711e82eebcaae8b42a90e65c01961

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260711-phjk9ab121
SHA256 55ffe5fee8185f4e19e488e73dd3a72a6e9711e82eebcaae8b42a90e65c01961
MD5 d7cc74a333a09d753c75f3ca062c6d02
SHA1 e28a99e8c31fd01f087036b78d19b8fec53828ad
SHA512 95e0a955dda1bea1254c1eb4e3a3f2d1a30b142147a1ac7724f69e24a9c07407f03ffbad0829df18657f5ab3b69b2e6481c17dbeff8a52d8f1b05adbeff4f5d5
SSDEEP 49152:X+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755Sx:O/PvOIjcXvvOOc5E
TLSH
T15B165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2688	elevation_service.exe
2760	elevation_service.exe
3816	OSE.EXE
1100	PerceptionSimulationService.exe
2604	perfhost.exe
5616	ReFsDedupSvc.exe
2908	SensorDataService.exe
4732	ssh-agent.exe
4476	AgentService.exe
4520	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\13da1ebe8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017caa3dd2f11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004561cf9c2f11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0ea439c2f11dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba8c5b9c2f11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003175fbdc2f11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b7b009c2f11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037d7269d2f11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2760	elevation_service.exe
2760	elevation_service.exe
2760	elevation_service.exe
2760	elevation_service.exe
2760	elevation_service.exe
2760	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1160	2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2688	elevation_service.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4476	AgentService.exe
Token: 33	4520	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeDebugPrivilege	2688	elevation_service.exe
Token: SeDebugPrivilege	2760	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 5852	4520	SearchIndexer.exe	100
PID 4520 wrote to memory of 5040	4520	SearchIndexer.exe	101
PID 4520 wrote to memory of 5668	4520	SearchIndexer.exe	102
PID 4520 wrote to memory of 4972	4520	SearchIndexer.exe	103
PID 4520 wrote to memory of 4792	4520	SearchIndexer.exe	105
PID 4520 wrote to memory of 1184	4520	SearchIndexer.exe	106
PID 4520 wrote to memory of 5160	4520	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_d7cc74a333a09d753c75f3ca062c6d02_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2908

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1676 1664 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1676 1664 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9aa345924c0a8fcd46d2b7b09f9568ee7f08ee52671f6c38c39907491ca89685
MD5 07d8edf26d88bac349d160342e90f414
SHA1 c4df4942ea3de54dee9bf3eb2f4c2de253ebf5fe
SHA512 af289ac0bdfe2f0e4a97717eaa12fe68c4a945e07c8937546f21a8f1f6e2181fed096206c7a0f71e735672f0a7b545b5aad4c515917dae4334e00208c970229e
SSDEEP 49152:8b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnWv50A9:m3q6sjBV
TLSH
T170D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d769852d95cb09c41ba7db0e0ed7b280d5cd069b7c28302104e58fc3a76727d7
MD5 ac728d5bf469f64dc632381df418f12f
SHA1 fcee31c3adbcf79a7fb1af1c2c2fd7539f48c82a
SHA512 79eacde3fe44446027fb5a69e31dea96b961adc2488b40a5949c650dd7e04ffa0ff27eaad8ebdf166eb94e36ec4ba28ed9e8b4e3b7d1c9c2cb0e021bbc271d7f
SSDEEP 12288:m1XLsswWkxy2lRq2czA5CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:EXYfDtczA5GCxf7Gz3Q9At
TLSH
T15B05012573E009F9ED6B8278D8B1C406E633785187A0E7CB03A499665F337D85E3DB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 09e80c423216ed89989dc3271eb42e852915133521a6892a5e608cbd80edf10d
MD5 45e14444f7ce42d330b5136cc54f56e7
SHA1 e65f532df39efad006931752d59c39ef329d8681
SHA512 674d7a1167bb3a1488ea17d4a5893f6d8dbb7374ba48bf433eba49392482be848c1f5e415736c470db57db5e76afef146f4a0b0abb79948a1beb9b677dc03723
SSDEEP 12288:RXZNYVLeyUji0h90ZD0wxpGZIVuCrHsz3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFu:X0Le5ji0hmxxrMz3GCxf7Gz3Q9At
TLSH
T1EF359E16F6748335D073C0B9C5D2A68EE97230865B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5407e0af2b2c0ac8674b954e8139bdfc9a0805c4ceae87faf8352e41081f4811
MD5 a2948c62d4a8e950d39fed31f7a9647f
SHA1 5985f6f9af5a4699d9ce0928f1ffc8b4da0a7f7d
SHA512 509d3202d4477b63302bf18ef4ce429e5ce785bb3c9c2cae0fb94cf787900652339ef2fd70c31c29c231b7c91292480fb56d6c00e091cfcc19c4e0df8ceda891
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWn6q8wyu13GCxf7Gz3Q9At:k/ezSC6vUzPveHjys3v50A9
TLSH
T1C1755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b722442d2f4834ee12eb8c1d7c240cf27953f2e9fd0cc442810e97ab834847d1
MD5 d5f2b615afa2e4e5f5c0d8e0d5f1092b
SHA1 18767f086e4956a5315b797e6c2155a73fe497bf
SHA512 9780205b3d8666a9d47b64ea7ac2bb94e114aef1372b585d85f043d62c7afde9f5967d8f54bf671ea379e411662fcdf5e48580d045ac320d8500af57301ea072
SSDEEP 12288:bVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98u3CB/9u2xKx+8qYwSHnGKwwqdSx:bVbqPb88hv/l+Yu3GCxf7Gz3Q9At
TLSH
T179559E66F5748331D073C0BAC5D2AA9AEE3230425B31CACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 710e7ac53a973ee9d09411bb0a8a26ab358d512c389a7d029c327d0dd819cc72
MD5 87bad4edbad69a46bbaa946b8110378e
SHA1 1b0111d892873c0532d4d8ebe7333ceaff739f6a
SHA512 577f3719c52b99d0c4ffb252ef7c64fe68d8f22136f66c892ed810a18c4d2473a896683f080f8b9fe53dd5dc1e953e09b6ac938d056c2aaae0f57ae215b37499
SSDEEP 12288:cLX3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:cLX3GCxf7Gz3Q9At
TLSH
T10AC4235353A4968CE33C07F135B4B80FD616B9A1ECC2D25A60267BAB9737A11E6303D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 48d24ecca00a725fb460bc45317fca02d2370510f4bc3eb3914d7d5205c68ac3
MD5 06f3f7cc02f071e570e7012ff1c2acb0
SHA1 a1b18412d5d933ccd0a46664e481ecd239c340f1
SHA512 f8f0391d2221911607f52ac0148383834e4ce5ea5f016c9cb3def4098c218e9d4bdf895e4676bd1b4e576afe80d81731a26632336e9aefe0cdba34628774eed3
SSDEEP 12288:teBNUbTVO86UW3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:tJIUW3GCxf7Gz3Q9At
TLSH
T15905CF3BAE28FCD2C27E4DB866918600D77274708F52A3CBE165830EDE235E15E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c45c54e7d5250760498daa5e962aeb2bb48aca2d54937cbbea1e78ce48affcf1
MD5 702cb458f48b5d160e562e97eb2ba061
SHA1 7ada5762df140ebebf83a77c327180f5aa124da8
SHA512 a4806b6598623ecaaae134eb65aeb98191bb8d5589cb059caabdbdbf3412c5169f50b040d4dc46307015c6b9fe02c519c9b9a26927b99dabc78a445759d8aef3
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:BQvGAdlCEL8c/DRNw5Cl3
TLSH
T101266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5b19b6543fcff3a884917aa01ee0fe0e93542116fe1492f849cd34cc1591d236
MD5 c05714887dcd5bd02ef16c98bf8bc88d
SHA1 d958d358f993f1b97255b20fa7460842d14ec3f3
SHA512 e286f32001ccb22a02f3ed85a634d6ffb5f1f5825be5a083cd7e09bd7f7664d7222613ac75205398f839f20b9be6efc31f9b2a783ef1bc3dc05f793e733d1702
SSDEEP 12288:IAwSfxL/2Dc3RDLLmt0LDQewsAjQ3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqj:t0ewsAjQ3GCxf7Gz3Q9At
TLSH
T1BC15E031FA74E036C37F0DB22B35D706542DB9604F911AC3E3A89E9E5A302D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d58bb659f9d40acefb9df286489b90ef58f7322fe8f7736b473b5bf7c105c44b
MD5 5bcadbb7a32ef604f0892d7c3bd64737
SHA1 50bff079afa03895f6ccd05666a9f38865a5e3be
SHA512 67339d7c1e4496325ffa676e6cceef82ef1a16acd5bda3bb6304c32462dd821e7cf8717e1f6debe2e86159e667819ba910d0161160fd4cedf0a245ad1b9ea0f1
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHo3:dUEtQevvqc2W1cpV2tI32
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8c567d296d393164c98c8650d03af44e6c59b5a77baccc4c4919dd20cc20f34f
MD5 0108642c87e4a1c5b31224a401c03aaa
SHA1 58f1f554d2f725f9585b163c1fbaf54e5e8b5686
SHA512 c862928580cfdb29ebd1e7490f3aadbb872ccbabf2862429d81cdec1397e63b913ef5dc86e29dfbbe6dd766d6e53ec8826b7cb4ac52fcdc1315b72f27c681e16
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/zw3v50A9:WoquVjnmR3
TLSH
T1A7D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3ec8e2a87011f83e5791645a4d071976418fe0f03f39fe80d0dec7a739704abb
MD5 4541314a615960af6780c169cde51aa8
SHA1 e85028e3f8d8e81ed50366b39481b84d59901312
SHA512 549ce851b3c95587916a6589a47e229f0306490aa222cc493a4596fb92ff3bbf6d7abdc33547436086a380ee142e14adaf258fe6816fb485c56c649f0d53e277
SSDEEP 24576:NAhGL3IFoiwtA5l7S53x3GCxf7Gz3Q9At:NAMUFoiq5B3v50A9
TLSH
T17435AD81E7F955D4F5B3AAB8A9B69071EA76BCA65E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 db083c615af52f9b3272dfadf20429096f576d67bd7fa1bdb26c54fe00c26540
MD5 0b8517bfe312a52f709fe968f748161d
SHA1 5f525fa5ad9e4ab4792fb970110bc1c7f39a3d11
SHA512 6291a5a49579e79125c63b3b458aa40d7e9270edd46d9e7ca8554479970f6f61ccb8e0316788e4b000f8bd7d14c9550edac4cf8d2bfb0557f794a52ebbd8df2c
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CV3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tO:zwu4OWM3GCxf7Gz3Q9At
TLSH
T1A905F14673E40CF9E97682398597D536F7B2B8122A21D71F1360C65B6F33321AE39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 2fd40a72ddd8bf5a88112d98e6718ff0a8e2df1cd5d31b9c51725f8716deffd5
MD5 04ac3205a2287b122bbda45c762da694
SHA1 feaca9e95b65ae524aa95f6491ec8cb577b7eae8
SHA512 e789ff538d70293ecfe8297cd777de98d61e36fef21108c6dea419b8a4980042d15d74c1e8d7451a226bd13685d9864fbb4fd204af64ff665eafd56081295e80
SSDEEP 12288:WeZ1IyA3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:LZu73GCxf7Gz3Q9At
TLSH
T1ADE4125733E461F9D27A43B8A8F0990AD7727462AB7283CF112546AA5F33EC15E34363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d085c4f60a11f2379f8e6276ffa2907e09237cd6415b549531881956072d1282
MD5 6bfe8749087cdbd3082c928fd9f45f54
SHA1 db3935e76fcc1954c388b3316e4e62d286cc1413
SHA512 b521a09de1d916290f9875a8499830c34436b56f4d35a2532ccf4cc714f66110fe145ca9748e78debb29c7631ad4cd81469a9e85e4032ad7e9c98a9250bc6ec9
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:WQRQyi36YOcPbLvw2gAf+PN3S3
TLSH
T128667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 991f0b9fd7f3b2ea5825adf8535693f29ac271cc0845a33c57383c4646ceca98
MD5 0948c7bf53c3ea91167c3b6db908e462
SHA1 1b9e326299a5e4fb08225001f27ebe1527d0a332
SHA512 c2dd795d82227f34703c872265673096174d20b6feea107c18e874444bdf9ab144f6d95ab970f83cf38f7384bf27469eee4d24bb6b8f5fd335f69780e3770670
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:7QRQyi36YOcPbLvw2gAf+PN3S3
TLSH
T14C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 584ebc21305ef60e09fdd7456cd483ad70bd46ec15a86a200bb47a77d3f8af3b
MD5 aa324c737e0ab6e8f3085e138f9bb0e6
SHA1 748d126f3e361292805346fec20af3da82b00fe1
SHA512 f7e3d050a5de1d2742a2d5e5615d67589339c04270cdb3dfc31dd7255f94d1f2d96f043b83ebc674b99d56d33c7ae6639f79dab43bb480c2bad87f6be644e6f8
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0L3GCxf7Gz3Q9At:A68Qg55nhceWu7PNU3/g3v50A9
TLSH
T16FB54933B2F20099C45DE1769F4A972196D27C75CFE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b7686b76cca8c018cd624b0aa567ac22bf8601f46725cc8d265810fd312f1b32
MD5 e1e79f7e8aea807c6960449209781177
SHA1 ccdf46c9b684320397453b9e041187acef40fbfe
SHA512 e7ad17ec5cb1d7b7e488bf54eed2d65ce02fe1f2d0f6df6f16b26cf8c61fc09602f57e97d70179e44a27623e51f0d44b8842b91a5cdb2b7b5be8edac24acbc43
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99O:Hy5112gYy5azzVvt69nLKnhZX3
TLSH
T117167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f225b1cd03e0f9d87f46b45deb806a74ced71d687a51e7d199202cdea627f252
MD5 f73281c85473229d3b0797ccab799922
SHA1 270bc228295ae368ccf567220802bef80831fe6c
SHA512 9cc7f55d192d2cdcb24a4c4beaf37900de73b3ff6b6ba3de2bd215334e84cfd5af6fcfe10c037cd03daf5a576e60fdf5c1f8f6fedffed25a9cea5ba86bcf2187
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJv50A9:Ou6Jmdxd2dJ
TLSH
T1CED59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 baf222c7fef090503acb22aa5dfe5d340f097e825fca81d0cf13a6a106bc06ee
MD5 ec86c21ab6fb8f2bc265d1e81e94be3a
SHA1 d5c1d9e01b677b2c117dc9a0e077e3e71945b923
SHA512 33f74f713a518b969c93df1f1dc26ae558b8e404fe64c3b27e1272f52af53133929454238c677faf967d01a931dc421ebdf1160a1817ace3302190e2217a1b56
SSDEEP 24576:Whv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3m3GCxf7Gz3Q9At:W1hpsNoJpF1A63U44CwH7R4x23v50A9
TLSH
T1C7B5BD13F2D901E8D06DC17887569232EA62BC460B24B6DF0A90B7961F7BFE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b4157148223e5905db6380022c5a0f1dc1cb8ffaada796e27abe310db36e6881
MD5 507cd8e309aebebe0563e82cff2c6d0d
SHA1 c512eee9433125e43994a1fa308695a0ab27993c
SHA512 5bc99e70eac4aea8c58a1e5fa945514f1a64e47708cce3c433ce2292664fec21feb653a2bb987ff5401061de079e85008d9fe5cbf4761ee0e9553eb98fc5e376
SSDEEP 49152:BSuZQIY0Be2KcRVtOnks6NMHq73v50A9:P5dKii6173
TLSH
T1C9C5BE03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0ada87126d2f3224e8ec8392297d4242c9bb60be5220738b082897a3fcb29bb8
MD5 53dc11d85e0e974d97ebe2b745f8d338
SHA1 0d6d99ff3817b5afd77b2bdce03c925cd40b56f5
SHA512 a24252781003136a3f7272f93a13b71b5fca7b0cb41680025ba06f3d5d05e02721698a9cd0bae6d3ddb82641930c2437766bef53adbabf8a5ada73992290b700
SSDEEP 24576:KhiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QLm3GCxf7Gz3Q9At:KhtSn8EApI0fig3giDn0AP5wK3v50A9
TLSH
T1B895BE13F2D900E8D06ED174C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 64f68c13581ca6d662d39035d02b909bd7898d8a17fcda46de5e27f3b725a507
MD5 2a1908f2ff8f5d13a75e86ceb3a1ffd5
SHA1 09228d3cc121ecc80268a28398e1b54c8b7ff1c3
SHA512 6a06ed81d0ff6ed131193d125c645313b39596686354675f0b685d20540db4c1e07446e02f36cdd8621202549cd2f7547afa6e43d0e5b84d02b46dadc5f62fa4
SSDEEP 12288:Af3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:Af3GCxf7Gz3Q9At
TLSH
T157C4230362A5968DD23C07F17170A84FC61A75A6FCC2929E702B666B9733E5167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 97b182b581560b6371484909b74dfc80aeaf4e31d5ee9452e9a6a3d0b4a798bc
MD5 c8fec06accb2be0ed5e15555cf8e0e18
SHA1 5289229d8964990b1d3f51ff77a499adf3febecb
SHA512 1de49ce1ad27d7bfce8734a3b64a0a9db16a40686469df66a5643c20f41ff2415bdce0ccc4a7e3c8940948e90086c878735eff2c0550001631a756a129b3b7a1
SSDEEP 12288:dk3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:dk3GCxf7Gz3Q9At
TLSH
T172C4231362A5868DD23C07F17170A84FC619B5A7FC82929F702B6A6B9733E5167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 445b643f719ff413837e307c8ab6e9db387af0dbbd4c95f57b0dec8e0cfe0f5d
MD5 c405266d2fc2c90b337722373acbf80f
SHA1 7a45d02193da3dd9304ec738fe8457c75ee11f7b
SHA512 a9aaaec4ce20b61a5519ec8454b65a06562ac0ce08328d9dabe5b28f9f7b4b84e7f02ccefac536977e5b0c26d898618f77e70d6edeb9e8fcbcc4db71f2a41d28
SSDEEP 12288:3+3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:3+3GCxf7Gz3Q9At
TLSH
T12BC4231362A5968DD23C07F17170A84FC61971A7FCC2929F702B6A6AA733E5167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4dc762e66b8ab12fdbea822cd2619ebe244c2cc9592b05a188a54760660d717c
MD5 c5f851004292461b45efd7cfa1972d2c
SHA1 bd5aaec9efc00f1786e2ce3fe7ca1150395fbeb3
SHA512 24f4e1137ec53b9de21bef7d17efedb8ba609d4cbf352eb50f892b8ae8fb64eda4e9f29b3fa0bd6fa0022b472bf7e9f9cf201a19c8c1db78afe937116773a7a8
SSDEEP 12288:TVR3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:D3GCxf7Gz3Q9At
TLSH
T1A8D4231323B542C9D53883F1B571A40BD376B8A6EE53939F61121A9B4F33B906A307E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fc3ed49b922bcb28a54133b59c5ee3b63379b67c29d7d890130c17b1ce1655e1
MD5 b7cf8edde0d6adcbd62ff911bfb7b08b
SHA1 134771a9a029564631fb1e552df8bf79e85805df
SHA512 214f0288a889a8fe0df4ce605de1d99bb854adfe6ac2b3543076d84b7ab997e46b4be89f71b19f34adac8f7a38f87c9f3ea7fd3cbba2d4f9679b1dc359144e0e
SSDEEP 12288:op3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:op3GCxf7Gz3Q9At
TLSH
T178C4231362A5968DD23C07F17170A84FC61A75A7FCC2929F702B6A6A9733E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 fa967da784eba52df9b9e8717903285aee76f5af256385c7b90860e21ab99a65
MD5 ce37a2634cf8ff71083545ee89ff73df
SHA1 1864e0ffb2e66fb5d5e4456afa5d5a5b4e0fd3b8
SHA512 634e74b4bc47f29032b5263252bd900835d64dd3f4179ed8d7a29dd77884d098188cf23f909e7fd21b99c2b2dbbbf557dc8962a698d56267b6178c8458e30fa3
SSDEEP 12288:RY3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:RY3GCxf7Gz3Q9At
TLSH
T119C4231362A5868DD23C07F17170A84FC61975A7FC82929F702B6A6B9733E1167303EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6289b1f9cffdee6350b3d3a09f9d6ffcac5b84f88e1b94ad5b2a912bd0cb5479
MD5 50f7ad1e4afce36f42bc0763ebcb3f6b
SHA1 42aeed4e2f6f8973ed593c1047a2547c240cd275
SHA512 b7cc9c2a2732ede57aef4dd75d312ea3a5b077e24eeaf47a71071e369223debc7d75a9eae339b8eb9c4716ab56f67dd4dfceadb64c7ffe6d82544abb21e47008
SSDEEP 12288:jc3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:jc3GCxf7Gz3Q9At
TLSH
T1D3C4231362A5968DD23C07F17170B84EC61A75A7FCC2925F702B6A6BA733A1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 3baab8316c072ee5e83bc6a86529ef2d4fdcea0727a8a0b0f17f8c83c5d56c26
MD5 4e0e4e21ff0989c6b9d99cedb9105a05
SHA1 e539ba985e774c558acce4c3112995ff8e1d8c11
SHA512 a5555dc8b89ef63ee90aa782b1c4c0293648928c80cf4732475f4e52b2973ab3ae094a0bf3ed7c0be5419f49ec736e05726b85e72b51fbcb72b0179db46db5dc
SSDEEP 12288:OiZwbVzzFEoS2cPvyE3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:xZMRzFVSOE3GCxf7Gz3Q9At
TLSH
T1EC050295B39018F8EC77827EC9219806D6B27C6A4B60C61F13B436675F333A11D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 72c03e4ef029e2ca66eebd4acc6480baa930ad816377956ecdc2d325ec5b4bb5
MD5 2bb5bcb1b90e616e60baa08256d9cf69
SHA1 15ecec3bb33ad569040ad3c63b94c8f725e4d530
SHA512 ff29ce9d8157976314f574ce2f1bb7d4556f990c90c7a57cd3e9602316d08be80ec65d34e7f7280dc89528a2bd28f0fbb6222dce79aec65cb9c933ede079f44a
SSDEEP 12288:pr3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:pr3GCxf7Gz3Q9At
TLSH
T16DC4231362A5968DD23C07F17170A84FC61975A7FCC2929F702B6A6A9733E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9fa308548d64f401d70caf53c122f3f09b0271a0fc1d346be8cb98a02a96f166
MD5 284f2c3a8c452de1f18efb6c0ddcf812
SHA1 14a201c2698388029830b70340da1e88ab085255
SHA512 63218183c8151971ff4528740b1e92be712fd37e678c92de5033594f9a59594884f759c75e8b7bddc7c4e626e6f5f298cec0e3b5bc43c68d375321a9f404d8d5
SSDEEP 12288:CH3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:CH3GCxf7Gz3Q9At
TLSH
T1A4C4231362A4968DD23C07F17170A84FC61975A7FCC2929F702B6A6AA737E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 7e5891a166e29b96035b83c9b9177445fc1680ddc7c5ce4a82b329eceb043de5
MD5 3ce592f52055363b73a1400287e4ea48
SHA1 9497134279c935b5362342975bfe6e5fa41ae8e9
SHA512 38645782882efc4e712d24dbd110bcd38d213a036cfead3fbc16058b6e02e1aa36b0c8ed5186b555a273f9c6e4e07db2fc96d2b54a74df09b84e08092659e356
SSDEEP 12288:cyPz5L8A3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:FzyA3GCxf7Gz3Q9At
TLSH
T1B4F4020373A131FDD13A437598611906F776B8729B618BAF236407772F336909E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9129c9cf58c86dec2ca350257bd23d77125dd62785ce1a4c30d945d42ffcbc2c
MD5 799e2f916dd9be90ea290b43951e7ae7
SHA1 325c049c2c420d336fd491beeb0cdca70601d585
SHA512 6b28a70afe0988ea3bf9b8d7a87f0462245aa5555cb2c1da2b12b90a51db8c3ee956e69ab1b690bdcb9e897f9624c6d24dcb94ae06d728ab79d654df29830e1c
SSDEEP 12288:1r3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:1r3GCxf7Gz3Q9At
TLSH
T115C4231362A5968DD23C07F17170A84FC61975A7FCC2928F702B6A6A9737E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4fc301b6db07aab380177e0df9fea51fe742629d56fde21fece14d1a6846306a
MD5 2e1c4099b50c506428d2a41eee0fd225
SHA1 ffc5e36692b6c100b5896d7784bad53773710afc
SHA512 25b7cdf697cb7c4dce25ab026bb4d20da39e606cdb4c1728d404e3c5cfab2e2787d584252543e0f21031e11f1c913fc1f8aa8c643facac6ff21985cd5a88edd6
SSDEEP 12288:hr3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:hr3GCxf7Gz3Q9At
TLSH
T165C4231362A5968DD23C07F17170A84FC61975A7FCC2929F702B6A6AA733E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f95e919c2bc70b92f2dc95e21c23991ec2f4f79984f0aeb01fc7af466317804b
MD5 25990b0cbaa47e6cd7aa36cbf68b7da7
SHA1 0734dc558a04aa1f64a2885e0cbaadd03bef7a82
SHA512 56b5f9059b9faf9c5d47732ff3260bc3d238c7f9b843c47293160bbe83511c9dc206d9cfe851c244bed6109fbaab438e71c563d9130bfbb3e39a1dbbf004eaae
SSDEEP 12288:7yPz5L8A3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:2zyA3GCxf7Gz3Q9At
TLSH
T12CF4020373A131FDD13A437598611906F776B8729B618BAF236407772F336909E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 fb23d35915d3bb5582e55324e6264ee1f30c2121bf6fa6f045e8028a0fe2ae1a
MD5 eb5d7dbe97626b107f7817b1da55eda1
SHA1 e0ab8c3c88b97308ca416fa75e5f9ed18578681d
SHA512 da4173cf87acdde92df4761d6416c662daa39663d5b4cafd25f11cfe881a28d345ae070b33bac945866afc6c9a467ada260c96e20f1d5820d88256ac8fe1290e
SSDEEP 12288:/Cd9CWYoaLHF3z0z04PDvhO3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tO:qTDaLl3z0zDO3GCxf7Gz3Q9At
TLSH
T17F050295B39018F8DC77827EC9619806D2B27C6A4B60C61F13B4366B5F333A11D3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c4d5b045eaba351b07e11a535707837387311024c02dfa2341efabc89974e5a0
MD5 af99d4030361e59a94cd101b889ada92
SHA1 df868925c264a4e7172f426aa05d991729d2f779
SHA512 edcccd6b2df606a883198f58d70eefcac0b90f8169414359379be221aeeb9e7e518b66ec5826aaa42add55dec2d219e9864edfe379defe9d310a7d98a5f4d1e3
SSDEEP 12288:/i4e7KRdTfgwCHKy7GLbbdIvt3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p3:/3vd9CHKy7GZy3GCxf7Gz3Q9At
TLSH
T14725DF90F3E410E8F0B78A75C9725502DA767C9A5B71DA8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8e288557d4cb0e926fa5501542c1cdeda8f4bbea915f12a0f504c85ac46e7d26
MD5 e8c286e84d0f9278d641c4353b97d8cc
SHA1 0e3d9a55c30faf8ce13bba770e7a8e892d18fc89
SHA512 a59aa5adb6c7b5c4c07aafbea0424b997d83889f35fe71da4f6d52ccc82a156f0e4ad9e8e6327861220e5dea311ca189fb809a1e7174e95260eb2a492d61b730
SSDEEP 12288:le3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:le3GCxf7Gz3Q9At
TLSH
T19DC4231362A5968DD23C07F17170A84FC61A75A7FCC2929F702B6A6A9733E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 596338c96dbec183c573ff4c5695e50d0c236de0427cc321a26ad86542da36bf
MD5 dfa3072f90adea9790ab882ba1c86a1c
SHA1 6b73c6322c59905bfd976a717e1e4412e6e9ddd4
SHA512 6a6290ee55e46c1ec49467b98f0670ee206098db310a8634e95e28d3c1f22fb0897cbb7ecb99daf2e5ac7b140bd124ef0449c0088382ef79770fdb6e7d7b04d0
SSDEEP 12288:Xg3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:Xg3GCxf7Gz3Q9At
TLSH
T16EC4231362A0968DD23C07F17170A80FD61975A6FCC2929F702B6A6B9737E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 bfcde0d331b6d4cad7d2c09c6bc20b2d322f9967d2330423bdd735d1727d593e
MD5 b692da2f20a6d2b6b01a0cdd2302119e
SHA1 d3cc362163bf46963d90e40f55a67f4bb1a0df37
SHA512 3fcdeea24c8350ef865504911f674bdf2ec38c9292393a83d37561a1ce88934cee575cbbbd5aa638a0762d72884abd344b695c55c9894edf6f8dd9f741aea03f
SSDEEP 12288:st3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:st3GCxf7Gz3Q9At
TLSH
T1AAC4231362A5968DD23C07F17170A84FC61975A7FCC2928F701B6A6AA737E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 e0506543429b7fbc62a43532f98c4d681b37a7e0509d8754d7486d7d2c9a3f2b
MD5 2a31ae9e01575c7b711094f4aba42b22
SHA1 285b61f4eb2460423f97168dff35f14c8c67a989
SHA512 b94614683aab05c0816f614c1c3332b95900b5d8d6a9e95a1217ae02e2304a949bd53838f8bf722f12d56fabefa9768bc8f8601c51cb6c61f48b07e950429624
SSDEEP 12288:Jr3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:Jr3GCxf7Gz3Q9At
TLSH
T1E3C4231362A5968DD23C07F17170A84FC61975A7FCC2928F702B6A6AA733E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 4c12f91b7323ffb9fe27ac908d335cea3a27ef583a6fa39b90bfad13c8d9fe9f
MD5 b93fa04535459646b0320d1e614c42c8
SHA1 379e6b90ece3e764bbad2310dbc1339888a32f5d
SHA512 065bb454ec2407941c311ed876d7a6f6a54b4f4019ad4a3fbcc460e7a8e910520d106197e86aa0c544d92049f097a24beef20b8a85518d46fcfe6d865eef0ea5
SSDEEP 12288:Ge3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:Ge3GCxf7Gz3Q9At
TLSH
T175C4231362A5968DD23C07F17170A84FC61975A7FCC2929F702B6A6A9733E1167303EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 f3810bb8e52f113ef816dc85511978c980a596dac3ff49ab2825465b63c0ea80
MD5 36f0be9e026dd895485990df863b5994
SHA1 2d6d19e75e593982bbb1e6283d39c2f10c99fd66
SHA512 d7d6911032b61814a43dcf20f4e1d6d919824b53d10a78a9df0bb4540c63b51170fce0502700919f9345bca2a2623e8eaf454cfc24866cdb99542fc189e539f7
SSDEEP 12288:0D3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:0D3GCxf7Gz3Q9At
TLSH
T1E5C4231362A5968DD23C07F17170A80FC61975A6FCC3929F702B6A6B9737A1166303EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 072be580352d5c97132f7c079333c6d96ebe2d93674ba0baa0ebf2d2fff269ff
MD5 871cd6ddea8ab214086de4d375e80b84
SHA1 859e2fa0add28a2915d7d83a083e39f4955bc2fc
SHA512 f433da9daddee05076cc1858cf35aa268bbca364d57834b9f2dc975e73dbee0e98c4b4ef77ad1065e00412a766404a8b7bf20186b4e84abf346b248eca4c2249
SSDEEP 12288:up3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:up3GCxf7Gz3Q9At
TLSH
T18DC4231362A5928DD23C07F17170A84FC61A75A7FCC2929F702B6A6A9733E1167303E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 738b6a2e43a9afe0b4d5137153829e2d83e6b891081d2767f7b3147d66e29cd9
MD5 90c9bbf54cdc4c520a7b5e06843d1992
SHA1 e09df0a2bbed69b134daa41f9628ee93c7521c2f
SHA512 bad907b6bafa3b30fa2749d20de8c5682b3b33824fb3b5955032b6b68ed98cfca0d61ccb5c2ac09c95f3ae57070b4286fbd9b95e34340056c9acf9d0858a32a1
SSDEEP 12288:VG3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:VG3GCxf7Gz3Q9At
TLSH
T1D0C4231362A5968DD23C07F17170A84FC61975A6FCC3929F702B6A6A9733A1167303EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 574a7aacf21168d47eb764af25f59bfbd555fe12c2f1831334e92016f81639d9
MD5 9fb2ed970caab85cdcb6087ccfb0462b
SHA1 b4c9275735fdb3f82bd589211b51940c5409119b
SHA512 633a90a641f64e691f3f326e30960ab467a96ab4c4e67a8b56d9b5c19890ffd9daecc5e992916ac7a4291a82a238fa22b51c3514834057edc12218cedb224718
SSDEEP 12288:qfwvD5ur64Lk3tRX69qkyAI5l3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p3:qfwvUk9RX6wkyAI33GCxf7Gz3Q9At
TLSH
T12E35D029EBDC44E5E177923C99B3460AF2B178691B31C2CF125A53AE0E33ED45E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e50b8fefc8a68e01fb90ca635f2fb088774e41482161e3b2ba1290e2c40edc13
MD5 4c81dcab2524fc17319ba76f98d4f0cb
SHA1 9670a01734412937fc8192c7a266b5ae9cb9b2db
SHA512 5d211e1313abc1259342675e3e0dc639be3c0a53dc628a865d8064dcbc3637911a6347f29df7707dfecf2e5e7a41f8e9bc30c30f735e8c65971e4aaf856ab94f
SSDEEP 49152:OYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0q3v50A9:9ySzPy3
TLSH
T1E6066C57A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 41fc67d862e0d153c6ebe83d913ddd4832c5660de677e95dc82427b634343649
MD5 3c079336b7c2a37d45638a2ef2158677
SHA1 486605bac1ebc0e55925888539aa75c428b5bfa8
SHA512 7f669296e990822fb2d4a0322138a2f06591c89b7a20cd78eff45c638fb3985867237639f25a8a1d2947f9c9a1ba89a2504b18ad9bb3ff15713c5d1bc5288780
SSDEEP 24576:C47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY03GCxf7Gz3Q9At:C47JUQjTirIhCnDHUPfF/a3v50A9
TLSH
T19765AE1EA3EC01D5E1BA827885154A5AEA71742E5F32CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 1f2c7daf132ecf981354273aa704f847f1093250a65ee2dfbc14008a4b14e563
MD5 3ad1b6092df17f03fe59562b3504074e
SHA1 fa064d0622cf3e89acee182df0711346068e3285
SHA512 00a7bff1071ca83261b3e383e935fa5a97c43983f96dca2f86d7a77d2d0d3231bbba3a2dea3097ae6387a65e2786577dd502511f876399f053aef4cd21282157
SSDEEP 12288:rbsf73CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:e73GCxf7Gz3Q9At
TLSH
T11BE4F10AD29802D8C06E52B5D7619A05F3237C6597E2D3CB62D0F53E1F36A909EF9783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 908KB
SHA256 23b95c65bcf2e96b0a1e85fa990f5284a5d1ec0ee6a4db51fa1701afda51685d
MD5 db19a0d09bf47c04bdad798e8050ed71
SHA1 d3bb80a3141c1f4bdf295dd6e31226e43346d232
SHA512 d44f70d2bf5438bc1c462663ecc7b51db3a1675e2420a36960d72ac66b29010a860287a0da786d7761331f05fb52b3a67f1cf9f04fab5aada536e0643bcc15a3
SSDEEP 6144:8sBC2na6eMSIzW3zwSmotMxr3sIU3fcko1FoWVD9tEmhUDq+Isyq4DfskFvLAVEp:Vx0iU3fQ1V0wfxLA6m1q5bfs8KDsLG
TLSH
T1501517107666D74FC6AD40325E33C5CCABB07D01EE45AB0372C9872FD576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 3d39e56022737f3f2ff959355c71b543bd5572ce7f8b62b967e3b3b497d6d191
MD5 8f93b126a4cbaba02132d7675d2f2474
SHA1 877df0998de5cb94e3ad2553bb56a8af0ccbbfdc
SHA512 e8a2e7f41b6c25cceff9552f75c264c63b2b2bc0113fc006da75993b15115958f0a00c8f0f9c2b9f826d21320e82c9405c9346202c11110d681736acab5b76a4
SSDEEP 24576:ORU0S07LAFbvb89/bt7hFshRM9yD93yU2VMk:oS07LAFHS
TLSH
T15D65E6409537A3CFD1BA6032472A5B4CBBA4EC0677456F23B3C8453AD86AB15B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 22d331e3a18a3a64c3444ff8682324b3e39f3c34d36aeab49edfa362cb612c7d
MD5 fc875f5ca6558bcf8d7c44e1957e063a
SHA1 bbf7b21bfbe2c5724b17a221cf48aad5214e81b9
SHA512 a4ec9cb9327bd37ba03278aac6c50353630e9dbf194923422ef2044642067cb0c45aff4cdb239bc9b19368fbcd2c922c1bd010b201e9e35040a30a4db126965d
SSDEEP 12288:107T3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:eT3GCxf7Gz3Q9At
TLSH
T1F5D4231353A89A4DE13C07F03175E40A961AB5B5DF81D1DBB01666AAA733EC0AF703DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 43f9f4bf9496d53e22ed75ea33e608ca427ba8058d4ee46297648e5cc8d629e3
MD5 0c0ef6301542b952f9c850ad8b676908
SHA1 7d1ec1db6dc24fa5eaf78e96c6abdbfb86337a14
SHA512 90b1e2982a4038756817377f25b2c46cd6579991e816a0e5ef53fa60ed5e0360520c61462071aadfead104e7b0c15c5708fdbafec52e911c98c980e8357c8cea
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bY13GCxf7Gz3Q9At:3gb4mBIBhGF03v50A9
TLSH
T10F65AE1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9100d04688e1d461e575102bf8c2ad2cdf75f18271bfa25631390a2378c99cc0
MD5 7a361dd3bc23b7ed1692942faee348c9
SHA1 a5d4e5feb710b9afe1e72edc7ab783c6a4ee72b1
SHA512 5680f411b0bcffd872ffcedb694252b9c5015fe5e32b5d0f1a45d59e668c9149a7e42c94071b9678ae91bcf4a4b0131e790c75d0ee77021ea6bec0b43dc080a0
SSDEEP 24576:yG88u8FpJqH1bzria7/mE3GCxf7Gz3Q9At:p7ZFPqVea7/N3v50A9
TLSH
T15335016677E001F4D47BD13889924667F6B2B4250360EBDF06AC8B561F23BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8d60807bbd7bd82afd84e7cbb54351dd2618483c1523454bc3fea62a911859c4
MD5 80e763baba0d381a341d7065aefe5e71
SHA1 6f2b6e6ee5bd8a8451976b485fef2c4c0e04624b
SHA512 8b9c7a738269b98dfb112c9684171522c5e1e4e87beea9f8b0c6b6c50b65114ef29f86b946a4cf10cabbb0409c9f690de1439c03284a63508a529992f7b03989
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjY3v50A9:oG05lO43bP3
TLSH
T1FAD5C06A62EC11F9D1BBC17CD9C64A0BEBB23425033556CF02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1f976875ab077731ef5bcc85e570768d911b07c7a78a9b7e8fdd5038dd64ee26
MD5 ce356a4e21369ac656e5f5ed9ae238a8
SHA1 8379f47be8e7218984c347772bce63376911936e
SHA512 4fa2128d4d9333cc0f6387bce717c29b2fabcec3b1ae31f0c9b2fae46b1bda0b8b0993821afbaaa9f06642af6504b3f93cda4ae669123d11666082e12030c2f3
SSDEEP 24576:Tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnq3GCxf7Gz3Q9At:ra5POZ3BJt2pasx2+mg3v50A9
TLSH
T13265AF5EA6FC01D5D179D17DC583861AE5B1342253329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 51944af5330acdf0c1b5310ca3213a51d5a89f9ac9807b04849e1be71890f59e
MD5 5c67956cd4d5e248f86efd43dd9d1bc7
SHA1 41ed634488ffd9505c00778e91016471dd99a1fe
SHA512 b002ca8e7d146a1b4e0a15a1c18757828a7061d06b355cdfcbe3a7f5fbf88f6daff6e9efb88df5522771556de8f4eb77728743e6c1199455ebd7388bdd6feb4f
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fks3GCxf7Gz3Q9At:FNc/zEOVHFt3v50A9
TLSH
T165858B2623E901E4E1BBE1BE89779546FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 00a3182d1c84997a6035e77e77706ba672f9acee89ca6aa4f0731ba0c1010368
MD5 da46059dd3efc2f6de54fda3dcd88205
SHA1 eeb8c5ca3cce03553b8327b80a72bbde0e811bc6
SHA512 5b248b99bc8e33e771eacb5f25a0f4db45f68fd22cffdfb5d9387a3196072db1c02c7ed0ba08b5154660946f8f30d01792d8bf69131e8568634f9f810e08a35a
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmtGCxf7Gz3Q9At:9TMwBtOmtv50A9
TLSH
T11155AF2EB6F846E4D1FEC6B59D238512EA727461173293CB5290C13F0E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 12aedf1cf9ea69670f0125289efc7c7e9445b6f52d9de486e03d25e050233b04
MD5 ec707796c76cc081539f93114c07f200
SHA1 9d156d4d3446be5ab3381adcbc0a674247d2b8c6
SHA512 b8df77f6d7cdcb63ae416ce8f385bb86a1fbdd032809c68be4b68c77290b995116e046709b966354b9ccc015665bffd40b00294e49f69221b0345a88a8b2146c
SSDEEP 12288:7HvUrBFrEjwaQI3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/p0tw1:7PUr+NQI3GCxf7Gz3Q9At
TLSH
T10905F12F22E818D5E67AA17D9582860DF772B4625702D2CF02E1817E4F33ED8BD39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 6da207896b85163b09b2befa3cbf19223d37509b7a59ba4287eadf2953a9ac26
MD5 6e63ca7c05ea13939542f2bea136d0d1
SHA1 ba6b76129e01e118ba4e4fbed5eadfc4d0c59039
SHA512 29ea06f1563e5cbf871c12ae5ddeddd4433480842b2f3c8edc863bc57f845683245fc272daf884d048e8dfedc69f9b3c6d4ad014d8b20ebeeb2a94ee1879b177
SSDEEP 12288:mQcMxWDXN1Dp/fshBItT1IQgA/3CB/9u2xKx+8qYwSHnGKwwqdSzY2laFeFyqt/Z:cD3FHshBIYQgA/3GCxf7Gz3Q9At
TLSH
T17425E13EE79C04E4D57AC2BCD6638907E77138A9032266CB119481BA5F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-54-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1100-56-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1100-62-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1100-274-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1160-8-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1160-0-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1160-6-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2604-66-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2604-288-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2688-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2688-14-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2688-22-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2688-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2760-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2760-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2760-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2760-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2760-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2908-294-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2908-87-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2908-292-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2908-81-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2908-290-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2908-88-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3816-42-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3816-43-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3816-51-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3816-206-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4476-114-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4476-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4476-116-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4476-108-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4476-107-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4520-295-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4520-125-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4520-131-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4520-124-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4732-102-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4732-94-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4732-291-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4972-306-0x0000014AA6B20000-0x0000014AA6B9C000-memory.dmp

Download

memory/5616-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5616-70-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5616-69-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5616-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5616-289-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5616-307-0x00000000007A0000-0x0000000000800000-memory.dmp

Download