97178dcd51532bb25d400c717531ef2b52526f98608dd7c7186537efe688e15d

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 4.4MB
Sample260714-2l99lahs3t
SHA256 97178dcd51532bb25d400c717531ef2b52526f98608dd7c7186537efe688e15d
MD5 16559f5cc4a2a045167115afd9df9133
SHA1 d01edfd4cfba10d504d4deab05824ba56d92786f
SHA512 2e587040122c209a828fa56c8414c67dc92cf417ee25dcdf086d014929f30e48a7f763d4408611455994005c5b06d4996e1fad077e5a20d3d54222388ffc44ae
SSDEEP 49152:yW4f/sQGQwY+GH01zFyB/c5KgGRy8BXgfJ4klKXnO:y/spYypKgsifJ4k
TLSH
T1C7261A53E7650DE2CA9380B0CD776B22CB96BC7C0BF107737B3246CEA8666D03569A45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4240	elevation_service.exe
5064	elevation_service.exe
1448	maintenanceservice.exe
1536	OSE.EXE
5668	PerceptionSimulationService.exe
1064	perfhost.exe
3788	ReFsDedupSvc.exe
4224	SensorDataService.exe
360	ssh-agent.exe
5448	AgentService.exe
748	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\47d0380f8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055ae23f6e113dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006535ba34e213dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5350af5e113dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a60cd134e213dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004468f8f5e113dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1164	2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	4240	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5448	AgentService.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: 33	748	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	748	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	748	SearchIndexer.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4240	elevation_service.exe
Token: SeDebugPrivilege	5064	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 3456	748	SearchIndexer.exe	99
PID 748 wrote to memory of 5656	748	SearchIndexer.exe	100
PID 748 wrote to memory of 984	748	SearchIndexer.exe	101
PID 748 wrote to memory of 3504	748	SearchIndexer.exe	102
PID 748 wrote to memory of 4260	748	SearchIndexer.exe	104
PID 748 wrote to memory of 240	748	SearchIndexer.exe	105
PID 748 wrote to memory of 5956	748	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_16559f5cc4a2a045167115afd9df9133_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1448

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5668

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4224

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1884 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1884 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ff9d39cdf9031b035752d66c30e2d3c2b5a91bbdd8553ca556861d173b8b3739
MD5 a339428d32bfaab7b4d786fcfd8c49ce
SHA1 933852ec4c76a8de07884f00b1be3920e5009fb4
SHA512 5794d668391f7c1f6450581998b7952d18dd944a34c7e680e5233e67e062deaed2919d246b43bfd2ad962bf6ee962e74e78129dc3669dfed41fc48334b5942e1
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8fJ4klKXn9:G3q6HjBrfJ4k
TLSH
T1C3D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 2cb892485b096495b2748d31b7b7dc1cb251eea8d0e36a004129c65c4e7474ec
MD5 37442aae8677da69af83db527b2120c1
SHA1 23109462a00c61aab3f8620f2077155542807863
SHA512 8d283f7e980484ad3686babb134117e875b047d3de717d93642b73354c40ddd5afcb1008a4480d13512acba02862121fc0f4d1fa55f16be4e4b299be61950581
SSDEEP 12288:L1XLsswWkxy2lRq2czAffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:xXYfDtczAffJ4yL/tNCJPXUQrPv
TLSH
T10705F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e035106f8090f187a66fec6a3802e6cb28067c2c3632a2413862251fe3a796fb
MD5 46544eec94f35cf0c9df1b2d9c3e857d
SHA1 83caf3fe31181762a4e25baccebcec73d2fb7310
SHA512 8138520f21cca1717e8ee0fcc1df84ad00fbe23eb612503229bf85b07b6adf129f2c178078db5860afcdf5da45998391afd97e5b1e817b6e27e38a4d57e1cb12
SSDEEP 24576:B0Le5ji0hmxirMZfJ4yL/tNCJPXUQrP+:BPji0AcAfJ4klKXnm
TLSH
T12735AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 483e1a81f999f2bb7a4ac510f3f39aa60e62a137fdff5665c2fef93ff5cc5dfa
MD5 f90aea3ce00621ca2bdb29c4437506bc
SHA1 c5292a70b117fe876e6a05cf5c90d3f9b1c0c0a0
SHA512 0c14f090f3a8bbd3959830eabd6a48a9e5c8b84957e7e2c44ac3005bc9fac47552f9e7bcfee765d42330b87884daafb354ad488b7cf22ddb5455590076b5c31e
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyu/fJ4yL/tNCJPXUQrPN:B/ezSC6vUzPvxHjykfJ4klKXnl
TLSH
T14E756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 99e9de2f381b026f6f3cf98bfd9444dc47270c9ce046e4f7b12f92921882db92
MD5 5c9aee2132944a8ee2c6c229032487ce
SHA1 75fcad83468ede1ab7bc98518a25dc4c75a9e217
SHA512 3b0fbb8965a3d50574e3b83a26b710da688f376c690112754d23d042a8bab6caaa5bcab6ef340a01234f6c1eab9d8988893a272b7fd4af4c6e4da2cab9441e36
SSDEEP 24576:RVbqPb88hv/l+6KfJ4yL/tNCJPXUQrPy:RVO88hXl+tfJ4klKXna
TLSH
T1FD559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 43762892b6428e12d91cdfcab430cc792a4583b65959b78e5d5e4fa3a0866c47
MD5 9ee3d919b6c8af1d63f89c67786502c8
SHA1 274dc7085bbf5829bda4012de10e3e1501caf164
SHA512 8c93201eda27fd6a0fa2df8af811566f90434f620ea57bf96e66e9cc1f77e91e38029950319b857b623475dc9f636d2e1cc020b5304095368a37303a8ed553c0
SSDEEP 12288:MRVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:MRVfJ4yL/tNCJPXUQrPK
TLSH
T16CC423E751949486DF6687F82A88F001C704BEC5162FA2F6DE82B8C53FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dcee51cfe7d6c04e2df30d1032d7280b3cf518098cc3a3ebaf5fe2338f4603d1
MD5 cd50cb280346cc493bd5ca630be99d96
SHA1 7e5586f326250eaad5aab24ad3d6975d5e713827
SHA512 470bc54fc1a165d37dbaf3973d9e8a5a9744febace6783c4a04802ce239a153359eba78d0d73596b491f98a6310e942a8a7daa7b75381904cff999ce8eb77150
SSDEEP 12288:DeBNUbTVO86UifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:DJIUifJ4yL/tNCJPXUQrPB
TLSH
T1E405C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 38db69979dfd57fda1388ad26f288e69a7544ea3afdefc8879b39c6049c5ee4f
MD5 e82ae790902d5d2f55a55b87a1311ff0
SHA1 cca4eb20bec97c8eb93894f3fbbac9462e27e2b1
SHA512 9a744240a2db2b3a6a421fa675f93c6d770065edb98ac3dbcd209a07b685f720f4665e093e2d920b4a7a1efdeba7744a04d084a4d107e0334e21f423a84c2c03
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THU:0QvGAdlCEL8c/yRNw5CPfJ4k
TLSH
T179266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cf3df67333780e6f5873beb27c43fc960cdab1a55ca46a931e6fee5f73c3fefd
MD5 b2399aedb88150bee2ed8293917187bf
SHA1 0208513efdc21e8a365a73c3d33be5a4df4890a4
SHA512 1f2598ada8cf561b53a3b953b907d1a4231957cec0b3b2ec5fc06094fbddf2567027786f22d658d1a27026f41764a3822c8a28e23fef7dd6c114fac7c04b2507
SSDEEP 12288:nAwSfxL/2Dc34DLLmt0LDQewsAjQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWE:AdewsAjQfJ4yL/tNCJPXUQrPy
TLSH
T1D415E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e551bb039037b449a7d68bc2bb08cba49b0b62c0040b95d15820a25692656cd9
MD5 e3190950291eec8c5a0d9d9b94117368
SHA1 98397eeb8fb3c3cec7df82203bda1777346d0e06
SHA512 2ec31d2ecce849ca30eee3a5f511f901f559ab6cb7e0d7210341170e1d2da79806cab85200f1c6faa1f9452a674967dac12f2d552d738bca3bdafb013e9d21bd
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYfJ4:tUEtQevvqc2W1cpV2EI32Y
TLSH
T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b7aef465c9460e1a6e6ff90149ddcd84a0ebc8d333c9c2641875e1be5002f104
MD5 d8d20549357a52d4b5b09df4a748647c
SHA1 09483ce0405032dffb768787c2d56a50f07cdd12
SHA512 cdfab90c3884caf427ed9794998e927954ee7b003258cdc16bf0625f17523b6e8d3f5fe2487cc0ef4606732d215a45768676175e07878183a8bb97350e163220
SSDEEP 49152:ICbRquA/m2yL5zifFiV+XenmE3/zwfJ4klKXnp:hoqHVjnmzfJ4k
TLSH
T17ED58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 38282d5b25a5d61fb4dfbfc54acd588da7ef45aa34b6a4ff153b36a152fd6f70
MD5 7edaa2a12740c252ea43457d6f9228d8
SHA1 d7ef95d48abf61713f101755e9fac9bf7b56f2c4
SHA512 53da1c25388189b239f011ecce1eac8fa80626efc3df8af4be2659122048c4daad5eb8cb55ff6e1a78e10669f20d78307aba09e25acf14babe8476884bd6fb73
SSDEEP 24576:OAhGLJIFoiwtA5l7S53TfJ4yL/tNCJPXUQrPl:OAMyFoiq5DfJ4klKXnt
TLSH
T1CC359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d2fa32b3cf315850091174b58d5e07dc514c0698aae3cdbc906c6b3fe3c872ce
MD5 1065cc40965df761a6a409eca08b3214
SHA1 b9f405131818d31d4763a21094f00ba3409533ae
SHA512 a7b2bafe0251199cb82cb5dfd5e49a189a05c577a128d923ec716b8760bc281b85858fa2a004a76d0d05d89feb72893c70748f0e7d6755c06731bd83e000092f
SSDEEP 12288:omw5HEjsChNVBFgl0WDm+CqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTU:FwuoOWdfJ4yL/tNCJPXUQrPQ
TLSH
T1A305014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c0b3a9a2ea94083309c6bc197f85c07e048a589cdae0f0524ec80bb706d51e03
MD5 e81edcdf5173618f4e1a0dd88ae9b1d7
SHA1 b0402a98b7d3a88d17e44ee621ffaaf64a65fde0
SHA512 af88f23f47be220d287d8599cebd3c9313908fc0775eb1305121589a99a8d44e719fabb7d0101950a593175a9a0795dc8a21d3d162c75e8bcae5980a6215e4d0
SSDEEP 12288:6BZ1IygfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:0ZuRfJ4yL/tNCJPXUQrPD
TLSH
T133E4129B32E460F9DAA782BC89D4E101D3217CD2273A43CF5A5155963FBBAC61D3C322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 796121b0d7db1b5e5d73b22fce61584d130e6a662b8aacac03e0536d262c976f
MD5 e4ed5d7addf922433457db5593115316
SHA1 2b34cfbd265636b469d2a2eae0b23bff69327cbd
SHA512 86ac1fe5618469b97bb968be1dee0003ab9a3fae879c012f01a721d572e6f0d3e540d4d6694fbb73c01f7188d3870e3ce9d781db3dc4550e2d68135acf91c37b
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:aQRQyi36YOcPQLvw2gAf+PN3mfJ4k
TLSH
T1BE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b421fad2b830c736ef0ed7d3539c59cc883cecb51fe43dff1f995e59c322d8ca
MD5 9bdfef3ca05d80264055d0b0cee7906a
SHA1 b429f167b5cee7c077ff44672ba65515d977cb02
SHA512 da5318514800e0ee9eba8e2a2a8a3b03e717840f6a62b3b705811ecd9554d91b2cd6a6695e5ddb208e45cd3d2af42781b954755a067cf9c28072afc7bf27f9f1
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:SQRQyi36YOcPQLvw2gAf+PN3mfJ4k
TLSH
T1BB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cd7c553da3e460fcf466d65889aa89778011257860aa10f8f675f5d4ca543b73
MD5 3c0e00bc282df004ccfeb790227b0473
SHA1 bc11c1bb07ef68808180cbd94420916076db1f49
SHA512 037de0758eec84c8e5795876d06969eea616cacaa97efb1a58df1ddd13499fbc53e4d18c6ced73d74dc1b8cb875adf4d0a7577e11564111738f95aa7680917aa
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0BfJ4yL/tNCJPXUE:468Qg55nhheWu7PNU3/AfJ4klKXnb
TLSH
T1F8B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 20e705561c447b8dbf3a02e78aa3f4e742cf2dde272814bc58bc524b3c7a0c78
MD5 5185a1c017950dadbc1ece2336073b1f
SHA1 9dc7e325c5c0121f723ae823fc713b9a805c0376
SHA512 aa10d31764b8655317f12bbd0105af4d83d36b7736e622c2831572042727229026ca4db107f079ada55a8934b395c551046168d9c0ec2ccb8e4bf1a5203cac60
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99S:Jy5112gYy5azzVvL69nLKnhZVfJ4k
TLSH
T188167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f8c002e543fe8f17d1f3243fd430b62cf89036534f463669c0a8bd44e6de9f5b
MD5 36fe96e3e50ea21219049af8db6397fc
SHA1 d4506971f681492e4396a7e87d5b7c22d67bd41e
SHA512 40fa7687ca0348115dad003638542216574e37333528cdb30d243c1812914dd05ae41ff46b5925f2d9b67bc39e30ae6b0d82abf1ecbb6317cc61a1f8affed2a2
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glvfJ4klKXnV:Xu6JmVxd2dvfJ4k
TLSH
T1E4D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 097935f48e7677551a701f00d3bfc8585981759b05b8a0ba09b47c89333ea1f9
MD5 50993a1be3dc42a2d8305551da37be59
SHA1 09d3986ba9eeb2d830094e839256ca4a4dc1ce9a
SHA512 b8b78036c1349921b75c12be302486ab2ee07b459d3add8f9ebfa0966326a3564e6ab9af06cf3e27d81a3a56d8af63f5b6d061b2131625d1e4bc343daa7d3fec
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xCfJ4klKXnF:MmifPbRzfJ4k
TLSH
T1B9B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2178cfc065cca1bc70122a4f46ba7267f9eee10a1dfb3adb09f7b472037b13f3
MD5 2a2bdf62b7cf07a772ac4bf3b7099392
SHA1 357d7fef36b9637bf3a4a4efe5ebd378bfb610a0
SHA512 326bc2efaf0ccb028f4d496b0f04e259bb3916bbd4ba24b122f2da3bd5999428fdc7bf9ed225a705518088bfec956c860267c368f37039855343d236aa85cd0a
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqRfJ4klKXnq:/5dKTi61RfJ4k
TLSH
T1D5C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b7ec11b2b9dd7bf9d9725c331f12bdfb833c17a97841d6cf425ec22412904a00
MD5 73a9614c1cacc39f5098ce92f9688813
SHA1 e3d3e6a819f5db285d68c914a8000dd9f0cf12f0
SHA512 d8926003df00be85978c1e51b75ff4ac7b5207c297fb414c1a741ff04134992b7ba8b079fb5620cb9dde58ac5b5b8c5e96a0d6fca1c569706017bb74499e7f72
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5wOfJ4klKXnR:GX2iyphXfJ4k
TLSH
T1CF95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 7a39c2908a46951802addf2053f3807ee8488f879a4fb00c824428a911521a18
MD5 199b4ef9c339abbc43aae0693f36b418
SHA1 9b46ee18a8935b902fae00c6983f6f68115a888a
SHA512 c2e2306efe38ba132b90c9dc605e755f04b660f098d86ea2e555159eb2ec122f93561f6ee1acdaf4773a4f782867d940c6fca032a9c6eeec0b2265ad4c45f6bd
SSDEEP 12288:2tfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:2tfJ4yL/tNCJPXUQrP5
TLSH
T120C423AB60D5948ADE1587F81688F001C3047ECA672F62F7EF42B4817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f59b51afdacea70425318969bb89236575e6e2368d0714ec4786b12c9ba70a36
MD5 ea89c044068d098408ccea96bb0aa7cf
SHA1 84a49ce34cff39812461b4eb0977c5dbf02a0202
SHA512 1e5d304154ee4de11e090e34f8fd8afadbc2df5af006e956ebb764b87ef182f7eceb8e04b18996740000993cfd190f0c76bfd5f0e3ab2db6d3701d2ed8dd372e
SSDEEP 12288:6sfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:6sfJ4yL/tNCJPXUQrPw
TLSH
T164C423AB60D5948ADE1587F81648F001C7047EC6672F62F7EF82B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 578d7349b6445c1b442b2ddee7c0be8b063af5ae0d92386fa6bd1f6eb4b7434c
MD5 a0f3f65bad8761dd2217710ca551a542
SHA1 349ddb94e7e3c71ee3472515c363162bbfd8e087
SHA512 0dc96e7a1d808663867b065c0fde70df3c9a6494ac582255e8a611f9d23bf565f1145496c549e3ae7613553b90dd704fce52b2dc084554a44d80d512611a8106
SSDEEP 12288:e6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:e6fJ4yL/tNCJPXUQrPk
TLSH
T1FAC423AB60D5948ADE5587F81648F001C7047EC6672F62F7EF82B8813FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 894890a390af446a7724182dd8e9a84c850d378d6da38e868355881af5a3e9de
MD5 38b1d5cb1cb12da5572c9913118dfac2
SHA1 93591f29e0de085dc2e796fe15c03a1f097ebcb2
SHA512 059f29c0240c525b534cdd93b9304836051c97183e7b07c797b588eba31857fbf30d7e09da1ea15025abac2fe32b4bd48859175de6114ffc843947e07c217fdf
SSDEEP 12288:4VzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:KfJ4yL/tNCJPXUQrPA
TLSH
T19ED42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 757478d9ed3691a0b1bb50e9424f48f8e2015889723815f3c80768956eb60fb2
MD5 d29a41000e8a1a5dc387e4cb591c5035
SHA1 631166ee4c189fc5a4bb20113d4b6289796d0a34
SHA512 25a57c44bd18324430ebabbbd408dea6c57e43dfdcb203189f5a349d9e987d6a9fca7492812a8e6a52ee66775506942d7c024312cbbd1b5d91824e12a3b53e5e
SSDEEP 12288:pbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:pbfJ4yL/tNCJPXUQrPH
TLSH
T143C423AB60D5948ADE5587F81648F001C7047ECA672F62F7EF82B8813FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 88ff39c5fd7771db6d635ea3b87c2bf4f8d7b77ffc8a7ec4520c25cec476c575
MD5 d7effdd47eb6406bea9f229ad4207af9
SHA1 b78ce786b0e0be77b845c39aac58409baa8e1b9a
SHA512 4e9b48b7d459170f73131638f1723389a54409bb2dfb7da575a1a2f2b3fcedbfa3bf0be7e3018e0d1b61de46c79351e3d3e20754da732e39c183357fc3a084d4
SSDEEP 12288:wofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:wofJ4yL/tNCJPXUQrPH
TLSH
T12BC423AB60D59486DE1587F81648F001C7047EC6672F62F7EF82B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 798bd21a742f0071587215d225560a57b017854f05500d929e5dc0da9251b789
MD5 cf1d39d0434ce88c083ae9e1e04a95d4
SHA1 76857109abd18d28da4efcb0f5290c2d661908da
SHA512 034521355acc884ff6ccbcfe31c5407772915baa91cdce1844a8b1c7cefee41dbafaf6e2a38cbc34ede15daed928ba251568ecaf1b0ffdd833365ecfac8f686b
SSDEEP 12288:k0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:k0fJ4yL/tNCJPXUQrP3
TLSH
T1D1C423AB60D5948ADE1587F81748F000C7047ECA672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 7d7410eea88ab863f788e625705d30a1e69861f45f6c17075a604748b50ae6d8
MD5 c24a55fadc46eeb1594f86ec3100e6e2
SHA1 728917e7054b25aa10da5f938e314a43e6609d30
SHA512 8ed33ce93ae23c9489284917e1f83d0f4656a25281d2920ea9daf4463f4e4e3842d1841bd19bac08d113bb886a5aaf7ffd4ba011bfcb8f5512fe0dc287e3e6cb
SSDEEP 12288:biZwb6zzFEoS2cPvyMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:GZMSzFVSOMfJ4yL/tNCJPXUQrPh
TLSH
T1650501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 546ae483955c8ea25d2024cf8b548faf74b962f913637e68e4c018338c673d3e
MD5 6d0671fe96280b293bfeec6780f6266e
SHA1 05faed309804ad04a7392d789544527b06a2d49a
SHA512 2ce1a36fc553c4590043e500f8c6267a291cc79e52bbf64c1733c9c985734a65309500c72a4909239f1d369a77a1f02db85c760de472bee976e8fabb4bf36171
SSDEEP 12288:6hfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:6hfJ4yL/tNCJPXUQrPv
TLSH
T1B9C423EB60D5948ADE5587F81648E001C7047ECA672F62E7EF82B8813FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a88a79b09267a1fd159dc6da7202eea66e0cae3b4b47fb09fa99c65493bb3c9d
MD5 9d2ce0a5377b95e44394425684ec0713
SHA1 a00da96f6ed6f4a821ae50e782b9c98a1cdc89e7
SHA512 8a95b6d88a6b92512a93e42e931ac0b1b4385956a9cd475f74b354eec81ac9a21d9d65160b9517af92a3f5121a99cc8f0b0d549931c24be6310c2a7828c30b8f
SSDEEP 12288:7lfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:7lfJ4yL/tNCJPXUQrPv
TLSH
T105C423AB60D5948ADE1587F81748F001C7047ECA672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4f0a1daffcdba3603e97e0c8bc2938ae75f238fd43b594d8777287eee78e393f
MD5 6b90227883fa437868f772b524aff87f
SHA1 29038e1fafb4d4fec4fc1557d79d1789bffe43d2
SHA512 301370d79e3efbc4081bf3566cf482b5634ad38b222b69df4ee8a5bc44be7bb4ad8ecc76797ed1368bfdc54b2f22ed2699dd671ae3d0822f2b07627fecbc49af
SSDEEP 12288:HyPz5L8gfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:qzygfJ4yL/tNCJPXUQrPH
TLSH
T10EF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c7f598f7a706d411541844d74d022585550835e94cc7d6735a7f796015a95861
MD5 7933f8c9cd21068d85caa24a706e2370
SHA1 fba133adba91b2677043279acab8120e947e1314
SHA512 d9f10a45d0f72f3f749cae6ec42cacd405c109445e621bb62e20fbde662dda70b5e875653f349b9324e0f2ff11f63e117c6e42bd1263c698c889eb3ccdb84da0
SSDEEP 12288:ThfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:ThfJ4yL/tNCJPXUQrPd
TLSH
T1BDC423EB60D5948ADE5587F81648F001C7047ECA672F62E7EF82B8813FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ec3510290dd19b7a2afa0a365e5b23b3be0a31728c11579fb267868696fd2dd3
MD5 c448f105349057b11a86d0aee02e6687
SHA1 eec4816e16cd83d1e6b52390b14d1d2f157157b4
SHA512 00fced4d6bced3b7d40692a3742ce38c3d872f437a0ad8f204173224448b9004d45aa454a1a6374897a5c3551291b04825b2f4ff0bbb3917d199199367e7bcda
SSDEEP 12288:thfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:thfJ4yL/tNCJPXUQrPt
TLSH
T1ACC423EB60D5948ADE5587F81648F001C7047ECA672F62E7EF82B8813FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f8b6984df2f2ede0dd0c57880ebe8fb9765ea2487345dab7337b4c3d4e709d39
MD5 5fd2314d318adb5d34c7f547032d49f2
SHA1 b68fded11a2d84bb36ab8b0977fe9fc745634d11
SHA512 17c282a221894fe2aab60e62eb637c6f51b09481b715349137d334e6e4d7af4d10775f81f6b15ba39b9c199b84de5c13e1fcd1e24657f3f6b290197842122cbf
SSDEEP 12288:3yPz5L8gfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:6zygfJ4yL/tNCJPXUQrPr
TLSH
T132F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 09ed5208d3c6b743c8586e1c978f3925e2d24e050ade0853a5481c8623a1cdaf
MD5 0fba008206e58901e74fc72fcc23bc7a
SHA1 b93283ac7e6324ffd2d95ed61b443b106e6e57df
SHA512 eace7c6a1874fcf29671269b63bbb8d9eb24d7f2d259c38bea20620cd6cc2dbe9efda1d219eae721aeab3f147976c78fddc05d087f66b61d86567a2faca758bf
SSDEEP 12288:iCd9eWYoaLHF3z0z04PDvhqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTL:jTHaLl3z0zDqfJ4yL/tNCJPXUQrPn
TLSH
T1E80501A5B39018F8EC67827ECD549502D3B27C9A0B70C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 54eb078afca307ae4fd32fa612f08a01cca0fb113d7429942df1712764303876
MD5 49ea74cc5eb6e15d52bb39ab0588c9b5
SHA1 be5782d9850608e2dafa9794322788b168872e5d
SHA512 d7fb027ff191a02e20a854ab390d19507367a7f352648d48ddf39f3c26c1c62876393496fdfc1ff81b48695f66c42721df0d1b056f765c51a36e952fe2c59350
SSDEEP 12288:Si4e7+RdTfgwCHKy7GLbbdIvnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGC:S37d9CHKy7GZGfJ4yL/tNCJPXUQrP9
TLSH
T1C525CF91F3E410E8F1B7CA758D659502DA767C9A1B31DA8F03A4255A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e301f6d51efa1fa75ca7be13d9adb52a014f3620c0e564e30434a1741b4b75d2
MD5 a8d7da47d370eb3a07f57d20f6cfa57e
SHA1 a3b1a969b90b1cc4bd6fc2358ab85961b51b6566
SHA512 f02765ffd7c21d320728a4d2404b5609373b702ff8f18cbac6a39cba356a52612a84a59751ab14712153e974083fbe2d82b161e92d2d3ea80d44faefaa634cfb
SSDEEP 12288:9afJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:9afJ4yL/tNCJPXUQrP4
TLSH
T16EC423AB60D5948ADE1587F81648F001C7047ECA672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 ff46ac51f90fe1a600fe5b235a62a5a1bc22fe0e5d561aa09af2d863be60ae3d
MD5 4c3f6881bbe490b2d40c249bc76797fb
SHA1 8ed105cee2333309dbd0cc35b331f37946b95caa
SHA512 49950e4949796a314f8e318a75e59683fe8565b6bc2946030061bc5c292f7d6ab1a67069462fa000b888a9cc9e6619880298d010470d46bb6e6bfa210b406dd3
SSDEEP 12288:VAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:VAfJ4yL/tNCJPXUQrPg
TLSH
T190C423EB60D5949ADE1587F81688E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 989428142149405ec2b27de23ec8167684d1e35e9f87ce51df0efc154c922903
MD5 312d24e4c51f91a73e85443b8099c0f2
SHA1 a06747fb1ed15862554e84fd2e779b9f8c9d376f
SHA512 9b0a2166ea2cd5bb32443f7d4fb115909c037bf814cc9b73196995374bf248d8731800b975b77b5d82f007beef70db3354bf06cbd86b44b01d94f006fb2e8def
SSDEEP 12288:anfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:anfJ4yL/tNCJPXUQrPc
TLSH
T148C423EB6095948ADE5587F81748E001C7047ECA672F62E7EF83B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 2de3277bbee58c3ecc88fb06a2db33984eb5932fa75553decc72898bf64eb9fc
MD5 fb8a582fd62a9e62e3cba03307331dee
SHA1 a53e66829a88c2be1fdffa6b6b35687fd4ff5adc
SHA512 683454bb2df59344acf0bf5785ec994862e19ff4831ac687616de14e5c13a1b620a09a34a8514935b8d920ebd83a2687b5f8cd94483fa547be82c5de28439774
SSDEEP 12288:XhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:XhfJ4yL/tNCJPXUQrPP
TLSH
T172C423EB60D5948ADE5587F81648F001C7047ECA672F62E7EF82B8813FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d83283f5228f2bd3624403dc372d3713db7fc0107308f045699ce7847a69be38
MD5 3ccaf558d94f60a327727998395a34a5
SHA1 814be9449c25473593fd85158fb69b1fa881ba56
SHA512 9c7ce341d4908c78fb14349bbcec96edf79e22531ca3ef50e34a640c4324850b3f493e6256ac4b2d5ca1873646a96b4e38a0f37921dc84b899abd7549ec9b5cf
SSDEEP 12288:NafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:NafJ4yL/tNCJPXUQrP7
TLSH
T127C423AB60D5948ADE1587F81648F001C7047ECA672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 8922853bcd0e48ac976fb3b00737357b28b29abffb5fcb59428d99f487c1af68
MD5 64185fef84f02e12a9f410d13685a137
SHA1 3caa6b263b9234b4d8e177445aef9276cb39b132
SHA512 f8ee852b1711df3b953f465185c59b08c9b64e38ab1ab4465db040da20abc0fdfb32d11c76f9747bc1ac5510105a2ecf0bcd898cde0efe60c6975efb851afbb3
SSDEEP 12288:rJfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:rJfJ4yL/tNCJPXUQrPy
TLSH
T1CEC423AB60D5948ADE1587F81788E001C7087EC6662F62F7EF43B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 4bf0e1c72449b8852eb433fa77f7648e8969d629cd6557768ae17e25f12ec23c
MD5 4b407a5c1cf18ad2426dc053b5242b35
SHA1 ca7f4ba6035d29799449d8c66f63f317fdc258b6
SHA512 1fa6c8008065ccffb31be20a6784c51cf4a7d1ef591a163cd513785c168af052b1f5fff70346dc426aadfac829d173b483255eb7a0142bc9fd7fe668b4beb44e
SSDEEP 12288:7bfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:7bfJ4yL/tNCJPXUQrP2
TLSH
T1ACC423AB60D5948ADE1587F81648F001C7047ECA672F62F7EF82B8813FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 473836f9d9e017ccb261342b72818b74c6d0de540c6fe68752c27fb712af9485
MD5 7e8f12dd14e05c6147055522d672179d
SHA1 3915e478f233d6c407c3d3d0694de8e767c78516
SHA512 73d42db06c4e2d77fb8be464ee00ae1a0ed684bf787314ae96f407545d051d38bad7096cfd91fcd3884ffa000fe813e175315f4f26e59856220dfdd5d5f794a8
SSDEEP 24576:tfwvok9RX6wkyAI1fJ4yL/tNCJPXUQrP8:rMnYI1fJ4klKXn0
TLSH
T17A35D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3f65bee996d412735a8ac9f5f47a94b6dbf3f6585c310e9eeb744d241471e1dc
MD5 436b4c67915cd6fec4d3317c36353670
SHA1 fd5e7bb426ea39b44ea88da624994b27e6c0e643
SHA512 3cc3f5fbcd476f153cf8e042ef60ab121857bfad0064b8a564ada875ce9d7d5c24ef52980d9ac67d184d014af4e6907163dfec35e138753e0f3f0783754c3d8a
SSDEEP 49152:4YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ufJ4klKXny:GySzPGfJ4k
TLSH
T14B066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 281ff48e92bc2e3f547381b0ca3749eca90096f5acce0fc1ff196c7cd6b8a141
MD5 aa9918be26619565d5d20c4384843292
SHA1 a1ecf33abbe57ed0f61a138cb0428f7f99015ffa
SHA512 3965559a9ca45c868c74aee3dd790ea39acb010926ee562a5b8add1085e6d22e475deb1df7c4e2c14dfd98cc5020bd939a563602e0e1ec6036b7bbbf90074fe5
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcfJ4yL/tNCJPXUQrPm:i47JUQj1irIhCnDHUPfF/+fJ4klKXn+
TLSH
T13865AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a2f041cc82a0c5a7e28fa803638446e7f20010db0bbf19b6b2716ca7938a4193
MD5 27133d2ee4fc48f6b7c74262cc464466
SHA1 ee4f872097bcae3031eea1482e1e87fa1461b559
SHA512 bea747e37e718b28d78da9f44d753ffc2916768c4054ba63b29836fcf46d6d381ccf3ef8c5a0ba89480670b937bffa615034db2370bf2f95cd9d8600d795f8e7
SSDEEP 12288:uNsfRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:XRfJ4yL/tNCJPXUQrPw
TLSH
T1E1E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9088548fa2739ba0e003491ea79324490ea8997ade328ad73a5c6830f0b17b35
MD5 fa8f8f34217a49e0c5832dd3b9ff91d9
SHA1 4ee0c354f1b614401260c2d0926c0821e3ca8d33
SHA512 5f330073315f3756b1688a6fc98638542aca6ff61a727ec35505303ee7ddcd62a2d32a088b607762114df7c334c750ad02e5962f40cd44d00e8d2bed58f1a37c
SSDEEP 12288:mV0dU3flUV3VTvPVoSZMEWxmNwDHh46GpxqNaRMDvJy:mVwUPovLOE0Cw94t/qNaRMrJ
TLSH
T13C352840766AC74FC6A940321E37D6CCA7707D01EE45AB0773C8973FD576A58BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a3a2f15b0242094f03dc9db8b1ac1c68c1bf8bb2c30cf091d543e87e7be28c2f
MD5 de10ae421a1d326f8da8e39900eea673
SHA1 e347c98e8aaa56a738562d00b34c24a5749d08bc
SHA512 886cffbfde9817b84e1635ef4b6dc06e6ade9cd7f48fae64f4b9d371e54f3bf70e405e2791dda5af43cfa8d5ddbca736c455e3c9728086a75b3b61dddaf73682
SSDEEP 6144:yIVsx0WR7Zg4pGqx7L1tySqtMxbEZSqtMxJNjhWZNkbtagP9HTxVXMv:yJ0WR7AqNL1teURZ9zcv
TLSH
T15665E840A437A38FD5BB6032072A5B8C77A4EC16B7055F27B388453AD86AB55B0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a0874866ce1e6f78e71c5ff1c28f4a14c80184a6b1e907613c62d3cda57c517b
MD5 1f6a8f63f0f24cc113fade8d0e4444c6
SHA1 cdb9b30cf87495f054b1e6de0515e5e465365118
SHA512 d4fbc75e7458c45d8323044acb1c78fa454ce1a6678615d7c69603ee2410428430e81a5ae038904d70b8465d678c431c55aa7f477faf8a00fdcd307f7b890814
SSDEEP 12288:az75fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:I5fJ4yL/tNCJPXUQrPS
TLSH
T100D423A761D89846ED7587F8164CE000D309BED51B2B92E7EE42B4853FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 852f14602e50246f396eb33a9cc60a051d6aae770595100c204faadbbbfe3c1c
MD5 df8c4c7276adbc1978522e7a4b4f0990
SHA1 ceb0208826490021af82f8cd03b22ebc226d07b1
SHA512 7ddab5a9b106df5916683f6d628075347e66521b1e76542905dd61392a25964cd2039c035621141c35ee4ed22ad0a4c56a9dfb57ccb0a5bee9798a34c83e1152
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bY/fJ4yL/tNCJPXUQrPL:hgb4mBIBhGFcfJ4klKXnz
TLSH
T13665AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8a205f9a4b1fb78e72bedd0c02652e3d70dd58b0f4759b4f903921c9e525eda6
MD5 5dd026ede7ca7526d2dd338b0d3b806a
SHA1 5a7b4eacf7e3c0652858af90e67a4af584e4c1ff
SHA512 6d4c1fb132dea4d97266f7202db31ebbff4fcbc81915a6406d2ad9e6145e84494b6612a73736bfbbf1a6bf762e2c154928657eb1f867c11e708c0aef7bfed3ac
SSDEEP 24576:6G88u8FpJqH1bzria7/mMfJ4yL/tNCJPXUQrPu:B7ZFPqVea7/HfJ4klKXnW
TLSH
T16935026672E101F1D47BD1388A858663F771B8150375FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4524d7dcad28c19b46836219666264a1082d5c8845322093320d47bb9bb039fb
MD5 631422cbc0dc1358241fb254cc269676
SHA1 950d93d985c769b8aa71bbe5fdfad9cb163a91ef
SHA512 e2765c1eb8fbe50a9e7533c57fbee1d63800b9af1c72ec2f6ea47c67e0f2ffb5efed943b924a24a4cf66ff130de47d592f7908a0eab680de3db616dbfdb7175d
SSDEEP 12288:mHvUrBFrEjwaQRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:mPUr+NQRfJ4yL/tNCJPXUQrPg
TLSH
T1E405F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 34a7c50553e235e850adf3eb6a5246abf4e20d33dc359d02fb8f4081aaee7706
MD5 7633c57efd464dbae6b33e5bcdbe8373
SHA1 754f8bc85703cdb88870abe0824150804a70116c
SHA512 b56cdaa4a08df564a8e625099bb5e262dcbc81b77d1e93fb8365c096667ebb70e278f42ef1692ef58943e3b8acea00cc24c3826c97e02b1eae5b5ae8bedc36dd
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjofJ4klKXnd:zG05lO43b9fJ4k
TLSH
T192D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5022945d6ba212c082d760128b5f7fdf0a533bcdf8b77d4748b76cde861db350
MD5 856014f0376fa06ef2b82ff16ca8fd81
SHA1 b76435efbb6332046acdd051eda49f1f9bfc4e9a
SHA512 c7eca68846947d01069a730f5e388e3488207e92bb3201f12b0c3e0f7a18b226178098040f55b52cf4c410b6e2ba775dfe0f526ba47016a6602c6285ffe720c9
SSDEEP 24576:vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnufJ4yL/tNCJPXUQrPJ:Xa5POZ3+Jt2pasx2+mAfJ4klKXnh
TLSH
T1CD65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 86e34e8f6a3a941fbd392f098137fc7d6b1745aa294be3346d1b7b8000943dd1
MD5 8f10dc8b5ff2f6bbb004ab52b1145e6c
SHA1 a409a3628693de311ab23778766a074f952948b6
SHA512 8d7462e6bc2bc5eb2d9226a83d03428404abe51d5262670e910e976109ea3bcbfe9775e73ca85d4a6ef507743ed27f8741bb465a1f96e45c6fae60fa04945a83
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkkfJ4yL/tNCJPXUQrPH:uNc/zEOVHFnfJ4klKXn/
TLSH
T1FB858B2623E901E4F5BBE1BE89679546FA717869133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a0dc5d248f3f7708077c10cb04bcd6c30e6cabce91107e072a0555085c4caabd
MD5 7c30dd9de50b1cf531f3e9f916376166
SHA1 798cd30cd193319c0ca29f8d3dbb4488e36e786a
SHA512 e65f294c9e6687a16ec0ce6708ab1c8df88e5ce0ba9be1b9a1e4b26cabf94ba420181a5518d6c9f0de04c36abc9470c79a3f4773f668f1374642c40d99459ae6
SSDEEP 24576:e8kNvNnaFeYhJNtmZBmDfJ4yL/tNCJPXUQrPv:e8MwBtOmDfJ4klKXnH
TLSH
T19355AF6EB6F845E4D1FEC6B48E238112E6727861073293CB9290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 eb4003b71bf8d22d03876894b4b813e23a4dbf312455e83902326e7525aec1b0
MD5 4b3443cccad652adde7288aa7685dc91
SHA1 9d82d5343d91ab3b11b3cf43717c0e1a6974dec0
SHA512 ec96fa255ba36bea879d81b81b4e58f0eea85e79229652b16a9400f4983098e382bae671d93fccd55df4e15d1b33c791c5e0477397437a692d9ec89f2b9fbd3f
SSDEEP 12288:LQcMxWDXN1Dp/fshBItT1IQgANfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GH:rD3FHshBIYQgANfJ4yL/tNCJPXUQrPv
TLSH
T1AB25E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/360-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/360-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/360-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/748-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/748-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/748-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/748-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1064-79-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/1064-84-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/1064-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1064-300-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1164-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1164-62-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1164-66-0x0000000140000000-0x0000000140469000-memory.dmp

Download

memory/1164-0-0x0000000140000000-0x0000000140469000-memory.dmp

Download

memory/1164-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1164-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/1448-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1448-45-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1448-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1448-50-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1536-268-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1536-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1536-52-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1536-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3788-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3788-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-328-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3788-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3788-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4224-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4224-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4224-313-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4224-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4224-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4240-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4240-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4240-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4240-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5064-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5064-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5064-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5064-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5448-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5448-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5448-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5448-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5448-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5668-289-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5668-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5668-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5668-123-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download