9fd2246c7a3dff6c7fa2aaf39b5279f3207e2b3243d9c6d1086927525dea2527

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260715-njfejset6y
SHA256 9fd2246c7a3dff6c7fa2aaf39b5279f3207e2b3243d9c6d1086927525dea2527
MD5 c29f9bbb166fb03aa32bc67277930306
SHA1 ce113053a796f138685c45b1adbd4a7e7c2522d7
SHA512 8af3646f5746629febfda49184a16523a6871824fd295e5b5c4e3d086687322b29bb17cf62088fbc458f3a4248c7b695727f191783abfbbdcd34b6c93e2c3bed
SSDEEP 49152:N+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755c/:Q/PvOBjcXvvOOc5FLm
TLSH
T185165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5936	elevation_service.exe
4536	elevation_service.exe
1420	maintenanceservice.exe
1248	OSE.EXE
1376	PerceptionSimulationService.exe
1392	perfhost.exe
1840	ReFsDedupSvc.exe
3852	SensorDataService.exe
2408	ssh-agent.exe
3796	AgentService.exe
5368	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\63882da6e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3bf87ad4c14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000886651af4c14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bde674ad4c14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b739ff04c14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009d1ddbad4c14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002fc27f04c14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5936	elevation_service.exe
5936	elevation_service.exe
5936	elevation_service.exe
5936	elevation_service.exe
5936	elevation_service.exe
5936	elevation_service.exe
5936	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5948	2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	5936	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3796	AgentService.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: 33	5368	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5368	SearchIndexer.exe
Token: SeDebugPrivilege	5936	elevation_service.exe
Token: SeDebugPrivilege	4536	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 3900	5368	SearchIndexer.exe	102
PID 5368 wrote to memory of 4184	5368	SearchIndexer.exe	103
PID 5368 wrote to memory of 4116	5368	SearchIndexer.exe	104
PID 5368 wrote to memory of 2392	5368	SearchIndexer.exe	105
PID 5368 wrote to memory of 5532	5368	SearchIndexer.exe	109
PID 5368 wrote to memory of 1648	5368	SearchIndexer.exe	110
PID 5368 wrote to memory of 2296	5368	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_c29f9bbb166fb03aa32bc67277930306_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2792 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2792 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6341bda3b24a369954d8ec558a4e2b8dc8e899a445b0ae27a0474f65b5ed9762
MD5 5d827f89081cf9ec71644484040196f5
SHA1 75b85e421421671e89d902ecbae3e7e391ed8813
SHA512 b7588ba5d37cee4098c94a04d090712a777eb307a030d8637ca23cc422e448c4c389887077a1d492566fd60eae79373ba96d72f01af511d1e1c0d437a064bad7
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOQ/lFTjN4:K3q6HjBiLm
TLSH
T18CD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 409dcf71596ea13fe0ea6b00b11457e7bda54aa7b5004c3614f7b6aaa9bb09d4
MD5 30fe7f8f9f8f225bcb1efac04e65aa79
SHA1 ee1c5f0b86c4693d3571d82afe9d1f317d5f7f27
SHA512 ca7c10b8bc5ab2729f51352c6948e30d83711976622bb2274066029c591aa41f38e75b70d61565c721b2b1e1ba6a7224399ac36c7a25ace0ec037b841e8929c3
SSDEEP 12288:L1XLsswWkxy2lRq2czAhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:xXYfDtczAxnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T18165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5c577e27fab00a92f4d2a50aaf68fc245775e274c04192862252e0b48ab368c8
MD5 32cd429e7e3b2f6e8384a864fbd6c38a
SHA1 f88a427c2fb57ac532e021c2c1131b72078a4d70
SHA512 3a9b242f0dc11e3677f2eaa81070acfa7716ac806ab781129e749373cd3557ebde49b64a416c6ffdcf315997658b39457e528adcc53cecb08ec64c3a254ca751
SSDEEP 24576:q0Le5ji0hmxLrMPnQ/tbw/2Mkjy6Fr7g0o+:qPji0AlSQ/lFTjN4
TLSH
T15E859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 83b1ff3f0251e846808d59c68d944c4fbb7afbdf699192e4529e082f053503f7
MD5 dad03d705db61c460396bc4fdd1e612b
SHA1 3129989d196ea9df115213d6e182c4dee8a1c080
SHA512 0812d6544f175505baffb2acd5430fe92b420a73daf66a0c601059e988821a415ea18a8f26a197d860041d05210236ed8cb7c1bd0d13fcd879c480f2c962587b
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuNnQ/tbw/2Mkjy6Fr7g0o2:D/ezSC6vUzPvxHjymQ/lFTjN4
TLSH
T176755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5328f4c964bbcb2037a1096e076e0b34ddf97b5f49be5c3b16c03bf1dbe916d2
MD5 1121b17a9e8b6423ae4215c37b1f7b44
SHA1 cd1075498a920250aae9c2ed8f7274926c461e32
SHA512 9df776af23584f9f1b2cfb266e72199d5f67fd6ced4decc7e454fe62466969564760c5019a4925a39a44703d1103203c9d9e129cf03370365085f92cfab58c3f
SSDEEP 24576:oVbqPb88hv/l+6knQ/tbw/2Mkjy6Fr7g0oU:oVO88hXl+TQ/lFTjN4
TLSH
T117559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 42d1407716a91355772624b42fc692c510fbbb2038d54318e32a6300f5a960e6
MD5 a85b7f79e0511a0568f0bf278caaedda
SHA1 6d34235bec55f80a397a91542b1bdfae1759d68e
SHA512 a982203266510219e04b7f2818db30698dbae174866d3de055f1e9106a2b9e6c53fb37f66fa28de287f1bfa43bd9a26174a06e09d113a4ad83ad949bba06a4d1
SSDEEP 12288:Oz7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:OzrnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T19C5523696A24F897FF2B06B15CC384826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 745273a1304e8d3a49fe1e4243c1cbe0a639d4458220f023f6b5064a030909c9
MD5 d15fc9487be9aacb69e30dfa98124e26
SHA1 1abdb35ee45f7a2d37ec2542c84fcff4766777fa
SHA512 5359e6d5a2efd6545844682e31c2430af828c17e0df3386c700acddd69d20cba1b68fe3edeb68d4a096a771d8b2509546ce61178331f01a38bf476b4b5364a53
SSDEEP 12288:ceBNUbTVO86UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:cJIUsnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T12575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a2a92452e5592ab10eaefafd29b310051baed2305aa5e2b962a59fcb79d41d43
MD5 b2162462ebe3c7543acd98f0e7569e14
SHA1 4849686a5fa32cf955ce1323e3893f0ffd71b3f9
SHA512 2204bb8b2698653a7606a7b225a6e3b4501d189463200b377dea67791f11510ed2756f9428663824aa5e4e94a1a075e095361aa96aa6eed77ea14519471a858d
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THK:qQvGAdlCEL8c/yRNw5CyLm
TLSH
T1F2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 cdab1a26a02a6d9a4f048e05710527bfc1e1ad3d522977678107bc230217238f
MD5 6e9a1e60bbedbeac42056fdb12002fcf
SHA1 52135cb8700a72360eca0c5f3de544effc97a271
SHA512 cf32d084253a9a7ced30ccc9f194aa09f50cc2316de2c0bb5705de0d88a8590a1725b0d13498943e38f1a5f8ee50f9ffa6cc9c66818fc2c47dea51307c71e749
SSDEEP 12288:RAwSfxL/2Dc39DLLmt0LDQewsAjCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg3:yQewsAjCnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T10275E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 283279fa5ed6a329577b52e7bd790f5599b073c3f88e563e1ce5e9b80457159a
MD5 15259bb8cd615af7e5bdfab5076e6b1a
SHA1 54564c4befbd2b705f7992c2da5aa959135341a7
SHA512 c76cce672e8c9a0286593f0d57c396d2a89f606b013edb174a9d4de63b4ddd24dc10631268298591b7b8474a8ed130e3e8928730c4c04fd5740f453f904b4ddf
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVL:sUEtQevvqc2W1cpV2EI32
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 28b1c8e926e251a5b15f4972f7e48b6900887e19b725d368e2e5894ed751767b
MD5 625af77f6bba06d1e9423be437bb19c0
SHA1 6e0ff0ac15d180fe7574f34517f47108149ac459
SHA512 e2d26fcabbe6abbd4f3460f96d797d387645acb38506b9a095050e6d7e4f7300233f2212e9fdd967569744dac02ff38e038d3543176ade2eb27ffcf6fdb122a9
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/ziQ/lFTjN4:0oqtVjnmWLm
TLSH
T104D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 623ab46de643656d1dd4f09d405f16316671559c3be7799b9fdd6d96d21f0a08
MD5 90569a04a984a3f3d7f068ac99d1e498
SHA1 6d2aad0552cad44bda5999b4ba32f01a2a5b9bef
SHA512 d310ebdd5e7eabb0d4347d83e97b6e191442f3d836b226becbc67a99b94db191e8f1c11149de6fe46bf008721755f51724a5368737e541497b1bf2619ea6db1a
SSDEEP 24576:kAhGLJIFoiwtA5l7S53RnQ/tbw/2Mkjy6Fr7g0ob:kAMyFoiq5hQ/lFTjN4
TLSH
T11735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c00e9a2288cb60fb26abac519dc1cabeca137823d7e3620b71f201ae1313b953
MD5 f3e7c7b8a449d2249dcd73e64581fcd2
SHA1 da36328fd84d5c256df59dc7f310413fd5a99fee
SHA512 bbb544d2e2c835b16598bb74ead4f93755d32b0b6958913cbb0eaffc2327d55d0e7ebaedf0de38f5d0a8b5d4a53a480d0e93d0375825c497a6dad5b739c6ee79
SSDEEP 12288:fmw5HEjsChN2BFgl0WDm+CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMq:ewuHOWGnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1D865F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 beacefa31506e4d6bedfb57519d9130d2407feef132dc5e7d887e076ac07ef66
MD5 0de5a33dca01504fbbb50a0744033590
SHA1 51b9ded966c6b104361da3a067d989add3a02e37
SHA512 b25970fd6e383d3adbb42d61581b09eb31114311eeb64a62db755621489d396f0a16d50e37a74b194b56f6f8b8a75ca26e04bfa91a432c0a7d4b8d42949c9965
SSDEEP 12288:3XZ1IyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:nZu3nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1C155126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5475abf5f32dcdee59b9f927e0a45cd4cb684cbc1703c9ac0067ff073c5c9d62
MD5 4b6d81ebed8a872ce1a5d8b5f88430d4
SHA1 d7f1363957848ae600010c98d22d21314604b844
SHA512 2d2fef8999891ea96fbd0c8c1bfe83ff601e836336b49be50eb56bf0e5728514335234bec8e9248adba2366d093b8c08e29ec1b6e46642cb6b132fc28e7107fc
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:jQRQyi36YOcPQLvw2gAf+PN3jLm
TLSH
T1AE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4054f53f65c1b3f4e7a273f53528d4245d4d355cd77ec998037595ed0940b177
MD5 770f94ab9d7d3d4d9e6a02cd85b363ad
SHA1 0f2466c0c5fec1c8694595d6c377abe43bd2d4d7
SHA512 bf440c7fb4c02dd5a751f4716c4822daf406a6713885d373d28edaaaac54bcb5f17ad1537a85ec9897fc462034a10a3927cfdf7d737f417b1f3a9c30752f0a72
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:ZQRQyi36YOcPQLvw2gAf+PN3jLm
TLSH
T1B8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 00d38d8008024c121d61aea498065305f6800bafa7c3e9e1d0ed2573aa07d463
MD5 1eaf0025866a18493cfcba27c8affdff
SHA1 95d272c56c744bf88b71f8f32ff845276a7e71e0
SHA512 60f6548fa671abe11cb5031531ff9213cd336034ca12600472ae481e16bbd340242266cbee756d835ff8f9f63b5a96a271a3f96703a089f5d6d658f17ef9e3c7
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0HnQ/tbw/2Mkjy6q:F68Qg55nhheWu7PNU3/SQ/lFTjN4
TLSH
T1B2B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d3850dfde71d6543e3ff4495d66f3f4291df7510fd50fbe332e98d607e63a661
MD5 49a705f39ebac819aaa949ff9c716217
SHA1 d34ae8ee0a2520a8770c3450f1ebfda742ecd9a1
SHA512 c8c2e04a731e1593c665f9216c7c474caeda38184741c8e791294e9feb4ac88bc349db296613113ff780d4c8e3383815f7b04364ca6cfdd94e498d55f067de6a
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:+y5112gYy5azzVvL69nLKnhZgLm
TLSH
T1AC167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f3f9a62f0035802ed5d3f45211de6b22bbc04a80653c3468ad5ba2a82feec625
MD5 f45a7af175121056219ebf4c78f76ebe
SHA1 c2f84d64e2f20772469d38ecbdbced00937f4187
SHA512 c5f9e944111165c52a2da783aa6a41a5ac940d6d93f2419b9eccb134198cfbc1c94054aefa45b4c066d448ee6c6a50652b8e63f5446285f2c841bd6af72ef880
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBQ/lFTjN4:Bu6JmVxd2dmLm
TLSH
T1FCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 74206ef480458f9f78e1c2cf729faa76353cb1585ba2fd3b7314341a6aa13c79
MD5 50f7afe3e71bbbfe22c556fe4f5d2961
SHA1 db047d28097d1dfc0aa7974499d8206ccfa9ada0
SHA512 1397e9a620abe456d758331efcedaed50446f339d83eb37560817a3454169c505dd5d5ac43c5c2b2e2c351192c65417d3700066f4c144f3be4e814ea5b8a736e
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xMQ/lFTjN4:jmifPbRWLm
TLSH
T1C0B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 783a3efd1ee8359923bafded6754a8337f3edd0d579d452b06943a01a0b27a67
MD5 e81f777c34f264d9daf2de6a0d826ccf
SHA1 f6a4db1a0413a1cc47aadb068bf3a3bdc3d5c3eb
SHA512 2f8a6ca0922234e0906c0921650829d3b8a47c569f131a90dc2350bd09b3c976dd1b243eb45ac572520dc8675f19f396b28980b49248ce5d217be4a6cff23a75
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHq3Q/lFTjN4:w5dKTi61cLm
TLSH
T1C5C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eb57344cd4e6d08119e8d70a8aea735d1f5f0095b9147ea3b7f21a8a0ad31e45
MD5 25adfecb4e82bfa8df148d8d782f64d4
SHA1 0ba73e3274e9c56378dc994158e1c568c4de1b20
SHA512 436eaabec5f2ec1e4902df58512818785f4b48c896429189d8783a7bf1518b1f1813adff01f67611fe002a2881dd519af0f5a2aa933933077a66c7d275ec7234
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5woQ/lFTjN4:FX2iyph6Lm
TLSH
T15F95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c09d09f51a6cae67bdc121e0b6a56ba001876aaeb78932eb58bd5b487d1a7e59
MD5 f5653d79a67ba7b2197c5ca6d9468938
SHA1 e22835160136ebe7a3cc3249a346950c9853cbe7
SHA512 f85d8f0960c051d3b565d6f933ef37dd595e451027d55ebf316afa95f3921b6793464789b70078a6cf4c1a3abbab964b3854ab08eb2983c4e721f0c58a9dcfbc
SSDEEP 12288:wjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:wTnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1AA5523697964F98BFB1706F188838182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4b3ebac9ba7fb7cbe293edd59a0bacd3348f6b30644b4ee52016c831d90b8697
MD5 15e3c22183d33b4e47606430474e36e7
SHA1 e6170db167c631fe160a62678a7cf6fc2c76d9cf
SHA512 170119edbe514424adc87864f03d7a19e48b7efd5a3e9657b54ed10fad93f5709dc46301e174b68538055218e4dff60959c69d18ae4c19279b1bf8c7db0d72ae
SSDEEP 12288:KeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:KenQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1985523697964F98BFB1706F14C838182973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a9950cd0ec9c5d800eb71d8c5a3eebce4c582129ac19e54983ae65f779dbac95
MD5 94f856127d4a81acc8636abc9f26dbe3
SHA1 7edd3d95a4f1c06d534c4e0528a878c7d02ae201
SHA512 b663ecca2dc152de2306413300eb2e09f32cc5ea0d0142a05a65dbd7635c8eac8d42dddf99e1fe474d91800efd2ce18b721fbd94e83bbc929f90f1fab1481102
SSDEEP 12288:dUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:d0nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T14E5523697965F98BFB1706F1488381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d1fed37a15eea919be3ed54a9d0766af76e9de5f052d1c676cea8a8ceeffded7
MD5 9e2d58c60d38912b5d2083a58200e1d3
SHA1 a98019457c00e09e53f3b2fc163fc713a0b34f12
SHA512 d6917030bf86d9dbab667ffdd3b2defaea2456bf3d86d2f5d43389075bdd61fcaf7acea8fc4ceab52090f7eea8e497ee6968486b9de94e560d8861c9ddb74876
SSDEEP 12288:OVhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:inQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1C65523693A69E4C7FD2742B4CC938142E77B3DC1BBB1A39F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dd5c066ffb73e2da899d03a384237610f5b434b818ac6baaef37fc4229cb7ef5
MD5 7e06c9cc75861064922c6c9dc3ef1e9a
SHA1 9c3bdf6d9bd204a7ba916ec40ead4fbf41258e05
SHA512 5b3113490aa02a334393cb79e3579bca16d84614f1c1ac9b8ede101a52050db50afe9eafbdec27147bf20c5b4fe7a54ed8f0ebbf9f93ff442b70151c11417a9d
SSDEEP 12288:E5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:EJnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T17D5523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 313a80cde44cca137c0454c6f6757e20ce314c8df0efa0f8f93d6b292564b232
MD5 46d4585b12c127eb2721a876581422d7
SHA1 6942b64f0350616999f17ab1e81f459ed7a9c7ea
SHA512 7378b7921e9affca697681edd472307284821124858db58dc8505356d4d2bcc83ea15bc725cd41a2c91e5fcf8816801fc3823de9d71ce89531c42c73bb9e85e0
SSDEEP 12288:DKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:DKnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T10A5523697964F98BFB1B06F14C838182973B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 24bc92ffbe9be03bb7275ddb7f29a1072446eb1c4de2269d0bf11abb9d809eac
MD5 84ed009f3403e9176ff308e9c4ddd9ae
SHA1 98f439f783ef4d44295d3b04a61e64de575f4427
SHA512 0d8b70bf6cc9578079fbb192747ca425313b8e134cc304468fecbc7f1455739fa458b1a329486381b3aa3ed95283d4de48e6063ce8eb7238a9f5096509dcd35e
SSDEEP 12288:M2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:MWnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1A75523697964F98BFB1B06F14C828182973F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0db310694936947f398385245d3b085f02e4a4515b776863073b32070c8d029c
MD5 2f1fdb4609509e98e2093651043e5303
SHA1 da09f7f85ce2b7621e67871b1787406cd4f18045
SHA512 f406a16afb48716b6a51ef5d9efdb067ae8b1fbc8e37a135c5dc3b184e21592d38b032b35353fca9150fe1e5588e8f55c98e73b934cba9843df6b3ff2e6c684b
SSDEEP 12288:4iZwbDzzFEoS2cPvy+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:7ZM3zFVSO+nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T10C7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 11b2238f5bef5cc35d90b01d361a09b256f12f32f1aa5d5a1328e1c23edd3fff
MD5 33bea7d05a93921b157101186b7a8e99
SHA1 85bee2d2d3efb99d0c7ec5a28dd48ffcb8662c58
SHA512 0f9e367e3613d14655f43edc4a784bc4532589bcf580e6c2df0051a62b75b573c7f88ed791953a597cf563c6cda0ccfaa97bbcb2f9fa45e5007ebd3d7d0c6037
SSDEEP 12288:THGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:TnnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1125523697965F98BFA1706F1488381829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0e7bac2a30c325b751de2cd4d559c0ed93d7ceef2d31eb46c46e231136a2c7ef
MD5 3f9a5051e25ae09ea9979add426f6448
SHA1 312c1183e19280bbaee7ae441d9ab2fe47eb06dd
SHA512 b1843b8de6806929fe7178c58a92c0f206f48575f03335881e7dbdcf89ec7b16d6fcd483bb761988bf89ecf0208fa7d9bc26366f403c3a17092e52c88285b665
SSDEEP 12288:prGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:pbnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1325523697964F98BFB1706F1488281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3344a1ac3ef32c974ca9cdd2aebe2590fe9821ded61f13c6be997337c7e74987
MD5 e720d71eb495b2869a4411e9958f27e1
SHA1 66af8c90a4a1ec041b829d6198e0ff0a7c28edba
SHA512 9fd9045b50f7fa0eb6c3a171c04b95ce7799a536bdd1baed24d80773aad4a4fded0d8368dc3d7bb7a8b5ae8a9c2062e652a03407007b20580589994ef2752dcd
SSDEEP 12288:EyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:dzyynQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1E365021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 240bc6ce108ad6f59884a6d2705dae133269346fccfbff2bdf5e42c19d3477f8
MD5 8f9c19e83b2ab491e3489fa9cbf3561a
SHA1 3f90c11fca82f352c59deb6e680426c7b71117c3
SHA512 8f03aeb7227b32857efd108fc344f2104614875f2e03d4ab6a3070ea6aabe89a821fd31d4b90e87e640279c5b192d9e9442148e4ae42d11b0339c92c850d4c96
SSDEEP 12288:CHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:CnnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1025523697964F98BFB1706F5488381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 93468a4e777aed9c91850ac415e0827373e862376c50afdf1d3b1347450a9007
MD5 40c1179642da4b99f74bac046bd919b0
SHA1 0a1185364bbe65a08772963566f6222cf4e67e36
SHA512 a496061c04b9f4207545cacd9692ead04dc7fe4557004a048ca3e0cb3520b3e4ece3eacda44cd278f8084c671c431878e631eab637eba545ce8e8b7262ab87a1
SSDEEP 12288:fHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:fnnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1955523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 071544e0086a9896660e387a07b69302ff26042f93ab5f57e7d1577b0750995e
MD5 6be44db2726944262e6a7d60cadf8735
SHA1 17c8e99fbae019c0402302b869376b01091623a2
SHA512 496cf508cdae8c88426baca7216a4275820456d34adc8dbcbf635731ec22215d7fbae3e7ad7cd279e9ab518c0aabc37c4873b11dfa19514f8d2235df2c7136e3
SSDEEP 12288:yyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:vzyynQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T17565021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9d5d77ef24ba7396a10f36ded967fc9414fb021f833e74f26f2fa60e0ceba1f6
MD5 b4072330c1828ddeb96a9ae7e65280f2
SHA1 dec4d43c92b906512da7a59391f4fe0de3dc6968
SHA512 836015196b29a569a0c7698d85060ebd254a3442fa383d9f411dfdfaf08fc7a8773e223cb499f1f9bf7cc0375063f2474c909a51b0f4913d95ce504df98b03b1
SSDEEP 24576:lT0aLl3z0zDEnQ/tbw/2Mkjy6Fr7g0oX:lTDLljNQ/lFTjN4
TLSH
T12C7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9c10f0b3a77ff56259e918d5b7a4fa2c985bc147cf9c062c3c7f6c44c5f18647
MD5 302afbdea66128df8f9cd6642d2eac47
SHA1 36d07e4a891cb31f8d5011b033b3d5d57dcb85eb
SHA512 4b8a33ecc2a99c36c64123e2d7fa26d81701f8b4a97cdf76167f0dce9d40047b35f60a57eec9ecd1234af50df51232f7607108e7fc5f6ef394f79995c38dc23f
SSDEEP 24576:231d9CHKy7GZwnQ/tbw/2Mkjy6Fr7g0o9:Y1d9CHKya6Q/lFTjN4
TLSH
T10885CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 43d918a397ccfebd3ef73bd2e0f5860f5b05fdd98b0c10599359b7fb0da77ba5
MD5 4a7aa00b6fb6f34c1b2ea4a8e060dd28
SHA1 277e13bf7b0b5826b45319f31df3d731dc6d478e
SHA512 56f7b498bd6d17560132ed9a00b2043ad94c4d2627fb3178f0861af1ab9962933d70d7c243d2247808328c6b014ac882a7303bfa6afdbd3ab3cb446d384a7aab
SSDEEP 12288:70GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:7UnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1B85523697965F98BFB1B06F148838182973B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 becec8990159acc5266961d5743905f46deb5163e23e5cb03b69a6cfce7ee685
MD5 88454451b8a634be4fcf965ca113d96f
SHA1 95516e93341ad5719084e073f92fe2fc51db2024
SHA512 34cd4d0c6728848079f36b9da69426a4db286786c89d1461c62eb2983aa4457cda7e9281a9da5c03110d319581a36edcbbff79519a83e9168268dbbc50693f7e
SSDEEP 12288:XSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:XSnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1005523793964F99BFA1B06F15C838182A73B0EC6BFD1938F7B481129967D39406D63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c1fe0d2501e600bc0cd135bcb74300cb69318e974df82a698a6a2f2f7bd55028
MD5 e85e586c7a2f15927a9d8c4cb10456f1
SHA1 6fb9445581b98e3e54da93cb70cb4499e20b766c
SHA512 1ef94ed7612719cc8ccd6c34659509b7792876f8ffd0c9c70a50e2462822e76caf51cd79cc17c2b73df5d1c35978e73f39e45b5fc24f66ee3390e111a737ea6b
SSDEEP 12288:FlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:FFnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1255523697965F98BFB1706F1488381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4d149fb626c35ea8a7b10ee63f50ef74047ad875bb608a17a7448214e591c888
MD5 c39f35800373fe1f9fb639bda0abaa2c
SHA1 dbfb0d6d4e6c02acf583fee0154db4d26e489ed0
SHA512 6310fcb1f5f0e8da44a36f6823ebf600395004619f66d7970fcbc4700c6a3a781f47a7ca024ff1ede2c2daaa08df021f0f65eb640c41ca1b02da7da4c1d9c18e
SSDEEP 12288:qHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:qnnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1AB5523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d7c421d9243c586d73e3f723fd188380bc43053d25018d5dabc87ae9f051b513
MD5 d8e8728b035e5d6be68f329b46981964
SHA1 c3dd1a8a7638259dfc3f1f62d7226f2ae811709d
SHA512 a1c4cf1904ad05bf0928fcc49b88d970f4b2c9742813abc0d56331b87cc31c26deee6525f80265f4dbd2f549a151bc827348398e30680100b774a286c3045aa0
SSDEEP 12288:10GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:1UnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1565523697965F98BFB1706F14C838182973B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 cb4a00ecd78ff89a1ff23018463d1ab6f5dd78f68b2e432492f6cc5580d8cd8c
MD5 d358ef127ca381c83152285808f4fce9
SHA1 4c16bfbfabdfe693ebdceb3f3b7ec40cd12bd0fd
SHA512 8a70b8417849233748aa665889fa58fb8bad86051e83e77589aad57e3d7abb238570a50d6c336ea81b28574f09e5f15c50199c6e969cca863f755648930ee2ac
SSDEEP 12288:n/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:nfnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1C65523697964F98BFB1706F14C8381829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3c973c9895565c1180851ab8c1facaf3b521e1e220eb0abd9ad243615c1b1ddb
MD5 17f4464f4e91ca56e585e6ab184abad8
SHA1 22d8d5fe7617381c22f6b24c6ee6918427c24ba6
SHA512 c79e9c2b6fc35619223314f4d988d08f6058eddb8cb0934fdc3b408159ecc9c888ac6dc72b6bb118fa461a89fc7ffc21ed82d9ac7f69cc4af8168bfab4a9113c
SSDEEP 12288:Z5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:ZJnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1E55523697965F98BFA1706F14C838182A73F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d47fa910e382dbb0f4c3ed52f797f6a8d15d5738ec54839c618e2f2664098f8a
MD5 92ee81201340bba4c660bf4d4e95febe
SHA1 c6b49b433b01ca88cc61e5496ef4f715de8d7e2a
SHA512 b85eb5a34ae37489f5825134024a431ceb0b1b54ff5518ce21a93e1b6b4a218ab3d1567ebf7d03f317afb7a1bf62b4ffc2ffe4c33a7e0d715c79eed55ed2fd8a
SSDEEP 24576:Ufwv/k9RX6wkyAILnQ/tbw/2Mkjy6Fr7g0os:jMnYILQ/lFTjN4
TLSH
T1DF85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e8abaf0320e039c270b6b0a29919e368f3b9ec4fdd55d071d3cf1981634f7649
MD5 257a55741cda1b9435ac2c55faaa47b5
SHA1 c1c757f8e66165a6bef7110458345ab70c8f8c84
SHA512 f70a0ba73e425ed7faa8772dd3fc0e363ea229b97eddb42316d3a752301577d63b7df9e7c0021105b621cd87d7fa02575b7eda93b0249e784b7830047253bc15
SSDEEP 49152:uYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IQ/lFTjN4:gySzPDLm
TLSH
T17B066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 de88bf004a6622791be2d13fb72437e4b5748394f2074b53889f7ffca2007dcf
MD5 8b57571a691af8725928a613f5381006
SHA1 a4e91e40841ec4208d49e4efb13defbe1e6f0a22
SHA512 b7431b35baea5a6f740154a005c15527baeaa19b98b9d8c3df38fafafa466b9ca0b43ac0931cd588328217c787e217ff91362cbb6ddc6a831f6a693fb9267afb
SSDEEP 24576:947Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYunQ/tbw/2Mkjy6Fr7g0os:947JUQj1irIhCnDHUPfF/4Q/lFTjN4
TLSH
T10B65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f79d61a2dbb22d6ab7fc04e5e163194adc5f9cfb07a2d0ed5bfb99255d1d1300
MD5 5a5456624aac468e9a49284957e81b15
SHA1 cc1c3434e2453cf4dc278e5c3a9491c4b490d26f
SHA512 5d61e878c45f12f38da9ad76326fa0e1cd247702641bbefeac086b6230a1e79dcb39eab57ec9cb559d96295c21d6aa392c2ac7782be1af2d60e391a6fbfbd722
SSDEEP 12288:5ssfXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:R3nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T17765F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 79a073d2cdbcac3e2dd389fa1586c7717c91d722ddf51301cc82788a4f385089
MD5 38978a371d54a512d258ecbc8a02b0d7
SHA1 3da55b082398c8b09c8b47fc066fef135550df6b
SHA512 67dcdc9a62abf0da3dcc6976e692b4650e2df14486f5cf5b0cd8c02ff6ccf82080b21ed12fcabb8cb2322c9648d34626803f92cf9e80d1e6a92fcdc60ba96294
SSDEEP 12288:hhEd9U3focP9E0UmDc5IXSaKw5OOfPqI38yDEBBM:hhEnUPv1xSaKw5XfPZMyDEB+
TLSH
T133451641762AD69FC6A940321E36D6CCA7707D01FE05AF0773C8873F9476669BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4c74f10325aa89a8ad332fee60f4d7048285335eddc9611102157d6886193f42
MD5 d641126be2a56718726054632efe6c3f
SHA1 e7fdb738ecf86e06f4d0a04af517ab4c9ac25e48
SHA512 930aaeb332d8ff662e241485b5d80ad0dbb939affd9bb83983ead72f066a4cd9deafb1a4be2aea01ed30ee1c3766c997c92dfa127df5592b0f314c3ccf0650c5
SSDEEP 12288:BzLZNUaEO3tRz1rG3E0a5pc21lQl2ZjdfE:BzLbxRdFwEP1+MZ9E
TLSH
T18A552B41A5A7E35FC9FE9033473286CDAB746C02FB452B0573844A2C98775BEB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0baaaa2a6785dd150a2cd1f2436bd1cc187898f90576dd1f4bd1f479f53288e5
MD5 ad867d72afc5bda0ba4d181f11227883
SHA1 72030ee7dd722986ec84426b5939d9dfc81cf574
SHA512 b86dfc3c0e9f069f633ecc08750d5366fbde5b50c9997616761979473bb0f30506e0938ca497bc0eeb46b9c6cebe3226a9b92c291f68fb7be3b0b4bde0bb75ee
SSDEEP 12288:M67PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:nvnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1055523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 adda379c47766f0e7a93155bfca00605d7aea55d2b495b1d7efcd24cfd2139d9
MD5 de421f68422c15cf6ce7c0c8afcf1670
SHA1 6cd805c1b937130eff5df762d1cc53d7734643b6
SHA512 33a646ed703bcf6ea16c5f80438649a5061cb6867716ee2c185769f9dd545f853729fc92a346ab3f3bbc00dd0f11bd8b36124a1b02a832fea98bb2d642b395cb
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYNnQ/tbw/2Mkjy6Fr7g0o/:xgb4mBIBhGFuQ/lFTjN4
TLSH
T15A65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 47532f7b68a6a7a133328ff6225e8467e3fe647a2a7b0ed51943712dee84b31d
MD5 b9b05889f0aa1846c5392a3178c3fc64
SHA1 a04110c318c0ee1dbad7930ef78ae2db1813e10d
SHA512 70686cb2855804b391dd753a44c7a56973064fdd727802f26c26a5627b35feedcb3fc96f3616c6b5f4884a930bd420c6800d85e9510c00f581d3bc578025bb4b
SSDEEP 24576:SG88u8FpJqH1Qzria7/m+nQ/tbw/2Mkjy6Fr7g0oR:J7ZFPqVva7/lQ/lFTjN4
TLSH
T13985F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b35ccedfc7d2c3d3dc4fa4d875fcc617ec0ef286e7740d04bf5bfeaf9719f2b2
MD5 6e580cbd5ea82f220efa539b2577aa14
SHA1 355eb04a32f41ecd48c4f83f3db934cb2a29e5d7
SHA512 09ba0b6e5e49b67be02c238fc61a2f919fb437413e361cb314dae8409ddae97d1532e112563e1cf4bc190291fd224b40f999102cfd6ba1c1fad0d6c1eb7d896b
SSDEEP 12288:HHvUrBFrEjwaQ6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:HPUr+NQ6nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1E465E12F26AC18E5E67AA17D89828609F77278521751D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8ee1358e8d5702c329d3f10d429e5e3ee546e39c6b377156bba36459c961ba2b
MD5 be8ff8621a9f5997e74a7d1105b9cd7f
SHA1 981f860efa720a2739bbb997b01dcf99f99e40cc
SHA512 e14342a3351aca8fe70a94ecc80e454522805d44ac3709dc2d12826be2c4eda4a4de8ded14e9d354d7c4b07042befcb2acb1a41e3556a8f45f3d68192aae60af
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKQ/lFTjN4:DG05lO43boLm
TLSH
T1DDD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 12f07038bbcf09de5146858e54e5a9eab045bcb0dce5929f1d497b66656f9788
MD5 c409ef4be14707679b04a202a968bb3b
SHA1 322fdc9d9542172381693fb1c800115d25654fde
SHA512 fef17462d93658db018a772163f46ebc0c8b7b8631f46935102785a1e69bbb97fa2a382f22975c75aadbceb3f08be1e8abb4b0487eafb0ce08cab9393e53fcab
SSDEEP 24576:7fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnInQ/tbw/2Mkjy6Fr7g0oH:ja5POZ3+Jt2pasx2+mSQ/lFTjN4
TLSH
T1EB65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9eedb94217b09a0f9187b21af7aed856e5c87bc3eb0b0f00bcc830b7b7eec01c
MD5 20d01a016c2853241786a67e6632dbae
SHA1 23fd8d737336ee742ade08fd90ce600144f7c51b
SHA512 13fe22257c509361e57feeaf4e65b03226f7c086c020b883f9a790cfe788dc5247eda91560b92df47165a132061167719e0959f847cf6aab60bcad365f1671bb
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkmnQ/tbw/2Mkjy6Fr7g0oy:/Nc/zEOVHFFQ/lFTjN4
TLSH
T1F5858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9a4450afb1cdf194303a1e9e91da8bb83bbfb6f3e008eed49fd5f2c79e16fd79
MD5 3c0a6948f8033c8c18db6e09e72af1a8
SHA1 ad98beddc1760a958dbb800dbcca8242f47cabda
SHA512 82dbfb191ef41cc23f14a0e374aeddaddabae8784ff7f91c1f04251eda7b1982f90cb5df4aa6804ac89b8019ba7f839896f05275fea04cf7b88d573376fbb25a
SSDEEP 24576:M8kNvNnaFeYhJNtmZBmVnQ/tbw/2Mkjy6Fr7g0oR:M8MwBtOmVQ/lFTjN4
TLSH
T1F455AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5474554d021cdc0fb751abc767767383658758b72edd252b834fa92c3497c437
MD5 4400b98887adb0d1aaa2cf253f54d5ef
SHA1 79cd7cf21a1d092c6354dd3d2ade9f0c5e0a5de3
SHA512 c1294584814adff358542a1854209909ba7be1ee95bc2dbaacdefe78e88b5bf077eabbc1ac53442d6e98a7f91e1d4d59ebd068bf403274a03248ad023e1ac008
SSDEEP 24576:ED3FHshBIYQgAznQ/tbw/2Mkjy6Fr7g0on:EDVHeBIAAzQ/lFTjN4
TLSH
T18075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-267-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1248-59-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1248-60-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/1248-66-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/1376-78-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1376-72-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1376-70-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1376-299-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1392-82-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1392-88-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/1392-83-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/1392-314-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1420-57-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1420-48-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1420-55-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1420-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1420-40-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1840-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1840-334-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1840-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1840-99-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1840-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1840-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2408-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2408-317-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2408-125-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2408-119-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3796-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3796-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3796-138-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3796-140-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3796-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3852-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3852-319-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3852-112-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3852-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3852-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3852-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4116-332-0x0000028FDF660000-0x0000028FDF8A8000-memory.dmp

Download

memory/4116-400-0x0000028FDF660000-0x0000028FDF8A8000-memory.dmp

Download

memory/4536-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4536-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4536-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5368-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5368-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5368-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5368-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5936-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5936-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5936-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5936-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5936-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5948-52-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5948-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5948-0-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5948-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5948-8-0x0000000002010000-0x0000000002070000-memory.dmp

Download