5c26530e1b5475b81e14bea51db7ee76e15fbc16d4a1c74489788c17d2db3b80

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Size 12.3MB
Sample260716-cmkb5aev7v
SHA256 5c26530e1b5475b81e14bea51db7ee76e15fbc16d4a1c74489788c17d2db3b80
MD5 1480f66271aa24da9ec705a6f046e74a
SHA1 6b4e125e94e476a888cc1de22bf76ed28a60e804
SHA512 8be84896a723861bfaed1252e1923d4706364e956e73c5f8cbfe0cef29494308febe305e71393d73e5deb320d9e6fa209cda80259fcc99e3f1a1b09a9a4435bb
SSDEEP 98304:1h+gco1pKsPW3sSJZsBgajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdWqo4w:zhr1I2WcqSjj7UlG8drCeqBvKCzcLU
TLSH
T186D65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1096	elevation_service.exe
6056	elevation_service.exe
2544	maintenanceservice.exe
3448	OSE.EXE
4252	PerceptionSimulationService.exe
5684	perfhost.exe
4528	ReFsDedupSvc.exe
4956	SensorDataService.exe
4396	ssh-agent.exe
824	AgentService.exe
1480	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3355160583806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\ResolveJoin.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\ResolveJoin.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d0fc67fc814dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c781297dc814dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007646c87dc814dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f66e2d7ec814dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b9b7c7dc814dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a779c7dc814dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa03b2bfc814dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4596	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	1096	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	824	AgentService.exe
Token: SeBackupPrivilege	4528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4528	ReFsDedupSvc.exe
Token: 33	1480	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeDebugPrivilege	1096	elevation_service.exe
Token: SeDebugPrivilege	6056	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4596	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4596	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4136	4596	2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe	87
PID 1480 wrote to memory of 3464	1480	SearchIndexer.exe	99
PID 1480 wrote to memory of 4280	1480	SearchIndexer.exe	100
PID 1480 wrote to memory of 3080	1480	SearchIndexer.exe	101
PID 1480 wrote to memory of 3468	1480	SearchIndexer.exe	102
PID 1480 wrote to memory of 6100	1480	SearchIndexer.exe	106
PID 1480 wrote to memory of 3112	1480	SearchIndexer.exe	107
PID 1480 wrote to memory of 1136	1480	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-15_1480f66271aa24da9ec705a6f046e74a_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe" --type=collab-renderer --proc=4596
  2⤵
  PID:4136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5684

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4956

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aa640e89e8447ad78e959841e723b47d30bc18a0069a4115a6e4480c9f88c265
MD5 b5b3b43a38aa1dcd8ce57084c7affaec
SHA1 e7fc148affa8f93a135d4e61992ce5deb58d9fa9
SHA512 33887f71306ca626e93850154535aaa6cc4dfae87b46911ca58ebd11ededa9bce0d9c2d61f1ab11c9e8a1c57ecd7f169b8a60b3ee9b95b1b23076ef37739be94
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnokQ/qoLEw:f3q6HjBFqo4w
TLSH
T1CED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 56a3e9cc224710ef14571547eb0b94a2f6c49d40dbf72fc9c09a70dc382ad7ab
MD5 a29596bc897fc0483de76fa7de494168
SHA1 1fe81c73dfec19de9545d68f6800aa862b238e18
SHA512 7cfb24249380f4fabdad1d3c065f03106fda356627932f5e89a2554632b7c445debfb5ba378cc55712ff15c77c0d1c3403953b6343ed9707ec555af637a72376
SSDEEP 12288:V1XLsswWkxy2lRq2czA6MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:7XYfDtczAvSkQ/7Gb8NLEbeZ
TLSH
T1C565F12873E408FAEC67827DCCB28401EA7378954760F79B03E499665F236D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2f5a069b28099abd6361edbe1594c4618783ef17b75a15fd06b278a2f175bf0d
MD5 adc283e8ebaaa0aaed0dbdcf6f06bda5
SHA1 adbe4e2f32dff0c9a0afa164afa43a192ebfa419
SHA512 ac40da08fd959b3e4d18314696b11bed32b9fc19ef127a9b2e0608843927dc06b06f0b52bf170faa2b02edcea513d42e577f88aa972583cb1f9448d9b4bc4720
SSDEEP 12288:UXZNYVLeyUji0h90ZD0wxpGZIVubrHspMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBo:U0Le5ji0hmxMrMSSkQ/7Gb8NLEbeZ
TLSH
T13D85AE16F6748371D073C0B9C5D2A68AED7130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8c2ec8c2cbd0c12cc55cb82ce7bf0da4c7f9efe985a5060edf0118cf737c2b38
MD5 478d4e90fa91b1651c23f45c6acd66e3
SHA1 9c1595fc288c9810b5cc361d3b07b7d2e71b5c08
SHA512 b38b88ede681937a0aca7f6e2dfdca455a110a99de4841b8b7f69c771dc932110e99e51e73171c02318ed745caa685689331bdbbe6f9860b620da95904b17f99
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyusSkQ/7Gb8NLEbeZ:k/ezSC6vUzPvxHjy0kQ/qoLEw
TLSH
T121756D25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e8d3f071d4d5e13f974df9f32d891c33e863423ba8fb8ffc210c3064329541ce
MD5 bc9747c84da322bd0e4a5477e0e19ba6
SHA1 8ade3ff00f7780fcb3d476f8df93bb77ef8f6d6f
SHA512 6fa435dae4f4d4fe829b0515a03fa271e5ef9a07e7a3e3e049c61c38735dd2508364da31868844b7f277f6552aaa2ee25707eee7ee9d6ac4e7a98aa4d62870bc
SSDEEP 12288:aVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98mMTmkJR4Do07Y86gw5CtCjX+NLt:aVbqPb88hv/l+6TSkQ/7Gb8NLEbeZ
TLSH
T121559E66F5748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a44bda7861a40b2a564e5e97ddc0fa4630bc75a8c80a3016b752dadf3245072d
MD5 e589f9bf2a5b08384126359273dea902
SHA1 fb20c0b53477bd1f56104b4004a2b0bba2baee87
SHA512 743132f3194b9e15ba8a0ae3a0fd6e612846910ec82f763a2f15f229f1d4831b02ecdbe24a53351300ed3e9f507dd4f31a89ac9b107c87be47489e4429f580fa
SSDEEP 12288:te1MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:temSkQ/7Gb8NLEbeZ
TLSH
T1F4452356905400F3D2B61F7268FD48401DA16DCA87307A357E99FA7B9EBEC48E8AF131
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1ca53af8c6ac73960e22adedc295aa72a54aa157416e9cc1c4b9f21bb23c000e
MD5 19b827c1ee9936844ea4fb495473d59d
SHA1 77cd08bd9e926d2075fba85276c0c0640ffbf655
SHA512 ae7f593853629df63add71504c10cb7e8593bf6cd71b23302adc36bf4058ee4d06a98999a9cef0140bd78f3889e6c84605176fc9b144188ab4f0b08185400840
SSDEEP 12288:PeBNUbTVO86U+MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PJIUbSkQ/7Gb8NLEbeZ
TLSH
T1CB65CF3BEE28FCE2C27A4DB95A918600977278714F21A3CBE165C30EDE235D45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1b83e4590f40ec31221422615a379ae2d8f50cbb7f34adb641d6e65899c23078
MD5 b69090cf93587c3d1397c2faf249695f
SHA1 54e388f35744f226e00a4088b73b308a03124ae2
SHA512 c76949804cf1a093556a25e8a8cf040bfcd9e7b05bf710c017f890c753ef9704e5ebbb8ec2914e3cff106ee494d5eda71f33dcb7c944f7fc7e9bc08dc826a872
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:ZQvGAdlCEL8c/yRNw5C1qo4w
TLSH
T1E0266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 178f09808e2643b380e6d208805aebf6cae8912e13b6531db4a66690b7c260a7
MD5 7d2247ce106f43f77130be0db649d7c3
SHA1 a994340e3314b525fef33f298223e59c23ef3aef
SHA512 3ee4df8ceb7b530db825a6b51a65f837077dec3b2042c45a089b0e816470aae7e1a4d4bc28fde280e9fff71b660638a221a43baa3ddcc7518e0e23505a1cc4e0
SSDEEP 12288:FAwSfxL/2Dc3eDLLmt0LDQewsAj0MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:m3ewsAjVSkQ/7Gb8NLEbeZ
TLSH
T10C75E031FA74D032C2BB0DB21B36C706187D79604B612AC3F3E88E9E59745D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c3d3b7ebafb792906dc8f93424034ee267442af9b217c1f0923108a36335f760
MD5 b2164af570f72fc978e4fb292bb12367
SHA1 c1304ecd6c8fe9dd8f8ac12f30dda7bcf4ac1bae
SHA512 4f4c432d4225d12e6ff6740bfefa1b3d8cb047ca4fef004b24ca957206f8a4f42032fc2017534fc004faa1c8b543a726addc7c7d830701f9cdf4434a34d2e156
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHg:KUEtQevvqc2W1cpV2EI32g
TLSH
T1D4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6d7231ca19d89d11def5ecafb476e99b391e03f27dbf05bc0ab0cbba2499ca37
MD5 3863ded91497028ba3a54fb73079ff1d
SHA1 15346f9e7ab8c62e432316354882b7f135993e47
SHA512 7bd05f262ac9ada8373419a0c8d51934117af02db0aaa2b993342ea15591446f503e5ead292436ffe4d326cd8e82645485f5e08a0ac56fc06e34b7566a92da80
SSDEEP 49152:LCbRquA/m2yL5zifFiV+XenmE3/zYkQ/qoLEw:UoqHVjnmhqo4w
TLSH
T1EED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d7c12b8001d7b0880655b6c83a26e1411323df8e518b4fdfae027fae6a46483f
MD5 073dad1895f118b9318be691a12d5d13
SHA1 5d7ee4bf195a6ece65f88a54151e8734f94750d8
SHA512 f90656a07fa8329c90944b52aa77f21ecf75bda7d48bcc9a8c26958984ddc36bdc399347e91da839bdb2e71285eb4e0bdff85fbbdfca7aad4fdd8f357e771dc5
SSDEEP 24576:gAhGLJIFoiwtA5l7S53oSkQ/7Gb8NLEbeZ:gAMyFoiq5RkQ/qoLEw
TLSH
T122359D81E7F945D4F5B3AAB899B68570EA76BCAA5E31D20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dd16de1190555520cb388c38afe71f0e1eb2cf25f3d684c39c84a9af50e8fee1
MD5 f2362372ccbc5ce817d3ddb8eaaac4f5
SHA1 c2c673e9bb770b303ced00c4775129ba6c8a4e70
SHA512 473e2816d5d8a6f511648c15977cf60882f1f2b8901ce6ec62fcabc3f2c00cde3292ca6f4b2da81ac5590ecdd92b873bda05c4a4480cb1936df39a20fb484f09
SSDEEP 12288:Smw5HEjsChN8BFgl0WDm+CnMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:LwuxOWBSkQ/7Gb8NLEbeZ
TLSH
T18A65F14A72A40CFAE56746398597C431FBF2B8462A31DB2F1760C65B5F37211BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 77ef0e3e6f4150824c85f86c37ea7dd296faa4b2ca9e7219d87726850c8a7cd7
MD5 290b727c466546fdd2c448422e66fe62
SHA1 759bda142cc6f23a6392bed30485a08d507522ca
SHA512 26d6a36f1b6473e2758f1fd90f4801f0f9e94d5c3d4d5f078a9dd4fa5a3e6fed10ec84f6a1369d27255b8589fe40d7764007730a2da91a55dcaf2d5e277c1559
SSDEEP 12288:U4Z1IyEMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:LZuaSkQ/7Gb8NLEbeZ
TLSH
T1B855125A32E420F3D1A34A399CF449009BB27887533163DF2A68866B6F77DC56D3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ba19a7fc3341f8d55047c1ef28e51a8268810db89e61daf06cc2ec98c169ae09
MD5 15872d4325bf02c742089fb1442d5ed7
SHA1 08c067b0849b1220ffc64a9ed5916ca5730b4ce6
SHA512 195b9fe25b67256c79281f5b6a7dd3c1ecadf00cbf9c7202276fd9864da8284137397f634ced2dcf01b9cad0f8421fa6367665f7def62fa8acc53bb61552b18f
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:8QRQyi36YOcPQLvw2gAf+PN3mqo4w
TLSH
T17F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 67669da027e1be0cf0ecf7a2b6ab9f99b6a11f09d7417909e45fdbca136b1f39
MD5 8a138d26a74552b39a1fac1545523ebe
SHA1 59a2f5c87e05685c2bd90c7bc8a95057b14693c4
SHA512 529835f2fcb2a2b7f421f947f414785ae1f60dca6af85f732c20d125594d108eba6e2defc261f4bed30ff5b2ac54f5f34dd56d5c520f7904a1e845ec9020e2c9
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:wQRQyi36YOcPQLvw2gAf+PN3mqo4w
TLSH
T17D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3e37b0ecfb4561dd7e6351c58a41dee02da01ec6184b44195e2f3cac18abfe66
MD5 f95a8fc9b0e9d477a86359638a180635
SHA1 00bc78d2a166ceef754afe70e7d2e96df025be3a
SHA512 145dc1c5d3e4be646a1ff76c0919fddc389e411599b237e6a13b55fbb4d8d68c410ebdc16eccbd7105b41cc81cc2ac5152a3b66322a3d7ec8837c10134be23c1
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0KSkQ/7Gb8NLEbeZ:i68Qg55nhheWu7PNU3/IkQ/qoLEw
TLSH
T123B55A33B2F200A9C44DE1769F4A872196D17C758FE0E3DB8515721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3c96acab2a8cdfe9b2f3826dd172485d0d88f198a3a97af5925ec7e8f2f87b97
MD5 77030ff18847622d0624c51520d40864
SHA1 3493aa7ffdaacd54940b44ab875e53e1423714e8
SHA512 db587f22298301707a24f6793e8316e89bd82decb86f3c0b634fbda2747511a46eb00689729929e4d93ad56df6380122e71e193dba5d95611576a5fd825141e3
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:by5112gYy5azzVvL69nLKnhZbqo4w
TLSH
T1FB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 799b5521de2ea1d28fff687fb0b9c27bb05c85a937c4af74b2fb6df892498e40
MD5 2ae7692e2ae3e53b57e21d5bbdd15c98
SHA1 206c752810d2fa3bbc10f493528db8bb29c70df6
SHA512 fce33c80511bec0eba22ae40de2978f213af18a42c0bc6be5cee35141a4650961d656d925eaafc1ec303353c2324b0ee955bd9fb31a8139246952fe863802aa8
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpkQ/qoLEw:Lu6JmVxd2dZqo4w
TLSH
T1E8D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 daca14cc540e6f60b5d16914192faabfaeccba06f2c47ab9674aa3459b49ab42
MD5 74772063dfffa946431b4977664a7275
SHA1 aee7b22b1e08d7d7d0b94f7996bf407ffe9f55a0
SHA512 faeb415c8ece327b3db1b27a325a7731240589583eb85a38cae90399da2afec94dcbcb63bd7bff93802fbbc7ead62ba0237f206e8b7f7ec4e8dd073f06d426e3
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xGkQ/qoLEw:qmifPbRhqo4w
TLSH
T1AFB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4baa7e9a902ca244aa4ad0438e342e7d6a73fd8f3c77510ee00fb91feb0d2000
MD5 6b55da25c9943077bc0bd507b9266deb
SHA1 3ca7d617f51157fe8c75c0d4603b593559f1826a
SHA512 c96667676f380fa4e80667f1e0d40b3092db2fdb9180a714ecd8f7f77d0cace4d2375bbc06c39e575f6804c9f9c249aed6297dc046ec8256eb86910fc115374a
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqzkQ/qoLEw:y5dKTi61/qo4w
TLSH
T178C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e633494373afc9e7d7b7fe98ec03c44df3e19faaafdcd49509dc05702ed293ac
MD5 f2b1ef456a2e4b5752883bd9cc2e9999
SHA1 8a162764e0fe51c2e521101596d2bc00ff4ad8b7
SHA512 b098ef0fd2224b52adf014ec6addb95c0f4791f37f1b99102cef77bff16fe683cbf7e8f4525a9e2a1bc750dd1ae9426e19e6c691f0c881dd8fd48d7889e48e20
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wKkQ/qoLEw:8X2iyphtqo4w
TLSH
T1D795BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a3b1ae7ab5bf127c4dda5cc6672ea56592ff18f12c8780ef5948eeda22ac99f9
MD5 95787bc4119bafbb1cf65de5752bd02a
SHA1 1cfc24796e39ecca6759a58634f974ac60e42179
SHA512 4ce51b4f87f9e073dcd761ce1d620e73a1593bc90772562d111ae10a86016a8c02c2b63533498c1a12369931bbf39a0e0b344f867fe180587395385e9f31920e
SSDEEP 12288:NtMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:NOSkQ/7Gb8NLEbeZ
TLSH
T1E4452359A0A404F3D0660FB258B804401DA479CF9731763A7F9DE63BAFABC48B89F574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7749c247635d0dcba888126e00fb4aacd3a0ddce541a1ad0d42e45b6277fb6e6
MD5 a1727b0d136f22a468a1717c3e9e87fe
SHA1 7a4aff378c9b558e7079ffb262a90e2fce01b22c
SHA512 783568bb7718ea52965aa7be6cd9bc070a6b49996009db55f9cc28d9ff852833f69c29146353c3528dfe32e65b2bb426492e4a7c03281cbf143afef49cd684a8
SSDEEP 12288:hQMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:h5SkQ/7Gb8NLEbeZ
TLSH
T1B5452359A0A404F3C0660FB259B804401DA479CF9731763A3F9DD52BAFABC48B8AF574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2029ff4e59c34385c461d6ff94e55706a75a3eac28ca95ba615ad7afcf9469aa
MD5 b4ed3a684ebc92b7919bb6e364307637
SHA1 88f569638809b9d29a5eee9fcd44dfc33ede640b
SHA512 e063c990116fa8da23ed1711f9f7c2104338e86131ba6b3d6cb22730e54637843aa1ad20f7f3695d938d0c2fd4a79232ac3a267153eaad9696ffd65addf6aa02
SSDEEP 12288:eWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eDSkQ/7Gb8NLEbeZ
TLSH
T114452359A0A404F3C0660FB259B904401DA469CF9731763A7F9DE53BAFABC48B8AF470
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c865e9d56c30afc5fdd408f423e6397d286c37ef8fbe2e8e1bbc27fe7cfead2c
MD5 bfec67554e630db55d2c6acce074306f
SHA1 e35f3d61bd1b4afaf9d608f11c54e2f644bcb4b1
SHA512 7632346863d76e5127ba52f1aa6bb8996abd62b527e1c8daa5607991b9d3ff7f5e253335fa77ac78f733ba88c0f1f453b8f0ddad7f9f62cd0acdfde4a45b7721
SSDEEP 12288:cV7MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PSkQ/7Gb8NLEbeZ
TLSH
T1F945235661A400F3C0769F7688B944405AB17CCB9731777F7F44892B5FB6A88BCBAA30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 98e4761d7bc40bee859491fbf30360e9e96c920af3cb45373a94c76f50bb7ec4
MD5 0f2a673d1a92fad88ce3e14fb750279a
SHA1 44040522202e367c0344ca2a9776654ccddaa00a
SHA512 6b1968c58a088f1324cfdd31857dc11dc7c8ee90027db1bc9e859a845dc518c180d7341b17c7f5bf609b0c097fff178165d036bd93f5278b9610562629f57cb3
SSDEEP 12288:oDMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ogSkQ/7Gb8NLEbeZ
TLSH
T1B8452359A0A400F3D0660FB259B904401DA479CF9731763A7F9DE53BAFABC48B8AF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5d864ac68c8826ccaa619d29114557ce10925f718b9869a21d9c09bd2a1c065e
MD5 0f407e7e50f81c7c99a1c1c7281217c9
SHA1 14cbe854bb5b1e3d2b4fb1aab59ce20670b621ce
SHA512 1fd2a751d2e403e345da5a5208021e526ce6993d8b685ec99ae4f43b54ab93dcb86fcbf4b7e2b211e74151fb5e7c039a84aff4155f1a7bd182d53bffbc1058c9
SSDEEP 12288:+sMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:+9SkQ/7Gb8NLEbeZ
TLSH
T1CB452359A0A404F3D0661FB259B804401DA479CF9731763A3F9DD53BAFABC48B89F474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 77349fdb77c4dcd56c6c29a4f807434eec0fb4fb9443ddd5f2165dd2e3eedf3a
MD5 90e9fc3f9c1513629e2ab315ceaf92ae
SHA1 148dc08b07870f97124154eac72168b8f824e532
SHA512 ddff602cd2cd14126df582c5e4969bcedccecce8457d123ab485649d2c5da7e47b532738b5219b300466493a33c76ed4acca813ff3c970d974ce40119fbf786a
SSDEEP 12288:C4MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:CxSkQ/7Gb8NLEbeZ
TLSH
T1E2452359A0A405F3C0660FB259BC48400DA479CF9731763A7F9DD63BABABC18B89F470
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 78b159254693b1d7cb630a0b5763d13aaa8cada1170362da08ba8b88958ffde8
MD5 e0e774c97e3f4ae352407b2d234dfa4b
SHA1 315d39c480e1883b8ae00ebe8c4033bcfb3ae6b2
SHA512 211b3c2bcd6ceec6db3accab30e25057dc07ad4e227b293ce601090b515e943ce665c13b9f3eb8b956320fea74f19d1324ae94cc46c1acf3c6ffebd47dec531a
SSDEEP 12288:LiZwbQzzFEoS2cPvywMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:2ZM4zFVSOZSkQ/7Gb8NLEbeZ
TLSH
T1FA65F195B39008F5EC67863ECD658805D6B27C5A0B70C62F17A8362B5F737A01C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 328cfd7a12dd1815b5db99620edeb178b432983f6f727eaee0a6612d7f4bc1c9
MD5 380530df5e1cc75e38386032380ea142
SHA1 9b005d6e2d9752c418ceef1871c32daffa4f4fe3
SHA512 be7dd32dfd4fe0d106116007ce6d40f2e760bfa471335a7ecda426b720ac646a2e3943f320f9be3bf4cf3bdbdd51820d91091698d53b7ea60dc3da4483e8da7f
SSDEEP 12288:PRMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PqSkQ/7Gb8NLEbeZ
TLSH
T1F3452359A0A404F3D0660FB259B808400DA479CFA731767A7F9DD53BAFABC48B89F474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f03e319428f4ed80a7b6233baba10d9a229dcea722cdb73e2d5c77c961a6002b
MD5 d254afee8195e66c93f160eb54525fa4
SHA1 2185c726658d2af49d7ba649e8eacef5a6dcd526
SHA512 c29be640b00721fce80215c76db095f7ca072153015f0e03122f8c9d87093f25929a660e848794e3556a6fcc4a5afa3dde266117761f76384a619b59e87fc111
SSDEEP 12288:CFMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:C2SkQ/7Gb8NLEbeZ
TLSH
T1DE452359A0A404F3D0660FB259B848400DA479CF9731767A7F9DD63BAFABC08B89F534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0777f026ecfe5c1c0e48fe77820a32e5a3dabca93d91b472c45859341a50c832
MD5 b218a6c92a038020245dc86d6efccb52
SHA1 4f788419cde9371f0a62496cdc8ccc6ac7814888
SHA512 b63da90a10b0599c57fbd2bd6c4fbfb3dca9551ff9c55117a8f3e7bffc959208350f5a5ebb71401688d9691d48257c61af92da69a046a2c894b11829e743c06c
SSDEEP 12288:8yPz5L8EMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:lzylSkQ/7Gb8NLEbeZ
TLSH
T18655024772A120F6D177863588A50901F7B1B8764730ABAF27A4477B2F27690AD7FB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 677c1682ec250b916e4cc134f65820c6f52fadfaea7aeae87b73bb1a0f5b1de6
MD5 43147e5f3b9d610e4829533834ca911e
SHA1 ef27669e2351c7bb2af1bf7d9c2327fd91333dca
SHA512 07c81709eeb07c22aa812578c0f73729aa20f6e117fed0492751403c69f43dea5be40a221b7dce74857f966323b973d47a8751c813eae9ddb843b304a02a49fe
SSDEEP 12288:PRMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PqSkQ/7Gb8NLEbeZ
TLSH
T19F452359A0A404F3D0660FB259B808400DA479CF9731767A7F9DD53BAFABC48B8AF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 94e5111b6e6f01cde6f0e27cc82c49ea2160d4694089224f6db1d7d36bfbc25f
MD5 e58331cdc3c18454d984fc4dcffa31b2
SHA1 b9786a5617e5cc68063d7e2c316afd6983bab2be
SHA512 4767a347929d6ba6e71a36f9bc77558a0536b599c3d48d2d74c421c939ced717166e1bb8c3e02fb5f67fcaedda65ede08bad343d9d0e1815386ae6b378a63eb3
SSDEEP 12288:5RMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:5qSkQ/7Gb8NLEbeZ
TLSH
T1AC452359A0A404F3D0660FB259B808400DA479CF9731767A7F9DD53BAFABC48B8AF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0922e0710c02890d324d46470203cabcafb34d742be1e2f35a468d98417c65b6
MD5 b600d36a11f6941f642022b4dd07fc8d
SHA1 3e7de2784e0b47ab1089cb5455e9f64ae53cbf16
SHA512 2a6a0cc1a6041aad18cc19d75ce59399999b3d61b00c00f526df608a910bef55251b7068fbcd38f648da4583ddd5140402c6f034a54df5a60ef6bdbf8f779c46
SSDEEP 12288:myPz5L8EMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:bzylSkQ/7Gb8NLEbeZ
TLSH
T17855024772A120F6D177863988A50901F7B1B87647309BAF27A4477B2F27690AD7FB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a520b54bf296353fd107f0f1420064da9941dc3a47526fe2f945813e6538bd74
MD5 c72b65cd585fbf5a95fad12203fd8ba2
SHA1 567b25e7bfbb5ef687d615d0714a32cee8b707f0
SHA512 aff8dfcf4897b469e1d6fa0cd65bd84f5a1afe8ce2066d2a70c7a17a4c4f7231d1fffdb75f3dfb06c1afe8024f6b024ba03921014ae36ea62a2c611bb468b390
SSDEEP 12288:cCd9wWYoaLHF3z0z04PDvhGMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:FTpaLl3z0zDzSkQ/7Gb8NLEbeZ
TLSH
T14E6501A5B39008F5DC67863ECC658806D6B27C5A0770C62F17A8366B5F337A05C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a4bb6e0fe75a0f89894338d794ff70e6f12b6d11b1a729c4b61b64fcf9f5e40a
MD5 ccf78b59ce45b64934678c71d66180ef
SHA1 49445f51b1c4aec43b2d5898e29b691bf2cace6a
SHA512 4e2f3634d678c90d9343e2aeab8adbd3c61f5aa3479f2a18eb6d6f029ae3f8055e0f4da4c06ba924998d314f6a2cdbce5b3214285f18ce0b62c3e8b71e60429b
SSDEEP 12288:zi4e7NRdTfgwCHKy7GLbbdIvvMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:z3+d9CHKy7GZXSkQ/7Gb8NLEbeZ
TLSH
T13075CF90F3E410E5F0B79A358D764511DAB67C9A1B31DE8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3d5b101253b6c2d1ca4707c91045d923307875476940806242fbb4a0f8e4b7dd
MD5 b4185233ed20e5bfa77f612415c84705
SHA1 5442b1e79b0d2ba272f6ef4886f85e12eafebee3
SHA512 c43e7da54d7e8a11c130d8d12e6428781bc79e231b5facdf7167e9baffefb7252393d2afc0df6608f994a077fc9a021627a91a401a8380668be97ffb03d4bbef
SSDEEP 12288:m2MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:mjSkQ/7Gb8NLEbeZ
TLSH
T172452359A0A404F3D0660FB269BC04401DA469CF9731763A7F9DD53BAFABC48B8AF570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ee19003fab25d4112337a38fef6525fa452cb2e77a3f820ce7c98ed591c2c34e
MD5 b78be5b0ec9f218753f997ea359d4b04
SHA1 ac9505c7fab9a53eadda10df640ffc96b3664927
SHA512 8132956817dfc5e72b237a49f0603a17ab29dc87b8434e421229124c055bb0907be1a5bbdef685a0796b14b4bf77e48dc00a4fb3cd84857b471d043b275d552c
SSDEEP 12288:okMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:oFSkQ/7Gb8NLEbeZ
TLSH
T162452359A0A404F3D0660FB269FD48401DA479CF973176367F9DD52BABABC08A8AF530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d2becf453b89df9a50901714051c9d91c3f80f1ebcc16aaf6c89b5c5139cda1f
MD5 47b0af49bab96b4d0a271638c36593a3
SHA1 38cbb7e6d784ea5055df0a8f6b8ece4cad53999e
SHA512 1da558a289ded66ec1fa71c308dc4cb63630d55862e98943483eec460a7b679ddc20b15caa3f522654d308c28d9107f10432aba4f748c3d4cd91e97102f820be
SSDEEP 12288:nvMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:nESkQ/7Gb8NLEbeZ
TLSH
T13B452359A0A404F3D0650FB259BC08400DA479CF9731763A7F9DD62BAFABC48B8AF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 508c1d8db4bcc0d3d99ba69599bc2923dbd93c5c5b0241da7baf5eda66b87939
MD5 88fee9f08b0eff9c95d4f1c69757f4ef
SHA1 e529f7f9be987f602f9c508f85186f55fe02ffcb
SHA512 d5367f165f7d2a6b7953c75950c9a15735fade57a3712e2d77a309523b1f136f115da738330db9307637cb2ef03d7f3273b2c8c477d0a6892a0796d0b75fc406
SSDEEP 12288:5RMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:5qSkQ/7Gb8NLEbeZ
TLSH
T153452359A0A404F3D0650FB259B808400DA479CF9731767A7F9DD63BAFABC48B8AF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 62f4d659a19345c3a9cab7025256f2778fd0d8f3f9de82d8e39972965c6c946f
MD5 40987d14f0413f9dfff3351951f26d4e
SHA1 95f432aacfef26d90a9984c969b176e492cc0d9f
SHA512 3de66e19c59289ba04dea60c8f92a2987c1aec3394db718488608013a1e96884faf871de9d2f9b87c6f490c83072a214e6a2a2c59bbddd07ff03241a82c2e0be
SSDEEP 12288:Q2MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:QjSkQ/7Gb8NLEbeZ
TLSH
T1A8452359A0A404F3C0660FB258B904401DA479CF9731763A7F9DE53BAFABC48B8AF574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0748a2bbeef1f0a35c9237ec14b21d6b2b8685c8cc7148a84adb08921eb20edf
MD5 d1c2d169f070be80dc0de79253793117
SHA1 e98e4f492dd7854ac2e1bb0acfbb323aeb0d4b13
SHA512 deacb4d4ba4db64f4f608a001a3e312bc87b2c521474fb68ecae9b6906c06ee07e6692f9d46c83a80d35515bae7be063ad2ddc7d28edda75627117c2ba4bd3f2
SSDEEP 12288:JZMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:JCSkQ/7Gb8NLEbeZ
TLSH
T1B2452359A0A405F3C0660FB259F948400DA47DCF9731763A7F9DD62BAFABC48A89F434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 32c18b7fc9a2bf51bbfba242034194acee268ecb0816896ea66b4998026f3f55
MD5 b9efc106ed293ee683483bd0aeecfc92
SHA1 89e5f392d68db53883a083f2ad9986f393ea9b86
SHA512 47f61d9563171d5544a1d3d7947a8e998cf399dadc8dcffdc9b81656b2024f73f45dc606e9eef3ab312964de7d40bc4bd57019aba3a6c3d739c5bb59758e7e7c
SSDEEP 12288:YDMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:YgSkQ/7Gb8NLEbeZ
TLSH
T187452359A0A400F3C0660FB259B908401DA479CF9731763A7F9DD53BAFABC48B8AF574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 787e8482e97b2d41cfe87b9d635cc5bfcb51565df732bd09f1c7dcafd837d363
MD5 3654da67f87b2d81f0de57d5db75d23f
SHA1 fc324780573838b433510ad65c67917474268603
SHA512 e09ef677af837fa200943545f3c68357a4d71fbf274c5b61d0b180c7fe0844c5b9137c732d495a1ed886c78b3ab82c3011d3bb143cde35a8ad07463cfb526272
SSDEEP 12288:WfwvD5uZ64Lk3tRX69qkyAI5XMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Wfwvqk9RX6wkyAIGSkQ/7Gb8NLEbeZ
TLSH
T19A75D029EBDC04E2E077923C99B74606F6B178591B31D2CF129A536E0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 40cc45aadd8dbefe7c17bd327c0c64e948b46fa87f2f0b23b5ac0644603f6d2f
MD5 d208f238a14cb39bb45d9cc308fc2de2
SHA1 7a5c77f8b44174836ead153f2f7c2e43f792a12b
SHA512 bd663526ac3f72845f6beb994143b0d5f953aee786bb039915ec2f586b09238c440d234a18dd67c22d25e32d0b31d6194bc2b018ce026973e6899b0f9d72d42a
SSDEEP 49152:kYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qkQ/qoLEw:qySzPGqo4w
TLSH
T1E1066C56A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f78cc5a4a6f25e42bc186821278e3cbb37616d5337cd525ee466db428f2b04f5
MD5 fea04638c7121e7dada6692ad6a724a6
SHA1 5158eaed13d3b3f019cc3ecc9cccef673d8b15aa
SHA512 e90c4f36a1611f7d76c260919963dbed22c5e072af6ef5b69121c1046cbc1706e822f863542f8af750ba27777d7703ccffa67db32d2ae4efd5038dca479eb12d
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpSkQ/7Gb8NLEbeZ:V47JUQj1irIhCnDHUPfF/akQ/qoLEw
TLSH
T10C65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31DACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2a1ce766dea60aa558701e11ca9950407853b6713d877a6005f1e6f82c57981f
MD5 dd4adfb8696f2e4acaf33270623fc8a2
SHA1 2584932f80edc13a6c86797cc74b75a2ae37cd2e
SHA512 1ab31c8ee3d1cfee76c466d4fc00b71420b5d040d2ee847bcb761f5636884598a7f37834a0394da91bd6f9e8d1b6590810ce4019df8fed939135df32da7bac78
SSDEEP 12288:iysfBMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:WaSkQ/7Gb8NLEbeZ
TLSH
T11255F109D29802E5C06E6676CBA54940B7733C5683F1E3DB27C0F53E1F7A984ADEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 94b659607946585fb2d1459f3f5ed415d97df35f3d535203b3b88c530917af60
MD5 d269de9580a73f39aa49dee7ca5a6b57
SHA1 1d65de79ac9858e8c08345a70f9d86f0984004cf
SHA512 a257557bf522225d9d81f5930384d8806748990781f50e73f74ba6bd2bb2b03d501a0f339b5e8f3dbc2a6ce23298cfe790a79c1431c94ad795ab00c653833cf6
SSDEEP 12288:UZqEU3f3qNvA93qQXbnfDIzVR9/82QYTZyo1mGe0Ky:UZXUP3q1zVR9/8lYTZ51mGeN
TLSH
T198351800766AD75FC6AD40321E32D1CCAB707D41EE05AB0373C8973ED576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 27397fe687367381ce0163ea68ae8a38cc3203cbc5088c7c38a724de7a7d7c84
MD5 f53b229c58796207a272d8715d634196
SHA1 0ceebe42446b0f0a1564ba78b12f64ddf6206e7a
SHA512 a81a39d39797a1a62ba2c70059d7c6b6863d2080581a8ab3ef1bbff158b5cfa84d2af1017c5d041f90f593eecd2ab54592e615b1d58b3d71b103414d9b61bebb
SSDEEP 6144:xBeJaULP9Pq/PzYdD8s6z93qQPbn+vR0scbVtMx8cbVtMx7zWUAA327M5E2bgB06:AZqnzY98t93qQPbn+JC2ExUd
TLSH
T16465C9816437A38FD1FB60710729AB4C6764EC56B7095F26B3C8453AD82BB21A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 775a976dc074ced8c73fa322d9f2e975a4085ac231ddc6cf1ca6a9a1061b18f3
MD5 7cd0aa4b3597ae2364a7a99757f499e2
SHA1 6ab1ba0d851b43d15b315cf0abdc447538e09f89
SHA512 39cdffc512a6bb0376af1b2314f23144d81b4453a2cafe96930367ddc0d9b07bc6f5c44436a2f4366d6f7c49a03e3c48ff113d9535d18f1ed4676a7e16b1b2ec
SSDEEP 12288:Nm7JMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:8ySkQ/7Gb8NLEbeZ
TLSH
T12E452356A19804F3D0761F7118BD44101D6979CF4B30B1F77E48A26BAB7ACC8ECBB625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c1ba80d64f0244a133352a734b99556de22c516629f72ebf48020819701b36df
MD5 09cb3fb21a5095351c31c986eada66b8
SHA1 bdfdf4f70c9a4e032319a16d1a008db2aa57999e
SHA512 d4ba27877acb0a3b343529ef248f57b78ce0c5c3fbdb55af9260cca4f7e077fa91c0e33f1ea1e3b45b5dd10d888a1b281492dca46908a7da607ecd0a5905bbc1
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYsSkQ/7Gb8NLEbeZ:mgb4mBIBhGFskQ/qoLEw
TLSH
T1CE659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5dce8f04e753716a86d844b5ec24838dac9db3611793e889627b2dd7723830a9
MD5 79ab452e344b5411fee6deea3b9a228f
SHA1 a1449302e0f904c2eb0a806ab99316ab44aeb6ba
SHA512 3d6b2fe6da403288346b99b583d31cc15d8582c593ab01c15aed715d0a9b2ee9a896a31711e1e533b3fb97a709aa393a8424aa1286332f4bf8e5dc55de4e18d3
SSDEEP 24576:TG88u8FpJqH1Nzria7/mZSkQ/7Gb8NLEbeZ:i7ZFPqV0a7/dkQ/qoLEw
TLSH
T19885F16572E001F1D47BD13889964663F6B2B4160324FBEF0BA88B561F23AD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 81ebf0243e7991323d5db1a021e41787e263526dd850b8d091a113eb20080063
MD5 61d877e35e8d33da23287271ec966060
SHA1 cb22476334e00ff61632bd932fc3c5145628d087
SHA512 749c6a3af4b932a111d04bcb9c1078459562cb59ca83c9c3c3f96d4fb44f41375e085a317a9ae9790ca3ce23d9167ddd3227b24411eb2a9ef0c227cd0ec47432
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQkQ/qoLEw:RG05lO43bTqo4w
TLSH
T117D5CF6A62EC11F9D0BBD17CD9C64A0BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2bc03f6addf64bb5a05573713c7fb68970ed46d954169d75c728134aa13ffe2f
MD5 1f86c07d2f680c8c0830f81454e1b9e3
SHA1 116d336a27bf80c1f1a14309bf870facfd8d7e4c
SHA512 ca258cff74dbc8a288f64d167fbe3624879e279a0afeb49c37a542acb13d2048fe5ac57a347d4cb98029a4e36310c04958db575c3524cee31ec5702d160774ad
SSDEEP 24576:0fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnPSkQ/7Gb8NLEbeZ:sa5POZ3+Jt2pasx2+mIkQ/qoLEw
TLSH
T1FE65BF5EA2FC01D5D1B9D17DC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 183636eaa09af1e15d8bf797f530160d232f48b5afe6fb30849fd02424db8822
MD5 48216f6fe12c5b584e44b7254f70d33b
SHA1 2c284354f0963f04909120b27113b34de93ff3ef
SHA512 bd4ade2ebc4adaacb5a9142888b259a9987112fbeaac3a6734434970182c7e106ec921614aaaec9ecbad7c242e1c920c855714200f7002c2a290184b78540503
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkhSkQ/7Gb8NLEbeZ:lNc/zEOVHF9kQ/qoLEw
TLSH
T1A2858C1622E901E4F1BBE1BE89779546FAB1786913309ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2cad3097c4bfe945110e9915f8aea281679833bcc21159d3929e0738a0da260b
MD5 3f86c08ef69bb0762c9af589c9e1a41b
SHA1 b9031b36a4d14511fbe2d7143784a7a3f3642f3e
SHA512 bd0cf529b58c8527eb2364ec72100d1f8305340e0196dcd0a64c17d6aac03ea164a7d43574806abd73d680dad8f3135d958b4b226c7536f02c30d8b8b1cc1526
SSDEEP 24576:F8kNvNnaFeYhJNtmZBmkSkQ/7Gb8NLEbeZ:F8MwBtOmdkQ/qoLEw
TLSH
T14155AF6EB6B806E4D1FEC6B58D238512EA727461073293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cecd1b5e6f2e2da1b77fb4902002b6f5f29b91d4c4906f8680d040cd80c4706b
MD5 9b7c80d08153b606fa253a1a0f7bb142
SHA1 f6d7cd831eaa175a01514d591166a07bf933acac
SHA512 a587b83036afbe3b6b0760c35f304fcac6963ccd7701c5621e8219591dab8d3e59e375348a986c609a500115e853a405670db0d82caeb3642a2c307831f89b7a
SSDEEP 12288:QHvUrBFrEjwaQ8MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:QPUr+NQNSkQ/7Gb8NLEbeZ
TLSH
T16265F12F62EC18E5E676A17D89964609F771B4520312A2DF02E0817F5F67DD8BC3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 3b539356ed6fdee5738b466c3b0f39dcf951c4ce1442aff1f10aebb18ad4d85c
MD5 7644337032f14945766c039a46a81b50
SHA1 de01b2e6a1f60e243790f13fba7ab718303844ba
SHA512 99d01ed3c0564ccca410cb95d18e31352984973e75399ae57a6640b1aac80c60f66661fc4cd677b8ae79e571b1ecf87edf69482b0006ab4ded40c1e6bd05292e
SSDEEP 12288:yQcMxWDXN1Dp/fshBItT1IQgANMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:QD3FHshBIYQgAuSkQ/7Gb8NLEbeZ
TLSH
T19E75E13DE69C00E5D47AC1BC9A634906E77138A9033266DB16D4C1BA1F6BEE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/824-145-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/824-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/824-139-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/824-147-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1096-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1096-154-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1096-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1096-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1480-162-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1480-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1480-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1480-155-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2544-66-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2544-53-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2544-64-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/2544-54-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/2544-60-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3448-68-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3448-306-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3448-69-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3448-75-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4136-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4136-26-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4136-34-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4136-28-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4136-36-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4252-79-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4252-81-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4252-321-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4252-87-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4396-132-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4396-126-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4396-135-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4396-327-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4528-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4528-339-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4528-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4528-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4528-108-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4528-102-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4596-45-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4596-6-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4596-50-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4596-0-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4596-7-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4596-8-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4956-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4956-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4956-324-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4956-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-97-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/5684-91-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/5684-92-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/5684-322-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/6056-182-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6056-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6056-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6056-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download