0204464ddb8cc677707bc997e1f4dc8df97e15907d1180526b0608f58d50f00a

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260717-xevhcae19x
SHA256 0204464ddb8cc677707bc997e1f4dc8df97e15907d1180526b0608f58d50f00a
MD5 8ea4171af30f295a815fe8a344409529
SHA1 331aa6ca018aec09a085536797b74e2325d6c4d4
SHA512 9887f404aa4cd24153010b06695932538d22b1f51317a4059cb7202c74f2db7dcb82392b1f213f8fa72aca83c5624c4885d466c1db5df12f3a017a3cf2c3d0ec
SSDEEP 49152:A+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755pJ:9/PvOBjcXvvOOc5TGGMnI
TLSH
T1D8165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2508	elevation_service.exe
3488	elevation_service.exe
4784	maintenanceservice.exe
2956	OSE.EXE
3372	PerceptionSimulationService.exe
2668	perfhost.exe
1224	ReFsDedupSvc.exe
3852	SensorDataService.exe
2444	ssh-agent.exe
4104	AgentService.exe
3716	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\edae17538f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030a698e31c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002def89a51c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1ec0aa21c16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b9707ba31c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dc7d6e31c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ecda3a31c16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000953ad4a11c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe
3488	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1324	2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2508	elevation_service.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1224	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4104	AgentService.exe
Token: 33	3716	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3716	SearchIndexer.exe
Token: SeDebugPrivilege	2508	elevation_service.exe
Token: SeDebugPrivilege	3488	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 1484	3716	SearchIndexer.exe	103
PID 3716 wrote to memory of 1404	3716	SearchIndexer.exe	104
PID 3716 wrote to memory of 1636	3716	SearchIndexer.exe	105
PID 3716 wrote to memory of 5496	3716	SearchIndexer.exe	106
PID 3716 wrote to memory of 3452	3716	SearchIndexer.exe	108
PID 3716 wrote to memory of 4464	3716	SearchIndexer.exe	109
PID 3716 wrote to memory of 1396	3716	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_8ea4171af30f295a815fe8a344409529_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2444

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3028 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5496
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3028 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fd34b6b6ea69d834e3291be25a95f58ddb7bcb0c2a8ac35e2b57bebda24d433f
MD5 5372b9e2ff067b203527431654572efd
SHA1 5d86577fdd527c10438b2a1ebe1c20012ce2139b
SHA512 2c171d8520f2a54363ddab4938993590c0e6a2726259de0f265a04c461aec55524e7aea6895cb340e29c56ddf76c883e6708180b45b56ed2d359b7b5662afcff
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEt7Uv+MnIIC:H3q6HjB/GGMnI
TLSH
T11ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1f4a9d040b4e73bd330e87f2fbba939178a29ef3b128e14d91a70a5791ccd5bd
MD5 ae28eefdda6d60ae1368fbdfa37cb4e7
SHA1 b5cd2f9f60786d213b7bbb4681b134b36528b007
SHA512 c31ba00cf00394944001c3c709c930cad0b43a897e17913fdcc9b124252b90a59be8924c751f8e98f6a17d05a7496672e2002523584368470a3bdd9ad6c16ab5
SSDEEP 24576:fXYfDtczAy+Ys7Uv+ahF8MlMPuuICiJS:qtc+t7Uv+MnIIC
TLSH
T195650128A79408F9EDA7823CC8B2C116E673BC914760E7CB03E495765F236D45E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 25de3f14caac742e88018965b9e5939f392edf6bfcba10621909da7cc9829973
MD5 97fb9ecabad2cb34240440e8a6fbbf30
SHA1 de2eae9fc54b7cd80969c62f5a6c698a10e0a700
SHA512 48a339c497bc95d2e7f3a5eecaeab2b5d9e769b2512e12a5c5f3170516ce5d42a9085ec88cea7e416390dc47a149d49e16931ce865567797445a4c07b94243d9
SSDEEP 24576:s0Le5ji0hmxirMJ+Ys7Uv+ahF8MlMPuuICiJS:sPji0Ac5t7Uv+MnIIC
TLSH
T11C85AE16F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 666d1baa597ca159d01a03fef045e78bb43f9255050dba02f0f17666310076c6
MD5 5869d5def412457f0cd1b7a9e129a0be
SHA1 ea163a987790e9fb3d261f3dcde5c6a59ff5151e
SHA512 9eea19eaa0456266de7ec153cbb38e65f1c5bdf7a29046dafea10edf404e9340d4f9e0cf93264ec5760f2b2f95b1fcdae7f89a0073906328233552cdb80a9466
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuX+Ys7Uv+ahF8MlMPuuICiJS:W/ezSC6vUzPvxHjyFt7Uv+MnIIC
TLSH
T1DC755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 56e8cdd3fc119080974d45698ed4a97a7df1ca1ce057e2add949b987859cd2e8
MD5 0fa3d3ac098601bda55c10fd19b26aa5
SHA1 58b7bd98e96a5ab8d40b21ec2d588223ca4979a7
SHA512 3ec0047a4ba0b5e15032340d36aa47f1ea4c5c3e2d103aeea35916afb023a14238e6719cbe3be5c88b4ebce140168f53468d8e6eb45a17697380259e4d023636
SSDEEP 24576:IVbqPb88hv/l+6m+Ys7Uv+ahF8MlMPuuICiJS:IVO88hXl+Yt7Uv+MnIIC
TLSH
T1DF55AE66F6748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8eb233437fc5cd7a9907ea1b48d8a0e4bdac9ab0af9c1bb722ed8ec56943be21
MD5 bb626439a6d2aa1754e4594449cae4c2
SHA1 be74a4c50955b3bcebd7c3f27f2a64464880657a
SHA512 9f787a972f79252061eb334c6c1c30f561678eeebe76b526fb962d5dd855f3137a6da6d99dc855c8bdb252f7aecd3080afdbd3c14db63e4ee53c4887b06afa18
SSDEEP 12288:oR+ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:oRN+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T15F452361CB0510FAEBE96230B5B9819B61F2BEA0596317C358E07163DE7D893DC67383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 74b82e55dacf10ff58375629899b4193c9fc5fe105f15b1475e685a323755074
MD5 1834b2996b5c026457656ae7da035c3a
SHA1 8bbacaa3d4c0bc667af57f213f4b525e9757e321
SHA512 b7294c211eeadec7a4d968e22e81dc312a7c536f540f49e2bb0cdd90bfb27e9fe4587554ddc1128154fc120cfa5e5de31216c341e81af78f9eaa7a78e4316718
SSDEEP 12288:ReBNUbTVO86U/ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:RJIUu+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T11365CF3BEE28FCE2C27E9D7856918240E7B278704F6293CBD164820EDE275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b749c4b67528a0a1b97622219edf794437f2940f9efea83133aa1bede39b7e61
MD5 42fa718f362f93cef1aebc4453b57ec7
SHA1 9c2c8ba88a79b1addd166fd1571fd4dc6977fd89
SHA512 f7adc07916be3e19b9a8cf58f2c8b161f659fb9dcb2096487bbcf2d7395632dc13633c4758134be991f7b1d7548a2884f4536b44646f19bf14a588dd741b4816
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:cQvGAdlCEL8c/yRNw5CeGGMnI
TLSH
T193267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 733d5dc4a0d1376996e7c9d51d4aad83f13167abf323753903a1b88100541559
MD5 4a9b85062a401c02b43358ae10e793ad
SHA1 91028edd089a88c6c36a8106427a05597aef6fb8
SHA512 b35b130a3579b125c0b87f51e89d1d52eda5da2f3b35be2c6e578e126da22ba79f3fd5d8d10593e58c9ec8e56ced18a81aadecefc1f33df708d465827e1eee81
SSDEEP 12288:FAwSfxL/2Dc34DLLmt0LDQewsAjBep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:mdewsAjs+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T13375E031FE74E036C7BB0DB21B36C716147D79604B621AC3E3E88A9E99341D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c798e586fc8025432f5eac3c991402600bda708bb506336865b75eb319d120fc
MD5 829c78b78fde8ef798a733e9e5887b5a
SHA1 fa1f1af7080390c20c9aeb26cc61c0c6081c4053
SHA512 5549b8c8b9d069ff2efcc058fa8a9b95b92ca6c99cc7ed79b3164f8baf1d0e0b08cba045bc017888eebe29a8dab13c0f3f4c7a475d7cc49683dc4dcb2d647184
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHg:oUEtQevvqc2W1cpV2EI32g
TLSH
T1E2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2b3079d54783a3949e1e7240a51298c33b508238eb40fe3cbd5ed7b4210fec47
MD5 acd5180f7ee2aaddec215ab45a566480
SHA1 545c3a306a463013be7a5ef691a650eb1c37ef6d
SHA512 03ae4ff63fc65cf147b625d29cba233aa538cde078b48d65bb037ac79149e2628e72b5890230827eea84a4aadfafe856ff2f5a0851ad4e4b12aff4d2e96540e0
SSDEEP 49152:aCbRquA/m2yL5zifFiV+XenmE3/zJt7Uv+MnIIC:voqHVjnmaGGMnI
TLSH
T14ED58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6af6b0741d51d074605adce075794804eb50fec02c2cbcdcc14f3814d75766ec
MD5 7a61968e00e9446823395d0d3e5f72d5
SHA1 23cb8a6720492e7a61f75ac4888b9c8a842230f6
SHA512 6587d97c85ff7aba3945b92e15a79f3dd12aedca38f2ab845e5f28a757c9bc742e6a0b5c2a1bcc20cb160c8543756989d92840c607c910e41915b05ea4140c77
SSDEEP 24576:KAhGLJIFoiwtA5l7S53z+Ys7Uv+ahF8MlMPuuICiJS:KAMyFoiq5Kt7Uv+MnIIC
TLSH
T1C8359D81E7F955D4F5F3AA7899B68171EAB6BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 72310bb3c536fc921cada44960d236c7255598562147f4003bf2c97e1bcdedb5
MD5 c82e2785122d948b30189cb2288e9ff6
SHA1 bc283905cd682c07f8124b6e0e0c4995d766dfc3
SHA512 fb821cd6e4afec607047e92cf73caaab7a0a21bd9c5ae732e9902824e7c469068485f6ceab6127d1bd9876098859faabab3e4b6ab63f22e280a19d747038e205
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+C8ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:gwuoOWI+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T16465F14577A40CF9EAA79238C597C136F7F2BC112A21D71F07A0C6576F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6280e4adb707ab586fe84e4b2325f0a4e8c0ce035d8d361c31fa5a059deb339e
MD5 5039bdb53787ea18a17f34a03a7a2715
SHA1 c5ab2a2ae125fe6606b9c80ff7e723ea2d8340d8
SHA512 41fd39c920b5a1d7c3d9277289bacaff289bfe7c69203e855c1de5a7c9254bd95e0370983c875313622eab367de5bb8c857f79db19888067c367fac8adedfc22
SSDEEP 12288:WBZ1IyRep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:gZuR+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T177551255239420F9E6E7523CD9F5824AE3B278A2677343CF15A04266AF37CC25D3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 98341af5e2976f509efd90a7c75bec61f8c8c261848db40a8e7fff9bda11c591
MD5 e909d222ae9747f0cf319386337762ba
SHA1 47ca29ebf31c3488f840bd807c5a46e9490cdaa8
SHA512 58c180e33d06fdd8cc276f87a66bf69a3af838c0bdb604fa746ae3bf7ea31b907ba660cbe23171cb1b4155d820cb8440daa5e1289797e82acfe4e17af5182e4d
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:MQRQyi36YOcPQLvw2gAf+PN3jGGMnI
TLSH
T154667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a8caab285a5943d7f696b96735353bdd3bb5614b26521ba0f8590dcd5995b982
MD5 200b238211620db792607de3a5f3ed3e
SHA1 a62c0241a5a2f63a3956c3b8e04d488ce3b81699
SHA512 e9cca20cb83e4aad5b5742bfb907e48d5012f237d6d8eee6b2bca675b69a79ad25ef28c0a1c07e03f93067ff614a63b95a03ca6f77d7679b405515967fc90827
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:EQRQyi36YOcPQLvw2gAf+PN3jGGMnI
TLSH
T1E4667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4a1db08369d0759d91c852cf8cb6bb3e1f5bd8450879c00b14ec790077790eff
MD5 8e758194deb590a8715dfeddb6c2d217
SHA1 0395eeaa348280b783f25b393285d8a6fd4a313b
SHA512 e74edfa6190b884f75a689040a4048b95b33885b0a62dc830c1da8b88a13b9173a48e322052f95b9c9ae9f5ded4cc284e10dd9afb241228283aa4ae60a1971f6
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0h+Ys7Uv+ahF8MlW:z68Qg55nhheWu7PNU3/5t7Uv+MnIIC
TLSH
T114B55933B2F200A9C44DE1769F4A872196E17C718FE1E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9fc375a73f74e60a896af2623de6415a78209d06358e6192eae37fc2c16e332a
MD5 7d31058990054f33f377ad07db3de3be
SHA1 dab6f8d39b414b4ee697470db9c276ce706042ff
SHA512 a14b71f00caa2cde808fdd7963b628a761669fe0991746f89c5aabd4e286a6475f006b91c170d5f9ff109f7fe90f3153f65cc5afa7c28f88a511a9d0430e82fb
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99X:Py5112gYy5azzVvL69nLKnhZAGGMnI
TLSH
T1AA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 463b552ce4af2b2a25b6fb26aa345e4533f620e3d5725e401eb330bee755ad06
MD5 837c4dcef1633e0a13ec3f9d8b5d2b2a
SHA1 d82e108708b0566885694245bcbbb8f379ffd29b
SHA512 808102c2f38b432d201cc12afc3ad16fbc47e3a6e29b647255b33b81090f279184f8c78fcb10cf262afd1403d40e240aa2581c4f7b506540ef53774efc9f88b3
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJt7Uv+MnIIC:Wu6JmVxd2dJGGMnI
TLSH
T1E8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 11b7590b4c72ad7e6ded7e00e75d90a0c5833e8ffe9f603e2a5361510ecddcfb
MD5 4635a1fa770cbdfde44a21aecafdf7d5
SHA1 5356a735f3aa09e4fee391d1045b522b10153cb3
SHA512 12ab0cd445a94b9d8105ab2910e67f1dbf18a9dfecd95cda7dfb23b7dc4302b0a2e986c4661e6ee8478b54235f73b0f2af64e3e4ff5b273a8bea2db87f700fec
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xnt7Uv+MnIIC:tmifPbRaGGMnI
TLSH
T1F4B5BE13F29900E8D06DD17887569232EA72BC460B35B6DF0A90B7961F7BAE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 642ba5d99630538cf95976985f6fa9c8fa839511b94e6a7548121bf107fccb6b
MD5 e2ec0bc60105fb02a96a86253d0abc2b
SHA1 8556f8b97ee5eb4ec3408c1253013be26160cad0
SHA512 8b84d7542e8d167dd04ef848bf08e7d8349fab72a28a3423c6bcd3ff8524239471aa1bfff6ba7a17a47d7ee4aa78b4dbd42b452b9ce3f38754013f4af802dedc
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHq0t7Uv+MnIIC:G5dKTi610GGMnI
TLSH
T179C5BE13F2E940E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c693f36e851bfec46ab4e1a45ea711f8ad46dd70029d47c7b912115487997cd4
MD5 abd760f37dd68bef460c5bbbaef7d16b
SHA1 b2c8a6a768ee1dc5f46de118ad378382e748ef47
SHA512 7efb67727fecb450ae1b0f7f27af2b92a3ee4a72d7be42799192a34abd2f4d097cc65030d06fbba329271df913d68169f287ae56ee86cb9716c3820b3f3ce2aa
SSDEEP 49152:2htSn8EApI0figngiDn0AP5wLt7Uv+MnIIC:XX2iyphmGGMnI
TLSH
T1F995BE13F2D900E8D05ED178C7568632E972BC160B35AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ef0f2dbb79ed00267799dab04e9a6f2dc345af5b743b59d872cde249533ad182
MD5 b72699ff0d213e7f7321511c71fa56ba
SHA1 3ea0bc8e4feb8a54589006cc1099a4fca84e02a6
SHA512 a1bc80d787ab8802d77817806054739d1019c7470395d4f64eaecb73eef74856cbe8ca778fe44518fa840cb09d629e14172a48c64980c31c031258c52a8104a4
SSDEEP 12288:/mep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:/V+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T169452351DB0600FAE7D85270E1B5829F70F57EA5AA6302C368E46023EF7E8935C67687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0591869cc83895c20dc9f66cce18dd35cfebe92da2c058bc0eaa626f1c94c45d
MD5 f3dd69ceabd4ae39860e1eac19bca30d
SHA1 873ca6a7db2fc21f55be05de2f6d95b06906cb3c
SHA512 8dd9d3a28805aea90c30f98768f84b995f5400692c41670229e33a3b770139bf95ac8edeed1bb540d7f5cc9e1ad403d5b8ac43ba9004c2d06f8d0588a7d73819
SSDEEP 12288:hdep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:hg+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T177452361DB0604FAE7D85270A1B582DF70F17EB5AA6312C358E46023EF7E8935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 95e667679ad5296b14745ee6aa8eeb9b9c52137cfcbf31ce171755488839ba09
MD5 05aabc2ae72b795be0c74485dbcb47bd
SHA1 f56316e4b5cdc77bcc8ca19b949786d419d09a5e
SHA512 54c06197d1d9bb33c49e5f67c5454311d7cc51899e0f55e6d73336edee0c9958522615baecef13e78dfdb82b94ddf05dd7eb0a4a30622a0dbd92dea731129bb1
SSDEEP 12288:tnep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:t2+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1DE452351DB0600EAE7D85270A1B582DB70F17EF5AA6312C398E46023EF7EC935C676C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d75a2c25ff276b89ccb7c92f97934196865ec19a708b4f5056ec46faecbfe27f
MD5 c665d52cc9a493c7bb6c38a74367b47c
SHA1 37d805b2157d408a1710b166bcda1689c6e2835d
SHA512 cf5561ea494bfbd19de9fe3c3ef75191b39d840cd7b1df60548510f5df08cd32d3de4f5cc2daff21b72e0227885ab0996ae1a22b9cf3cb570abfb3bfcadd45a2
SSDEEP 12288:9Vgep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:7+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T15F4523519B1500EAEAE5E334D5B6819BF1F1BDE09B3313CB999011639F7A4D29C33B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 32ba7a0b77c1b92b2693b399faa4c3f862ddd312be2ff2a55a8c06f3987882e7
MD5 67972fb3cb21a15f0781fab733293429
SHA1 77b2c4a1f475ccdb53b3c9db4a494d2b52830db5
SHA512 98b955514b79bc2e592f93e03a0cecb06cb4c645593992a929f1f5f1cbe02e1a5cae321734a66e251fd7bd63cb0034084bdbd22e31b7f2a72085f930c56c8a7f
SSDEEP 12288:aYep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:ar+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T110452351DB0600EAE7D86270A1B582DF70F17EF5AA6312C358E46023EF7E8935C676C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e3310767b2d340d7e0475f2c4a69102f516f1accf543c6a6f0de1c3d34f5b57c
MD5 3a9ae46052410ec5bd892fe0f64d21e1
SHA1 8e491efc8e5dcfcecd0b7e71484c959bd559c84b
SHA512 ffe7e6f99baa10e1ab850d2c196f1d9f001c0f0cee87a4c06a7db46ccb648d97d8328895c399d4ab121dc4a208dab7f062c67cbf6f3b09a5ba4fc0bdd7059da4
SSDEEP 12288:Epep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:E0+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T11C452351DB0604FAE7D86270A1B582DF60F17EB5AA6313C358E46023EF7E8935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 12039b4bdcdff5c35815c6dc4a3e998c848d456b2bf4fc4c5b12bb78ae0bbe54
MD5 d96fbd946380adb96eadbb09dfe4d4f5
SHA1 fd1c13ad9959e46ae45b23e9cce85fb55c2c6c48
SHA512 a6f520e192b4a5e023c5f6ca56da042b9488fb75a4cd6572e85514eb8997497f3b8a967e201d8f1313c1952c8b66668b8a014ea15661f90abd55a794c1563d08
SSDEEP 12288:uVep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:uY+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T118452361DB0604EAE7D85270A1B582DF60F57EF5AA6313C358E45023EF7E8935C27683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 472506b24800d495594f8874d770a9a55121843a664c977ed60400a185fa067f
MD5 e4763920e44cf3e4d7976f22e2edbaf4
SHA1 2fcb4c3d46417eb0dfa8f3a7ca9260246c25ad4d
SHA512 241ff19e2e205508d4eb79e25db3ee3d356fa415d0df655f93a44a1e1e2476654034fabeb6fbb2d7484b0ecb1d7067949cf187767efc2663864798e4b882243c
SSDEEP 24576:/ZMSzFVSOA+Ys7Uv+ahF8MlMPuuICiJS:/ZMSzfRt7Uv+MnIIC
TLSH
T1BC65F1A5B35018F8EDA7823EC9658916D2F27C690B70C64F03E436675F372A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3b0ea2615466435e01002d1306b9af601243f68dc5d0b7cac417d5f0a63f87cb
MD5 20a61ae553ce39c03436c18c6acbdf87
SHA1 97c3023bf70d1b081b7139dc02f5d4ad7ad2bac9
SHA512 f2cebc37e00e392c6d7d47ba39548e52a592dbaf037c58fe946dd508739d6a38b31ca06f36091ea5cd8636f6f334d457943319619d554ff6354aad386d5d0866
SSDEEP 12288:Xaep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:XB+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T170452351DB0610EAE7D85270A1B582DF60F57EF5AA6313C398E46023EF7E8935C27682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 541af74aea8f8cf77b0818b7fb805967bd43cbce18cf524a1d66c43dcf9e2790
MD5 67e568fcb1486d28e0c77a3548d09f27
SHA1 1c01aebe7d1fb035f761104b87d9c49f61c7f602
SHA512 4cbcc4e7d68af4af3dd984b6e0660d7a3528a9ddf58989590258eb857921a6700d4c3fb47a4f34523a3907e6b30402d4d6cf46274bf798bc48eeeb140808b87a
SSDEEP 12288:yOep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:y9+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T183452361DB0500EAE7D85270A1B582DF60F5BEF5AA6313C398E45023EF7E8935C67683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2ca1c1239610949094f1dc4c794989c0a9d26182bfb9c637a3663af797b4898c
MD5 d66e487fd32a8b7528a0d9ab082f2e3b
SHA1 5f2ab5cc19ea44474657d1c8a9e5f7c71a4f07f4
SHA512 ca74421fc4250e41ec9f1df9ba2e20d9e6dfce6cf8a401bef5726fc8f466f2330c3433986a61b84714b397c9e28c1430383fd9efc27b132287a3e92453fb8526
SSDEEP 12288:6yPz5L8Rep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:nzyc+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1E355025777A130F9D2B69238C8A20646F3B2B8724B214BDF17A002776F275D19D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ea2ac00d2960235242fa0424e3b8eb636edd9e48c71d777fd3e18f63f17a2081
MD5 94ad8ec278b3510143af35765c7baba2
SHA1 3da27328050097bd83712fef96db6ac6efe81906
SHA512 ae3a0784d842e202aeb3f8ccc494811232b55d190f4b2d13aa67a1a17ea107c2bc9553d605ad1edf945edb02ef4d65cdded7ebad0ffc423d11a0ba4429fe4ef9
SSDEEP 12288:xaep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:xB+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T10B452351DB0510EAE7D85270A1B582DF60F57EF5AA6313C398E46023EF7EC935C27682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fe5e85ebeea01b491ef2d96d79abdbce2683138c15094bef6c399d02df3d4a05
MD5 af9bee3463902c1d380f0f9e826e0e87
SHA1 2385e8419a0d1751afbc3a6706602ebf8d266219
SHA512 bcc62a4e1f2f491e677e5f1980112ef3e1d0f2c9e23ebee3871c4fb852a63157e4654b89a6c4d49b1143230b97702796c31f0d37e32cc21cbeff023d9d164a61
SSDEEP 12288:Raep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:RB+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T179452351DB0610FAE7D85270A1B582DF60F5BEF5AA6313C398E45023EF7E8935C27682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7405afc4cf716acac4e1799a643b13a6be33e0798f136d34a0bdb246377f670f
MD5 3b166ae0096bd6847d03175e8aa0ca5c
SHA1 b01ffb2d70073d3902c5808b54aa2e1e6e715b0a
SHA512 dee06336170d437b36c41f68cde47146299bfa27243e436d75522b016317a7e5689496f5e3b5d3c7bef5b64775c684a0c8aca96f5934d56e519fdebf495f7d78
SSDEEP 12288:dyPz5L8Rep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Uzyc+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1CC55025777A130F9D2B69238C8A20646F3B2B8724B214BDF17A002776F275D19D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c8ebbb7cce29a7045abe160aa741887c8361aa9810a5cbbf1d21a7918b46332c
MD5 485cefd62c024c2f8a2e7d2df90519d6
SHA1 9f2386ffe525fc360416924bf32ca532aeb0d8c5
SHA512 bf0c426c81293e5dd4d0bc7f0df3b69874230117f43781ebbfc5eea86aaa73c2741a24d5371f6916178f79c69bf4883a80b039b04f5dddd92d964251d65b6163
SSDEEP 24576:fTHaLl3z0zDG+Ys7Uv+ahF8MlMPuuICiJS:fT6Lljut7Uv+MnIIC
TLSH
T1C66501A4B35018F8EDA7823EC9658516D2F27C6A0B70C65F03E432675F372A15C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 baee9d2728c191c79d3d424c87be6c3f3050482ab4c29aee4a2b74392f6b376a
MD5 3762c026c98ae7e3cbf85bc1ce8d40d0
SHA1 17666acf3f6106adc887db39516fd1e52213cd09
SHA512 caa6293c112bd51f5b2480fa61ba4606fac10d3f572b8fc401bcf1f9d59a0dd7aa351fadcebadd50fa8071ca2643d3df3ee5f1ca9e315eadb47decd6ead8a061
SSDEEP 24576:x37d9CHKy7GZ6+Ys7Uv+ahF8MlMPuuICiJS:h7d9CHKyaRt7Uv+MnIIC
TLSH
T1D475CF90F3E414E8F1B79A35C9764512DAB67C991B31DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0d79e96645cc76fea639621299d7cf34563f4a7ec58e51942b9a79c7acc7b49d
MD5 363891b26a6061909eea12c90e5ca67b
SHA1 4da25451dde2fb3ad35eaa293bff7763244521ff
SHA512 119babe3cdd2a8b899c6984be8f8cca94a9df6088146768bd3e7efebe1d025ebce2ac8615b85dabd9ab8c7b64173099ca90bda6cfd5871adb97c41a43919c3c3
SSDEEP 12288:MHep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:MW+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T186452351DB0610EAE7D85270A1B582DB70F17EF5AA6312C398E46023EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e6cdac7539fcbda5605050325dedc6cfd5940ac0a7ee2a104ff75aba12fa2be1
MD5 21a62f9f6e4beb115cc53d229a49263b
SHA1 5f8676a46fc42212e13c3d48fd1442644f6dc0a5
SHA512 91280dbd12ca75a9a3eb93bb423e7548e3daad69e4a6cfbe042181b70bbf040eddce84ee4989e2f82e41ca4691c0bf67633dc4c3349b02ebbcbdd7331ba77faf
SSDEEP 12288:zxep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:z8+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1D2452361DB0504FAE7D85270A1B5829B70F57EB5AA7313C368E45023EF7E8939C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ed0dda2cb663222a6554214edb6b867485fe1ff500bfb5ba83e514c218f39c65
MD5 5b8be42c81a9a81d81ae939fce703c13
SHA1 3896d605b675abbdc41e0b5bfff7e1f13a636460
SHA512 ccc84f9239083ec6fd7fadb5c955c1b260a5080e004c30bb90fd24aec4ed0a5b07a4e61b30f05cffee5e1652aa17c73c7c1d8afc5c402bca479746144c300c61
SSDEEP 12288:F0ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:FP+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T179452361DB0604EAE7D85270A1B582DF60F17EE5AA6312C398E45023EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 eeb2433542f58b45395f71e3058e5807d9b074e3c00c5ba12d24d4e0c2705baf
MD5 0bf327a59d15e51c17ef0f38641a940f
SHA1 7ec485391e60669e05a547938515302246d2879f
SHA512 425c16db63ee5fbaedb51dd69abc6a3888a84bff812d7edb4502ff9d172df8c406d1140e94a692f11b89ed3543e52d9f6bf3bcd574c817555cdaa93cf6b3151e
SSDEEP 12288:iaep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:iB+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T163452361DB0610EAE7D85270A1B582DF60F57EF5AA6313C398E45023EF7EC935C27682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d4aa1d9c3d00527ffee8516a03d0eebc226488eff9e5fb112adc9e0a5f4e7a1d
MD5 00576770aee0503c4a97932b193dbfd8
SHA1 bf3d1c41987ddd091b3a298d893a50a95c6f3894
SHA512 94a2144f82818b2bf8f889482d4189d356b971e3a5a3362187ef06dd6e49d45102da332be36a16a07799195994ad9b4b25603daed169452a2c27651b73bda9b3
SSDEEP 12288:eHep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:eW+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T169452351DB0610EAE7D86270A1B582DF70F17EF5AA6312C358E46023EF7E8935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2f89793b865e3bba4aa29887feefe5dd33baaf9084a8f631fc15108f86387562
MD5 b2c9e8b97cf3cbdf3b258c9758a83c89
SHA1 c75d258fc0fe528e3149a70c9d4c182d3532b9d5
SHA512 75c5a83faf3ddad5cec3333904ce853dfa642b45e3eccea0e8f3a6c70de3ae5e2379f6891db7a89dd3efc2ee706cc21f8d1cf9e56951d6a93f8fcbf613961214
SSDEEP 12288:WSep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:WZ+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T13D452351DB0600EEE7D85270E1B5829B60F57EF5AA6313C358E46123EF7E8935C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f0a10b4dea46b723f981769d421133ecfaac88b39f28f6bd43c9a6e2f2a6e427
MD5 e20d047a52e325b95c9821d1f05fb6e4
SHA1 75b49b9d813334438c9ac9478e4d02fcfd0f19f7
SHA512 e56b7e9a01869388434ef54e6efbd022158e9c96cc128e79b636a625241304d97303ec7e1ef11b3171e06e79dafec297f04081782252645d11419e058129b714
SSDEEP 12288:iYep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:ir+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T19E452351DB0600EAE7D85270A1B582DF70F17EF5AA6312C358E46023EF7E8935C676C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6af45da99c70ae16e608e14004a6bd221480584ab9378893a34651344a261f41
MD5 6a3dbc78d3513495480b9579ab015180
SHA1 11554a4218541f6619d52d7a9bae77e76b93a080
SHA512 bcfd3240ca52c3efc9ebf42e14904bed0fff9bf6f6ab95be8c2171fe14fa42963b3bee5d3811673e588da2357fd8d870d996fe5c5bca5bde40c9f0c09964089c
SSDEEP 24576:Qfwvok9RX6wkyAIt+Ys7Uv+ahF8MlMPuuICiJS:YMnYIgt7Uv+MnIIC
TLSH
T1C485D029EBDC04E5E1B7923C99B7460AF2B178691B31C2CF029A536E0E37ED45D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 910bfefa29d961604f554f38becdeb8867a488cdfb45af50b4cee2c04195b811
MD5 dede3243021c60a00f291fc2bc9b87d5
SHA1 668db775cbabbb62fd0b5b79de665ffcd30f6d26
SHA512 b376096bacac2f05e6a5fd8ece49bac2a7dbb4c2dcfadc3fc818bb4bf27d68b5edf21aa07b31456490f007991ed2f0b91f0aaa8b54b596710604e53280b5fa19
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rt7Uv+MnIIC:jySzPDGGMnI
TLSH
T1F6066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 be553b3fe339642f50493a32785e40f1945660b6ee6b57fc82af18132eeaf470
MD5 304878caeb33eba344a71bb691385549
SHA1 229f8f619dced756854a7f42510857d98e737ab7
SHA512 1df3f85bfa48e0f3bd15aa5bd4b79a3d702e3c249e29f2ae7b714f4223c7dffdd4c4096f4d794575153f03485ec9706109d46c1ddb3293b0430a6cd35d82817f
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYw+Ys7Uv+ahF8MlMPuuICiJS:447JUQj1irIhCnDHUPfF/bt7Uv+MnIIC
TLSH
T10D65AE1DA3EC01E5E1BA927885154A5AEA71782D1F32CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 41e06aef9fbdabda6ac3d70fc1404c642236603234c975987575ca537dfeef07
MD5 0d74c1f706480fd24ec780cec3603559
SHA1 f43706a89984350e6d922bbc6ddc1e10a732d82b
SHA512 c3c3c9566d338de99e723f540507f07e03094293dbdcb9fa047ea1ba00f45a02e8e08ef130eb6aff9b505c7b5fed0539a87826d54babf69594d5e4f78defb2e0
SSDEEP 12288:WNsfKep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:fR+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1D9550119D25801E8C1AE6239C7668642B3737C6587F2D3CB56D0F13E1F7A8909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 920KB
SHA256 a94a8a4d15248c3429324a5cec9979d7e895af950ab2fff4978045daf45567e7
MD5 5b9102ea84291b84b93d0eb29fb11fac
SHA1 5c2824a1ee1ccdbca710f7855d9c979613dd3735
SHA512 1fb1d5f0d356fddea06de7379d302ad49b687fc9bf6eb77e4691fa6a2176931490d5bc297b45c7d9e099164e46f226b6b255b62f3e1bd4044eee26c29281fd5c
SSDEEP 12288:RJ0xU3fEqI/+OzW9GW8bnvV3SWToLSiMJ/Vkh:RJEUP6PlSCoWiKt
TLSH
T1A4150701762BD74FC66D40321E76D2CCA7B07D01EE45AB0372C88B2FD576658BAF2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a8e36104581c63a1a1718100ffe27f173ffed4e5004454372b768ada0692fac4
MD5 cde18476318681f69a7b6c1b71070145
SHA1 0d81266b00063179e95b81293336c1cff929c577
SHA512 3f37796148100b00b5a63e73b5f5adf9abc4a431252c59df6e4e458617b0297883f3cd21cfb1b58e81805cf54917864d726e7b56d2bd542e65b93c61f22e62fb
SSDEEP 6144:E5CuWLbQD8XiWKeFU+Q14zJyESqtMxgSqtMx4sAaNO587Ux2+DK9UNIiBKT8ky:E5C75WeWSz387UJEUCi28ky
TLSH
T14965D8419537A38FD1B720314B2A9B4CA7A4EC02B7456F26B3C8453AD82BB15A1F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 14b3f8760b0f35182f71825a60df826eb8743612ed3f1408dfd38399bc9588f6
MD5 02ec57eb19f1c0bc5385d06f6a18fef5
SHA1 f1186332ea3b47a7d7677d3828ae1affd21063c0
SHA512 473db81771528c6d7580fb17fc6c7dd9cd43061733451a60bb040565aa29acc438e8465b98e7cf868d53c602337e621decea421ed3e430c324627fb6c6248ac0
SSDEEP 12288:8z7Cep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Kp+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1FC452361D70914AAFAF86370617AC16A31B6BEB45F2342C3A4906163EE7DCC29C73747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 54587044dfb89e35c45be5ed82261d86ff443225ab642d0f80be0295b806d793
MD5 8eb29d98fc1dd2b31ef3cea250096809
SHA1 1a2987791f7347e00f4f7c4f88dbbceb8127e89a
SHA512 e2c757ac3b8b49750628256a314787096646bbfcf090b8be6f988e07af8d8c9102e3a5afc03184c762195f435b1cfb562797be55493ea70c6d7b4c0b36faf842
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYX+Ys7Uv+ahF8MlMPuuICiJS:kgb4mBIBhGFdt7Uv+MnIIC
TLSH
T19665AE1E22E802F5E1F9E2B8DDAA4417D6B278160732D2DF1151423D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9f1bb3e2b3926a759f4b1629cabff608bd750e091f16a5484f9568e5fea2cf2d
MD5 71aa8289af4e5ac9bad967848cbd7806
SHA1 0c8863148b5e5224a7aa46d3429305fb2f1df67f
SHA512 1a0bd744cc9dd919991d80e1cbfa712b6f277daa19f6f8c96f17a43f542bd440546d960fadc769749af42075c6dd671b537361d6ea6d12789bd657670390a54b
SSDEEP 24576:5G88u8FpJqH1bzria7/mA+Ys7Uv+ahF8MlMPuuICiJS:s7ZFPqVea7/2t7Uv+MnIIC
TLSH
T14F850165B7E101F1D4BBD13889964663F6B2B8250361EBDF06A88B511F23AD14F3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 86fb3c58a8f076236bff0f4ada3df3ec6ec17574b2d74dd4348298717d261800
MD5 ef6f80f828c42c2e4495a699e7e49c6a
SHA1 f34766571e5baa4a6e9611f0c34352b6cd1702da
SHA512 f0913b4730c50b605ac886653f76ca7213bee4e1958b27fa18bad8e8ff4e936975a8ca596951e2e7aa0a00334e0bb06b5f49e5ee6bffdd0953beff3800366d35
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjht7Uv+MnIIC:VG05lO43bIGGMnI
TLSH
T180D5C06E62EC11F9D1BBC17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7c6271e86b5de619827a4621bbb6742c3e776fb5e80224933e927b12ef3a5e9a
MD5 8c25bcee3cd76911fd477281c16da5fb
SHA1 5b0784608e319d26d22d3ae6b514e22592c21fe7
SHA512 3d426a46122ca476dd173f09717460dc0154117117e6651012709fd2fafd57c16823e7b10ed0e4eb89c5b8e9fa278161b14a25e7b2c2678305689f8921ad7165
SSDEEP 24576:Mfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnS+Ys7Uv+ahF8MlMPuuICiJS:Ua5POZ3+Jt2pasx2+m5t7Uv+MnIIC
TLSH
T14C65AF5EA6FC01D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 962831ec4ef4f8c2db1cf3562d9225871daf5ccb17a17cd5ddda248195d14783
MD5 e6754c3fed306cb66682673db2c4c24c
SHA1 ee488e2fc9ac56413ad944a1fd1cc0d6b19d38d6
SHA512 ad8d79ca931af2158c0581cc51253cef66d32ffbe1a85bd93728c3f52bdb91a70173f67bdf2ce4e6ec36fd7cde1f36001ad88d8203a1b9729f2a02f5f811c062
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7Fko+Ys7Uv+ahF8MlMPuuICiJS:rNc/zEOVHFWt7Uv+MnIIC
TLSH
T1A3858B2623E901E4F5BBE1BE89779546FAB17865173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 46ef0fb4b2554e79b17e1d998996b2d9843495414be2f006c737be7ac74da550
MD5 5fe1304ae1e8e200238cb4dfe89a8320
SHA1 0bea6d61d8b1180e54310e1f81bdbd13eb5244b5
SHA512 0b300490bc89408b03e2b1ca6791ff00c081dde50f5289bb4e64c070c096ac22b6a579398f4347c1cd9c5fcc98291564b437b01afa3d23fc973aeb38bcb759b7
SSDEEP 24576:38kNvNnaFeYhJNtmZBmY+Ys7Uv+ahF8MlMPuuICiJS:38MwBtOm1t7Uv+MnIIC
TLSH
T17255AF6EBAB806E4D1FEC6B4CD238512E6727861073253CB5290C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a61b05551e4a2cfd0f90294f6d4ecbdf2f67f0508483aeb07549aba2fb5646bc
MD5 1c4e40a2a969ebaec723c1674592e7ed
SHA1 9ab5884dbc53200bac0b1107038c9bc6f3e3cbf0
SHA512 360742fc8260b68aa5c4bbfd4b28080995ed542d69b2ed387b806c72f19c99083a7cdb11f8fe21c912d26789e306a796ade102b727e0a549d7365ec5a6e6e580
SSDEEP 12288:XHvUrBFrEjwaQ5ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:XPUr+NQk+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T14865E12F62A918E5E676E17C8592831DF371B862171292CF02E0817E5F67DD4BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1581ad927f839a813c625bcbfc138d888cce7bf58f17c1dfe2f6bf976cb257aa
MD5 6c99fd39d7f046a880fcb737c7666d71
SHA1 c7141a557cdfa8394411e10ce6e291c9fdc2eee1
SHA512 d5006f658ddaca60c6c1e3a17fdb060be153f0e62e186290851a7a604732871c594dab1c34597c98369cbc0f3f7ffe47cd7322e8940fabe5c3cfc1687a277f78
SSDEEP 24576:xD3FHshBIYQgA1+Ys7Uv+ahF8MlMPuuICiJS:xDVHeBIAA4t7Uv+MnIIC
TLSH
T1F875E17DEB5C04E4E57AD1BCD6638606E3B138A9033266CB01D481B65F6BEE46D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1224-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1224-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1224-333-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1224-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1324-15-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1324-9-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/1324-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1324-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2444-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2444-125-0x0000000000F30000-0x0000000000F90000-memory.dmp

Download

memory/2444-323-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/2444-410-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/2444-318-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/2444-319-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2444-119-0x0000000000F30000-0x0000000000F90000-memory.dmp

Download

memory/2444-337-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/2508-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2508-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2508-25-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2508-18-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2508-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2668-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2668-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2668-88-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/2668-83-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/2956-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2956-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2956-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2956-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3372-283-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3372-72-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3372-78-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3372-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3488-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3488-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3488-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3488-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3716-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3716-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3716-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3716-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3852-106-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3852-112-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3852-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3852-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3852-315-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3852-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4104-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4104-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4104-140-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4104-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4104-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4784-51-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/4784-44-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/4784-50-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/4784-55-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/4784-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4784-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download