8ee11f622b65f42201db98d0c2679764765e86d77a0507c3ea5f33c825229287

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260718-ha1q8set6v
SHA256 8ee11f622b65f42201db98d0c2679764765e86d77a0507c3ea5f33c825229287
MD5 ba0d0f5e5674d1d5551be5f79783d88b
SHA1 dec0057020993c56ad5e6e077e8bb0f1bcee37cd
SHA512 5ede2b3a2f40bcb1709a8a85b3e03a6e177259ff619ed7e99bf9d387281f4f070c5458b81f7ba74c7220532d4a89dac18484d791976652fece8e63ad2b294ca8
SSDEEP 49152:6+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755RT:r/PvOIjcXvvOOc57TyR0
TLSH
T1B2165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4560	elevation_service.exe
5596	elevation_service.exe
2304	maintenanceservice.exe
3364	OSE.EXE
5008	PerceptionSimulationService.exe
1820	perfhost.exe
4288	ReFsDedupSvc.exe
4376	SensorDataService.exe
4820	ssh-agent.exe
944	AgentService.exe
804	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\85d49928e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f22143537f16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000020a379517f16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aa72b927f16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056e7fc507f16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecbc0a927f16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
5596	elevation_service.exe
5596	elevation_service.exe
5596	elevation_service.exe
5596	elevation_service.exe
5596	elevation_service.exe
5596	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4964	2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4560	elevation_service.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	944	AgentService.exe
Token: 33	804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	804	SearchIndexer.exe
Token: SeDebugPrivilege	4560	elevation_service.exe
Token: SeDebugPrivilege	5596	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2276	804	SearchIndexer.exe	103
PID 804 wrote to memory of 2128	804	SearchIndexer.exe	104
PID 804 wrote to memory of 5992	804	SearchIndexer.exe	105
PID 804 wrote to memory of 5908	804	SearchIndexer.exe	106
PID 804 wrote to memory of 5112	804	SearchIndexer.exe	110
PID 804 wrote to memory of 2084	804	SearchIndexer.exe	111
PID 804 wrote to memory of 5872	804	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_ba0d0f5e5674d1d5551be5f79783d88b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5596

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2304

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3364

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1820

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4376

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2840 2720 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2840 2720 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6e202984c76385daa0cc19a6207a8a1fa865d87072290bc62c8b2df1d48df013
MD5 d2b840f37a56ffa801e52077e0d840c8
SHA1 13c605d2ca0fa264d76ba306881ce93ad3f261e6
SHA512 72c1ec7026599560ce34c87b728c40f5bf3fac047ead31e0f46482e5fe15a936191f26f47d053646326c9243456cf2900206435d758b98fe7302e98bea75237e
SSDEEP 49152:Fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn7T/UzeKZS5:b3q6sjB6TyR0
TLSH
T13AD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 542e842d041b5118ab944dc84d2bfe286938124215fcb838627235eebc95cefa
MD5 a10c0d4a55ed1d88442f0b37df7f9e13
SHA1 adada1161e37305741781b44a27731729cb6ef32
SHA512 f87059659d6b1427cc75be2190a08146e451a8938607ba2ccee3bc4c8155d10ce4a5cdd04d73642d26fef039372861a0fd4a637be1d3570d2ef325f83aebf631
SSDEEP 12288:S1XLsswWkxy2lRq2czAvwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:4XYfDtczAvh0K/6nWrpAk5dKFvHPdY5
TLSH
T1BC65F129B39408F9ED27813DC8A1C016EA73B89187A4E79B03A4DD655F337D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 61a9dcd7f4297725b24ae8f40d60c44b4cc398dab47ddac29935b343eaf489dc
MD5 7def34c7e8a1f5bace68c6c57a68befd
SHA1 db14b1349dd029a737843b8677cf39b1fcd34e00
SHA512 e020749d6bf27906bb4c72cda45b36f289dd6c7bf77e0f5df81f7072142a06b1d7cd4dd24644c0d751d1c22f2a88301c6660aac80d23e3d50914470637e83b8d
SSDEEP 24576:k0Le5ji0hmxxrMuh0K/6nWrpAk5dKFvHPdY5:kPji0Aj5T/UzeKZS5
TLSH
T1F0859E16F6748335D073C0B9C5D2A69EED72308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 89111c476cc02db9bfe75fd9ac4632e689f4a7b8ec9b9075aa97711cee58c9a4
MD5 513c982177e5e10f0441f443111c0b21
SHA1 1cddd3eb57c58b9a0959daefad1b9775544f8a90
SHA512 2bbb1b94ee21855ea2875f42de3b6c1a027b49d97524fd9bb686cd44cec9f2177bb831683ec294ea2b074495216f62da0f6327f90798fef0be936dae17948059
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyuch0K/6nWrpAk5dKFvHPdY5://ezSC6vUzPveHjyVT/UzeKZS5
TLSH
T189755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 86812c8c466a2559bba851e30a9e7508a443a57c5fd9142bf59bb2064e9445c9
MD5 fcf0293e783720c3d09889c2552703e7
SHA1 54bab7858590b89c1370e2bfaa66dddc99e0dc41
SHA512 37b840f6de6a201b2daea676d0a02ca57bcba6fa09027e5a9437bbcb1a3562332937bfe0eac6f7550c4f4a44d9804798e9053c86d799750b2d36be54079ffd4a
SSDEEP 24576:bVbqPb88hv/l+YTh0K/6nWrpAk5dKFvHPdY5:bVO88hXl+kT/UzeKZS5
TLSH
T135559E66F6748331D073C0BAC5D2A69AEE3234414B31CACB1246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f9f8faa056b8a3c68394f7c2043c6488ad4acc9d1c40c501c695cef1883e9144
MD5 508851f412829d4f3131b66cf10926e3
SHA1 23eba5bc5cc940017ce1c51e433d170808abf377
SHA512 30a504dcc9ea585f65077164922502694737d3b95347c1b90f0221e45f11728ab74d6e7e2d930608032a6bc6c71d79ad9dc17be76c985c9022f906a3354b6eb8
SSDEEP 12288:6Liwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:6Lih0K/6nWrpAk5dKFvHPdY5
TLSH
T16845239AD3085426F737047E3194D05AE972EE80C4CEC667AF22FD91A432EA5EF7D141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2a52fa266f10565f3325dcc305ab907764e273d9ceec89020c28d9d6bba10b3b
MD5 38771fdfc9fc84c6791eecff7d405956
SHA1 7f2beaff64719dd5888d7b7261b0fe3a03bb89ab
SHA512 ab40d0248091af988172b68ad7d32a2ac3acafd6db184f020c0953fcffd933703f8a5a73909e41b96642eb019769511f343da5eeefbd84edbabe8fd0e7495689
SSDEEP 12288:7eBNUbTVO86Urwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:7JIUrh0K/6nWrpAk5dKFvHPdY5
TLSH
T17065CF3BEE28FCE2C27A8DB95691C240E77278704B52A3CBD165C20EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 023fa2efbe7aea7d6fb2df4960a666f8fb985b5d0a397bc734158195a08fdf49
MD5 2c4efa651feaed71fb3e25efb7bcb5ab
SHA1 d174c402ea23ccfb2122f79a02b1fa27d137d6cb
SHA512 aa00d0a1835d10ef17c0b943dbe45131970e50905ea74745b5fa2b5cb5950cfefd91ba57d77bbb15c27811a73312d9a3389339660b0ec534bd94636fe90af83b
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THH:GQvGAdlCEL8c/DRNw5CsTyR0
TLSH
T192266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b421b4cfc12eed798b45b6c103ca2133213b7c51da1d814ed489705e73f2107b
MD5 0b91c925281a21142d695dcbc551c600
SHA1 468dc24f22a7d6055595eda1baea62f566543a22
SHA512 a6307dd0f2d977b0462625a4b1ec1da38369bedbfe86326797dca40c444201cb6a5a49ed4dd9e21d9e9e578de6f3a43f14147438c88868cf92dda0f8e665f75b
SSDEEP 12288:wAwSfxL/2Dc3RDLLmt0LDQewsAjJwk0upay6nWrNHh6koEddKFfnzrXDTG3XItA1:F0ewsAjJh0K/6nWrpAk5dKFvHPdY5
TLSH
T1F375E031FF74E036C37B0DB61B25C316583DBA604B921AC3E3A88E9D59306D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f7744d02f471f2a0de804ffc1637c644b2661e624592a462cbe8c8ef6decec4a
MD5 50f2778f33a274e8da63839626394caa
SHA1 6a01e22f4929863702b5620a3f54f7c5b03d7849
SHA512 4c0d060cf2ada1a6242dc443d18eaa570572008486b2ad735e952ee33422bf05c28569218d324940474dd83a4e3206d148fd144c627b22b973c1b35578daa4d0
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHRTyW:eUEtQevvqc2W1cpV2tI32R2
TLSH
T1A4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6527216cab2ff824e12afc0e6e822e1cf9c0d9ed32b22b7044557a1c699743e3
MD5 3515ca55931d96dcfee57f1a0c8963ae
SHA1 b9e0cb600af112b0f051aed3b8f7aa02402f85f3
SHA512 2b5c3097965cfabfd3bb0245d31824dc4d89eaad6b140f78888fbacee4dd3b7bebf15bd3b53ea33ea385cf6929ca88f3711c9c9199d23f8be0d1acc0bacbc18a
SSDEEP 49152:7CbRquA/m2yL5zLfFiV+XenmE3/zpT/UzeKZS5:koq2Vjnm4TyR0
TLSH
T1EAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a288d1a5004520150e034c92d60d0f6304a231faa67a7f0ad3a51954d3fb8d75
MD5 c4cdf2632da4f9a55b169810c14bf792
SHA1 59d909ca03107bbcc81df3583cc9e6b26553acc0
SHA512 6fb6895f08b12e95abd6e729a5deb41d5a54324f7f506af146626ac442f63493075262c153c1a92691e6d1a8b1dbe4ee0430ccc0da38c77ca562df25bcfaf711
SSDEEP 24576:iAhGL3IFoiwtA5l7S53Yh0K/6nWrpAk5dKFvHPdY5:iAMUFoiq5IT/UzeKZS5
TLSH
T1B135AD81E7F955D4F5B3AA7899B68071EA76BCA65E31C20F2260D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 24993d39329bcb7b92b6695547a9911d032314fae20f3a6da2615563bc2e363b
MD5 49b7440a7090f4a566bf9678e973396c
SHA1 96e6eccb29c0cd60b22b10d856cda219bf5c4cfa
SHA512 29d6391ff50bc668fc360062ada89d6dbd500548c10f4a846a54cd867590228be78abff9c4e3b2146bfd091e6f56ac5f86a8697d1899d4dadde01096942ed150
SSDEEP 12288:omw5HEjsChNVBFgl0WDm+C8wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSI:Fwu4OW1h0K/6nWrpAk5dKFvHPdY5
TLSH
T1DE65F14A73A81CF9E96741398597C036F7B2B8012A65D71F1760CA5B6F33361AE3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d76c1429f47de2d42e670596a1c35548d89c56a53424a41f05c954665a09e0e6
MD5 3fb4e47d7677f521cbe5909cc27c2350
SHA1 cea8b72813399eacd69327cc56064d36b10adfd2
SHA512 1411bca215cc3bcfd8977581e74550adffbc4f926d133b3990414918a06f2d3d09443e367d4d44a3e595dc8e68a1fd3fabf567545d94c8831c2216f76a878592
SSDEEP 12288:ieZ1IyZwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:vZumh0K/6nWrpAk5dKFvHPdY5
TLSH
T14E55129A739820F9E263413D95E0D14AE772B492437A83CF1B218E656F33ED19E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bf392e4faaac8b7879102e455f488384c5104efea7a00580e47e5231dcf3a09a
MD5 15283dc4490c0789f8bfcdb8fb267c55
SHA1 e57aa6bfd496eb19f5ebbc8ced19bf9840f1714c
SHA512 f47324fa0ecb8a9f071a7bd9200cd614e649d0494a97da347e240f566420a8fa7dc97925c62e0d0233f7404629f6a045d7c85da91d3a37e464caa5501aca737d
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UL:QQRQyi36YOcPbLvw2gAf+PN3HTyR0
TLSH
T181667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c49961b2786057787f90cec1441ee5d51e8a0b4e90d186e2b193414af3cc0025
MD5 8fa37fb1bba4965db0aa04b968d5bd4a
SHA1 51f5658b2c0385795679ef3512074d73a578897b
SHA512 b6668a41e8e78f7ef8cec1fcac524a09669ccdf1aaa1ded29f12829a6284a42f8d2061e0f8c1fb06e1056d14009e53ef9cbd9a6154cd5f6b2d6e797e702bdc0f
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UL:zQRQyi36YOcPbLvw2gAf+PN3HTyR0
TLSH
T14F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2f1bab879bce1198d5d8cbc2b7afcd4a268e12e124ad1f1f33db178f8a14b121
MD5 eea1a71730052086b938ff02090e12b5
SHA1 9fd1e2a48003722823e2615ee9354d752b774236
SHA512 30b463a9814ab8c5cf1653b0f206b101e5e296ed90b0c52fc48f74d40382c3bb0ea6dd38f86a47af3ad2ff5a606e9b730bb8103956cccb2f515b54fcf4722fba
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0Wh0K/6nWrpAk5dH:268Qg55nhceWu7PNU3/5T/UzeKZS5
TLSH
T112B55933B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e6b5251df5b68499e2df2eb5c571b3004276f50c636efdc6a613ce10500535cf
MD5 c065f7f702e804eceea230ffc311c31c
SHA1 047603f860aded1a1512e5ba88cf7650b6df927a
SHA512 6664d258ace5a08d7cf7cdfa3a0bcaf4d64984b3c5d3ce115c4923d4be4edf85cc62ffedb757c78ea1e01006fd2a0be920e449f9fb3761a2e43ab4e6dc7bcbe6
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99l:iy5112gYy5azzVvt69nLKnhZiTyR0
TLSH
T1E3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d17c53382e80a3e17ff586073f0e0d1814247f57367b519538cdcfcaac0d2a56
MD5 486a11f1137e334cb44106982920868a
SHA1 80752e59d9c3a6ccd527e792a99c3ede6e5c23ec
SHA512 a97f8e9e78d913999e7a542115bf16ee8dc747cf2763e4ea3f37e6621416b4a9f5bccd69094f7d3596eabab0fb7831ad808b8ac60f5586524409895237cb57bd
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGT/UzeKZS5:eu6Jmdxd2dGTyR0
TLSH
T1E6D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2d6951f58ed3fc5046b191d1504674ce86a73231661c25e6ca096557d303d1bd
MD5 1fb2a0238d0dc18639b752a2d0e3bf1d
SHA1 51cafceb94bc8d0cc93138899e62611af394895d
SHA512 43b5898f7265abb72815920d913367e8a2efda8b366abd92a7bcec97d5358fa9f00f452339c4886baf56a3060be065a6060b2ff4ac0278c9d07497409f5124b3
SSDEEP 49152:k1hpsNoJpF1A63U44CwH7R4xLT/UzeKZS5:kmifPWR4TyR0
TLSH
T172B5AE13F29901E8D06EC17887569232EA62BC460B25B6DF0A90B7961F7BFE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b74dadd267fcb739e5fdf67003adac35d73908e185e96287ca034bcfff3bc7a5
MD5 82a88c81679e871bccceb4f24b3405a1
SHA1 5b3c0b4f605603e335d3bb7985008e4f38dab686
SHA512 c258d7011e6458aa6d8130e7c7b8695ddca59f919d7c62b3ba7a084d38d150f204582492528f1e46c41b16e4f6dad14c82c2af6c0dc65bbb4eb6a4ad742a3529
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqmT/UzeKZS5:u5dKii61mTyR0
TLSH
T166C5BE03F2E940E8E0BED67887659236EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9f9700260966fd09748ea79f76b64874884eb5f77a3b337d2635172caeec2edb
MD5 1ca0ffe5d5e22221a53d00560c6cc709
SHA1 4ad7a2a1448d05be58a6990af00d143583571f55
SHA512 cd09347baa810c26c04a6b3166778947cc2ff653958a97eb8006b1bafe048ae0dfd83fed1fa0a443362320e48ef753955d98f735b810c3585410f4f774b4fb47
SSDEEP 49152:chtSn8EApI0fig3giDn0AP5wvT/UzeKZS5:dX2imph0TyR0
TLSH
T1C595BE13F2D900E8D06ED179C7468632EA62BC150B39A6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f0ccb49f58ba009e5b76389f3d0231c33b10ab951c895837a77903b33d8a8001
MD5 db07117b1eda4d5d407b64b294f45182
SHA1 e0215da0a939061be9a977e6b563ee7cc2139351
SHA512 839c1107924d739ed20448a2eadd9c85217fb8888c1404e5ae4e633fd913d94a64096a0059fa12d1e5c173b73f292c8c3e379a700f888fe1d7e55b22c4939b09
SSDEEP 12288:rawk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:rah0K/6nWrpAk5dKFvHPdY5
TLSH
T1F045235BE30C592AF233057E6144D09AE966AAC1C0CFC1A7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0a94e7e51c3086accef49586af0ff64d11cc26356d2155efc740bd34ddc4c790
MD5 35f2b7bc8faa1a4c745f1a05ff79ad4d
SHA1 a501c6fa92ce8946f50b2770fd81cd72ee2b285a
SHA512 c1e49afc5bd2c71ec5f971ff59cc0f9d9bad39ccce0b6aab0d18ecb18dd0bb80a3b401755938c6408abba22d3ce52e143dbaa3e564532fc6b12d8f157f8717e8
SSDEEP 12288:/9wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:/9h0K/6nWrpAk5dKFvHPdY5
TLSH
T1C045235BE30C592AF233047E6144D09AE966EB85C0CFC1A7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8efcf424d20256aa42acfde2e846fc1f263743685dfbf5a5402b2dd435005770
MD5 782c311a1aca6b4444b3969fad2520b2
SHA1 e1b43b7258a7351d618a4d43e1ae3ed5bb1ca04a
SHA512 7379e941415d13b126e79cd48f17aef1437c9178a80d96d05790c941374909c972bca207851bd28cd202dee16b084f367fc9f6272c5d7f123a78955df63104fb
SSDEEP 12288:yDwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:yDh0K/6nWrpAk5dKFvHPdY5
TLSH
T1A745235BE30D582AF233047E6144D09AED66AAC5C0CFC1A7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 eef004ef22456b8f66c61090e649da1535c1fe4739ef0668129fc8289c36eed2
MD5 e9776ed567523de6914bbccaf3261dbe
SHA1 d0b3ae2de099062667742860de25859e745ac29b
SHA512 2262478ad8098c8600bbf35f25d94569659b179670d77f5a41fe89cebf9ffd7b61a28c93f67a1759f7abaf5c3729f0846dbfadf0fc128ac1aa9bf8269ab1653d
SSDEEP 12288:AV4wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:7h0K/6nWrpAk5dKFvHPdY5
TLSH
T1EC45235AE34D04A6E533857D9150D05AEAB2FDC0C25BC3AFAF11DD515E32BA4AF3CA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9723cf2a3a922c08b285c22a7e366adae72e785a0814a6c9b98238020a28f8f1
MD5 d0dadb1f178bd5a866adf68a9139e55f
SHA1 46bd449096a61c2e7e4cf393e7402b3381c89ac5
SHA512 710e99ad32374ad6727a55ba07869e771730c4b94f45e0dfcad554163ece82e986bcd2c8f92d085a63ca05cf64ef25dabe83ce7a4189d4b8e3f49f5297e9d824
SSDEEP 12288:DAwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:DAh0K/6nWrpAk5dKFvHPdY5
TLSH
T18345235BE30D542AF233047E6244D09AED66AB85C0CFC1A7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3dbe0058f6f097cc95178416b6319aec3786dbced1ab065bbb067672346871c8
MD5 e23faa60fc85d985638b93edfaac4c1f
SHA1 e1fbf7af7e345b359f4118bd032f4eee0bd2b8e6
SHA512 946d4f6346c55a27261fa4d6839e0dca3aab37696ecb7c3700103c43d26866801f1258da919c4ef435d2c69a2edb42a25c7a0bdc8eefcb089c26c542154c9152
SSDEEP 12288:Nhwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:Nhh0K/6nWrpAk5dKFvHPdY5
TLSH
T12E45235BE30C592AF233047E6144D09AE966AB85C4CFC1A7BF26EC11E532EA5AF7C540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8047fcfb3e722fbcb45622786d2a45ddb9c8e9aca4457ff0d7a53099db9da3b1
MD5 c0020bb8154c133d17547ae98eb9e602
SHA1 a71f8c894bc5b25d591bc3bc37ab8acda8f49955
SHA512 34754c3414c7b22b31ca86bcec8e135fcc8aefec33fb9b7b4019aae76fb94b466faa6e934fad776d18fd5ec8118787303b7ee169954a08099976332584f03978
SSDEEP 12288:rlwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:rlh0K/6nWrpAk5dKFvHPdY5
TLSH
T11C45235BE308592AF233047E6244D09AE966ABC5C0CFC1A7BF26EC51E532E65AF7C540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0ce8a12346fe0c94da0dfcf500443b23982943717d86a73bb9d5de3f9a8dd4f3
MD5 fb651b04feee27ddbaa14ffb889c9262
SHA1 11671c3b88e19bc4a971db5b2a3c0dc72d62e0c5
SHA512 45816ffe30a1993dbeea979a722785fde3f881dee4708db2f73499d4bcc1673142b8a1be2c4be7b201f4eb2cf6c7dd7c0cf64f84cd817f9c4f7d0e6d3d9a0e4e
SSDEEP 12288:4iZwbVzzFEoS2cPvydwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:7ZMRzFVSOdh0K/6nWrpAk5dKFvHPdY5
TLSH
T1A06501A9B39018F8EC23813EC955C806D6B2BC5A47A0C61F17B43A665F337A11D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 38b6f1370b3e5b2ebd3b7d5e630dd69a08a5ad8232134727788b49ad6caad9ca
MD5 a84fd1a078605b8c9d05c1626f4c993e
SHA1 ff8ca614044be7b50a5bb6cde986fb63c696706b
SHA512 bbd0e6ce6796d1fd3675721295353097fbd032e0fea6f38b502662555165cfbf4c870b0b753ef74e1a62b6b527b1c74c31f0046058ff09029bd18192ed9e5d3a
SSDEEP 12288:i2wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:i2h0K/6nWrpAk5dKFvHPdY5
TLSH
T18145235BE30D582AF233047E6244D09ADD66AB85C0CFC1A7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 27fd3e6906883d473e723af5281678e5a3c94a2e9c831ca1b6bd8572236a86d6
MD5 89bac3111e2dd51d7564e822be8d2b7c
SHA1 53feed31e7eb56222bba39f5cae004d960e0ec15
SHA512 e69dad1749f814f0133ca3917cd55c7a63a72408c78c1c2d81ea481fd9a2cd3b03f9dfdba61fd0576b7c8383a67cfa845ff5373596059392cb48c7bf2bbf95d2
SSDEEP 12288:gywk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:gyh0K/6nWrpAk5dKFvHPdY5
TLSH
T11C45235BE30C592AF233047E6244D09AD966EB85C0CFC1A7BF26ED11E532EA5AF7C540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0f7d6fb9cf479a2507c0729e9640bd6fff20725f7f7a7243878c5363af50858d
MD5 465a76b37c73147c6b3b95a56c222e1e
SHA1 2826c0e32c300fe1230872357206aea634f8f4a8
SHA512 cfe096d700ba84a0e9361821451f10752ef1805d7099eb31ca1b5074de7f7ac1f2880add0cd1124636928513a884c652cca4a43c665ec3cb4506fd8b4c40f607
SSDEEP 12288:5yPz5L8Zwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:4zyZh0K/6nWrpAk5dKFvHPdY5
TLSH
T154551207B39530F9E137813D84919506F772B8724765CAAF57608A726F33AE09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a768495398f63d9e796f008b16cee0e97edb79920f3315b5dbd82b0e0cab7021
MD5 c3e49a452656ca0f775ce0fbea444de2
SHA1 5c3989d55edff974e23ee835b5f8fe4e515e9ea2
SHA512 1d5101c60ae2601eb71dfa4bc734b0ed1267d8e1812f5290820f9720d47091a5e5ac5efe862c6575694e1af7def518c7b093a2efa01260e42d1437a6abf95247
SSDEEP 12288:k2wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:k2h0K/6nWrpAk5dKFvHPdY5
TLSH
T18345235BE308582AF233047E6244D09AD966ABC5C0CFC1A7BF26ED11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 909a72cc1d0c3b0e5a36ffee8e94ee8fab7f51caba1522cf8228d56fb0a2d02b
MD5 360d2b204852dde2aa1136d06bc35748
SHA1 ac1af8af8f3829adb071c389916b0ad8c56ab586
SHA512 a656944f4a2b067a4c2693f5c874320e03adfdc49671440a53c3264a35452d16b494111df714365fe192d45941b73b83a37f1570a272379d54639a48b1d571ac
SSDEEP 12288:O2wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:O2h0K/6nWrpAk5dKFvHPdY5
TLSH
T14445235BE308582AF233047E6244D09AD966AB85C0CFC1A7BF26ED11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 81af5b0b7f094db8164d18d048c975a29e7a0efcf4d465a1e756e94b458b23e8
MD5 60c5e6f121500a6dc35c575aabda53f2
SHA1 03e5fc52435a24700a9dd029f96ec1649eac6084
SHA512 08059132228894a04d9d59319e27837c01ed40e7c2035c3422da408135b31f87419946b183509e1261291acbfd6966d1251a11b995efe8e39e0e6e8c8e66898d
SSDEEP 12288:KyPz5L8Zwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDsZ:XzyZh0K/6nWrpAk5dKFvHPdY5Z
TLSH
T17F551247B39530F9E137813984919506F772B8724765CAAF57608E722F33AE09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 899ac53b97bec36be3094dc0a7bf75e842d4bb0c01322c73ebca8184b4bb485d
MD5 57be88e2a3e046dc880893822318f379
SHA1 7c0124b3585d441de1b602404b099038ec07ce38
SHA512 3022cd16b2e97d0922ab6a0d325430ca7afa6882af6fc9627bbb9b231cccaa15950f94807d40a90bb9226d461865566e265baa039334bab77549c570b0081b93
SSDEEP 24576:mTDaLl3z0zDzh0K/6nWrpAk5dKFvHPdY5:mTuLljcT/UzeKZS5
TLSH
T1666501A9B35018F8EC27813EC955C806D6B2BC5A07A4C61F17B83A675F333A11D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d3ce82d6f82fde4c204e158097a167c06aa1e61e28845640a068cd2c19b1e6bb
MD5 b2117ae98ccb5cb256298adb720561bf
SHA1 ca8f86ebc7431e7dae87b8413c9f83b57e1caca9
SHA512 f02aad9b0ece44cf3f096e295db6f82469bc108e2d9711199eb230d64f2c0a6f72c3367de15f5e66e2497b7dcfebb5ce99558ca41bc76d36cda062430ca3eaf6
SSDEEP 24576:m3vd9CHKy7GZnh0K/6nWrpAk5dKFvHPdY5:Ivd9CHKyaxT/UzeKZS5
TLSH
T12875CF90F3E414E8F0778A3589758512DAB67C995B71CE8F03A4691A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3d72aa41ec0451abc8c0e27097c5c2e32cc1db239bce2dd411fa487c475f3bcf
MD5 8597c98ef08d7ac440493fde995e3f4b
SHA1 e52e91ac07d4268b156bfc7151dd66ba64d95772
SHA512 39f749cccb13e772a520278ffd612261d18b6545ad35026c286a92d84ab15c2eb026861c4d37e95fd75e64175f41bb91a6ada793c4dd2ca2f718c44248f1c114
SSDEEP 12288:Gjwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:Gjh0K/6nWrpAk5dKFvHPdY5
TLSH
T1DD45235AE30D582AF233047E6144D09AED66AAC1C4CFC1A7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3230ccbb62a5144cb47c373546a6c0e7bcc6030090d6ba8b11dca1987b5b1733
MD5 17d727bbf0c830e54e745620e807644b
SHA1 10d236f6819fae69020273ebe3ec586e24487d1d
SHA512 74059963c3c9801f1d98eccc99e507508fd36bed07abc38dc20a8274c8c8968df1fae8e08335f88ad9da79d78da8712e519ba6b923cdbd9ab444674c5bbde344
SSDEEP 12288:q5wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:q5h0K/6nWrpAk5dKFvHPdY5
TLSH
T19845235AE30C586AF237047E6184D05AED66AB81C0CFC1B7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4ccfa2335e2c565b86d45584fb46e83003d369fc0d23c8eb5868b9f77b0502ac
MD5 271d084e9c0949284b3754211e284029
SHA1 fbb83c248bc83cf2ddcb8673fce6cf8de5f56c04
SHA512 44258f2d2d01f46e8b241800f196b78d334caa227c68f322c5d9ea6940e38494698092965c116db21cb549dd9abefbaa185ffbeeb1df3a04f7de1577c9380435
SSDEEP 12288:DEwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:DEh0K/6nWrpAk5dKFvHPdY5
TLSH
T1E445235BE30D582AF233047E6244D09ADD66AB85C0CFC1A7BF26ED11E532EA5AF7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 87b842fc7ca26f7458cd5f8d28233ad8d509b7235c2b551553c2e391a5486cbb
MD5 28cdfd79e5cb10a7de7f2df583b93b16
SHA1 186d523363f5acb0697c6ba37aca1a388660d12d
SHA512 4c5b01505a73fc191502f21eb5c9dd435e12796ed46f1e4b600fa2ae057abf4f6e1f8a44d41f65292d6bc3e74641a3e237d5d2c2ed532210f5110c0df17011ec
SSDEEP 12288:/2wk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:/2h0K/6nWrpAk5dKFvHPdY5
TLSH
T16A45235BE30D582AF233047E6244D09ADD66AB85C0CFC1A7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6d189138b1d82c6fefba4b92cd48dd1a2d579191c4fe92524235beba4f928a92
MD5 9da5fbc24edc0b2a55eea245d1c99450
SHA1 5a5f96dca5215af74bdfc77aac99ac3c6b30044f
SHA512 9b9fa13f5d5a39fb88151251729d635ded06f7b34d97fab2d66179a7ca49ca0aa560d32715f11d2c9a5857e54686f51266822cf7f5bdfcbe4419b7bbbcccc6c2
SSDEEP 12288:8jwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:8jh0K/6nWrpAk5dKFvHPdY5
TLSH
T17045235BE30D582AF233047E6144D09AE966AAC5C0CFC1B7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 efc02987e6335bcd66bd9bb5a23f817ecb6078ed4f6636f7099618e9c351877c
MD5 aa838cbe469845cbc478554501dbd5c2
SHA1 ce57273e024d3f351778a6f8fc739c3a5fdb5137
SHA512 61bc8ff50602b4fe204236b80e4e68ea5b7778a4f424263971e6bcda911077ddaf7bc8da39f084d7e94be7d80390536f4776d1f7c321b1b48345e569a83e29e4
SSDEEP 12288:kewk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:keh0K/6nWrpAk5dKFvHPdY5
TLSH
T13645235AE308592AF233047E6284D05ADD66ABC5C0CFC1A7BF26ED11E532EA5AF7D440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 14c005a9babe9592e406721fb9612fe0b701db3c3900fca2584ca3c01546d793
MD5 38b0f4ec352eb9b48b9145e165c6ccce
SHA1 07f457c3411ed457e9fef6636c28bf30d7f09d85
SHA512 58105795a0c9281a408e23929efb63fe2669168f6be0b394f02b602a120197efef7fc923610bca5346e205e217aaade3e1f27ccfa7528064453f4a370a66f077
SSDEEP 12288:LAwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:LAh0K/6nWrpAk5dKFvHPdY5
TLSH
T1DF45235BE30D542AF233047E6244D09AED66AAC5C0CFC1A7BF26EC11E532EA5AF7D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 05a0d2b6667eea586e869a9cdb09cb6b3de8bc0bac86e1c59641938c5a06badb
MD5 6a161f49e12e93ee4f0c6b54dbeabdb3
SHA1 462e4753102b3d4a18357987153b6de37c310ef1
SHA512 bbc7440cbed552318fb1772f2002c1a825c2a8a3f43a83893187b866ea4cc5889f16153d870bb5db459808bfc307ada749bd03450045c9484fcda98b050d994e
SSDEEP 24576:HfwvUk9RX6wkyAICh0K/6nWrpAk5dKFvHPdY5:VMnYICT/UzeKZS5
TLSH
T1B685D029EBDC44E5E177923C99B7860AF6B178590B31C2CF125A53AD0E33ED4AE39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8e5dcf0eb61a301e0c58d5cdb512db948fb2a59c441dd3f3fd370c92dfb7dc30
MD5 3dba0dd0485710b467c67275a7b1a094
SHA1 5d1ae793b02aca2e1a5bd12d55e01c68c54df7d6
SHA512 f235604794dccfa4a136924d92a120b74a35e5a437b43ae1a66b08bd2024b1dce1d01d72adadac4ecc24f132f3d58223ef3c07559a348a97885fb723bb0aa8c4
SSDEEP 49152:vYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PT/UzeKZS5:6ySzPnTyR0
TLSH
T133066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3c8a3092c528cd2cf7987d38cacad6d1d7747378d573742b8b7ef2f148c428b6
MD5 a4a7a1a4a4fec68f364e3b8e81d468ec
SHA1 f53e9ab693a69de39ae4ff3a59e67bec986be312
SHA512 9abe42a7224c8bce4a65a475d4db30dafd3662658822efcb3889e18355ddfb385933139c43fcefe0275a48d2bc809933b81ee836585ef3f536e57afac4bcf45b
SSDEEP 24576:H47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYth0K/6nWrpAk5dKFvHPdY5:H47JUQjTirIhCnDHUPfF/fT/UzeKZS5
TLSH
T15D65AE1EA3EC01E5E17A827885158A5AEA71742D5F31CACF2270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 95f6e458be6b45f272b90d7d20fd5acaf7083bc27a014f63fed8040973b3da6b
MD5 ff0d63840a49ac7f9eba53d94df59de1
SHA1 cf40d0fe5e19c0ca3593f9d2634c4f5befd0dfce
SHA512 bd7cde4e55053978a5310c13b89eff3b58c3dab1de6636a4d75ee4d2e324abcae08f258c3e7f16de1c5a2e13cf88a4f8ab9b1a40a3adfe5a28e3b3cd225c1fa3
SSDEEP 12288:2bsfmwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:dmh0K/6nWrpAk5dKFvHPdY5
TLSH
T1A955F01AD29802E8D02E517AC7558541F7337C6583E6D3CB67D0F93E1F36A909EEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3a2a633b71b1ed2f85742788d4b12f41778ac6174145f209d7fca1581e1a4390
MD5 bdd1dfd0c00ab1a593fe171008024fc8
SHA1 9a7bdd48272cc16ab37f0bd1fcb4d9931019e31b
SHA512 571e289c5cc3eb92ae0422b635e252e06a9166be7ca7e86d37da8715c4f8b0a39f4c1d13b35897c5dae879722e2a2112c9a51b79ebb1688feb69f0d4dd22abc5
SSDEEP 12288:cF7Owk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:wOh0K/6nWrpAk5dKFvHPdY5
TLSH
T136452356E30C582AF537057D2148C029E92AFA908B8EC1E7FF12ED91A532ED4EF7C601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0e8c85177b49d68ddbd36b34b100dc1fe19143e28da0ec76a450323a6664afc9
MD5 c428143fac8e5a1dfd4f546005758ab9
SHA1 01b1140ea872e789bf7601eb6dda868c3d1d7bb4
SHA512 9eb4f023f163b8d1f3acf163ca31fbd033d2eaa26e489355deca0067b8aeb79efff0c9e954ec12d904dc85cd37bbfd2ed8e2ea4410edb81a42d8f3a56f948aa0
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYch0K/6nWrpAk5dKFvHPdY5:0gb4mBIBhGFtT/UzeKZS5
TLSH
T11D65AE1E22EC02F5E0F6D2B89DA64417D6B278160732D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 40c14c46c1baedf423920547696dc300dc3c7426b588f4198eddbb9956d6bd95
MD5 9802e99ebd0499b94bc559f95015cfb4
SHA1 cee6d76774005d58480c065bbb40e6f515aa0036
SHA512 4a1b38a0aa061efcd5237569acc998cd8fb27dacc22c36e98adeb49cf6476c5180e7a304f3c95a17668ec07aec4bc116c93deebc9ebb8904dace9f20b5330c67
SSDEEP 24576:WG88u8FpJqH1bzria7/mdh0K/6nWrpAk5dKFvHPdY5:97ZFPqVea7/kT/UzeKZS5
TLSH
T12385F165B7E401F1D477D13889828663F6B2B4250364EBDF0BA88F511F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9674bbd19f756387005778837d0e2669a9ecd567985cf0c0e8c8682061bb530f
MD5 de3919e1650e3c5247e4839c457eaf83
SHA1 504c3e311c1cf00164ba099df16173af7675eef0
SHA512 16905f740dbbac99f62e27e5385dc5340c96a58694119a0c51822929dab4fa4612670738059308878a2d9112aee4302c75431f3c301ce30ff088818963a932af
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhT/UzeKZS5:8G05lO43bqTyR0
TLSH
T1A9D5C06E62EC11F9D1BBC17CD9C6860BEBB23415032556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b22618b3cb7339dc96dc1c07ec13cb20ccea131c0495661fcc06e7300cfae441
MD5 ceb5350829cad23d938f9bb7eec29559
SHA1 519c8629478a882681163743fa54f8245c1ce56d
SHA512 0a227e7a0d60c6f120fc9c13820970822c167127123899e019ff57d508e05f599abee8633ba8a2adda6afaec4c40e9eacf9de130f2e719abeffd5e755238d38f
SSDEEP 24576:nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnPh0K/6nWrpAk5dKFvHPdY5:fa5POZ3BJt2pasx2+m5T/UzeKZS5
TLSH
T1EF65AF5EA7EC01D5E179D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bcd0823197e247fa8c6315de758f6bd09ea9fdb62309a9747d9c8d3ac5f2beaf
MD5 3c1dbee3a451aa58829e8eeec030741f
SHA1 66f00d73de573813dc7f844dcbb46e59831a4c3d
SHA512 3a4a956755d6670a10f2feda28c51ca517778f8e5e91229b70ba872e3df5307b8a2700abdb34351fc6327aea734b40659e1cadf149359f56b4d6093a57580057
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkVh0K/6nWrpAk5dKFvHPdY5:KNc/zEOVHFET/UzeKZS5
TLSH
T145858C2623E901E4F1BBE1BE89779546FAB17865133486CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5198878618285adf71b9398865988c0654907ae2a3d8996ae19f5e10bc5428a1
MD5 043a6018ad8e3ec5b03b3c45acd83b79
SHA1 128fb38814910e7504d3fc4f04ba2f33a220233b
SHA512 ecb86bd9459d550fa0cbbee7e73acc1a616005169e6b4388b3dfc373dbd18ac17a8c609d1692411cfec8b5ce7fca6eb2800d89dd11e95b1a55f345cea7b5002c
SSDEEP 24576:jTkNvNnaFeYhJNtmZBmyh0K/6nWrpAk5dKFvHPdY5:jTMwBtOmyT/UzeKZS5
TLSH
T10055AF6EB7B846E4D1BEC6B58D238112EA727461073293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 64933fe67a7c36bf34519d3869ef526d58daef25f3ef6a0073f31f5b818b7530
MD5 ffb198e8f13bd15cf94af8b31f321332
SHA1 828bc739d0c31b8815d28ef34d483ea05f292d0a
SHA512 c1baa371baaad7ece162ce43fe05167697e8ebc28943673f027e267c2dbc2faa47a2b9d647c2e23845a20523837943f552b32a5ca944ded2e71ed40b3cc096d1
SSDEEP 12288:9HvUrBFrEjwaQxwk0upay6nWrNHh6koEddKFfnzrXDTG3XItAC/AZSDs:9PUr+NQxh0K/6nWrpAk5dKFvHPdY5
TLSH
T18265E12F62AC18E5F676A17D85818219F772B4620312D2DF02A1857E5F73EE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8f9009e540dd6f9156b699aa3e675e4357f7ee7945a948cd2493e7d804ead136
MD5 6f9e5b56843d05a89f600297e6038d07
SHA1 4f4209813d6a92db3a1cbd4c7f2d3dec9fcd7301
SHA512 3832b8ef5792b5be4e2782f2f993de5711a2c0571176ca9b643a01335332c2fdbc4ca5547e4f07e2290a9d9e2b4bd107384cecc40041624e95299f2bc1450701
SSDEEP 24576:yD3FHshBIYQgA6h0K/6nWrpAk5dKFvHPdY5:yDVHeBIAA6T/UzeKZS5
TLSH
T16C75E07EE79C04E4E57BC1BC96638506E77238A9032266DB0694C1B65F2BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/804-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/804-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/804-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/804-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/944-131-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/944-138-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/944-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/944-140-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/944-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1820-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1820-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1820-83-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/1820-88-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/2304-55-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2304-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2304-44-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2304-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2304-52-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3364-254-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3364-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3364-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4288-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4288-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4288-332-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4288-93-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4288-99-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4288-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4376-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4376-316-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4376-106-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4376-112-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4376-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4560-15-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4560-23-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4560-21-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4560-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4560-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-319-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4820-125-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4820-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4820-119-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4964-8-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4964-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4964-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4964-30-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4964-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/5008-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5008-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5008-78-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5008-285-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5596-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5596-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5596-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5596-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5596-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5992-331-0x00000215FF280000-0x00000215FF900000-memory.dmp

Download

memory/5992-400-0x00000215FF280000-0x00000215FF900000-memory.dmp

Download