b9b83526c75479c7083de01090178890a5f14a075ef8185971d1e51412df68b3

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260720-tpjbaahw2z
SHA256 b9b83526c75479c7083de01090178890a5f14a075ef8185971d1e51412df68b3
MD5 1a4d72ddd02d5812edd67b4f125f5a1e
SHA1 6bf4cbefa2c0e0fdee0821f9724b07fadf3e2f04
SHA512 16c4743bdb9c7de38f16a2cae0e9eb9fc8dec683ec0c8f2b90b17b97ec4db641c0a0b821ce4af88a30bf155c3e81013f213bf0507f488832c32cc96ef929f69f
SSDEEP 49152:O+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755zH:X/PvOIjcXvvOOc5Fbpi0gYz
TLSH
T1E4165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4108	elevation_service.exe
3540	elevation_service.exe
2044	maintenanceservice.exe
5624	OSE.EXE
1208	PerceptionSimulationService.exe
5688	perfhost.exe
256	ReFsDedupSvc.exe
5000	SensorDataService.exe
5840	ssh-agent.exe
1336	AgentService.exe
1168	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\794063f5c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c5233106318dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000752f53106318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e714b4cd6218dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa2a39106318dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b820d2cf6218dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e79f4dcf6218dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd8840ce6218dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004af80a106318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a72b47ce6218dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe
3540	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3044	2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4108	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1336	AgentService.exe
Token: 33	1168	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1168	SearchIndexer.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	256	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4108	elevation_service.exe
Token: SeDebugPrivilege	3540	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 4292	1168	SearchIndexer.exe	103
PID 1168 wrote to memory of 1340	1168	SearchIndexer.exe	104
PID 1168 wrote to memory of 4316	1168	SearchIndexer.exe	105
PID 1168 wrote to memory of 2680	1168	SearchIndexer.exe	106
PID 1168 wrote to memory of 792	1168	SearchIndexer.exe	108
PID 1168 wrote to memory of 4296	1168	SearchIndexer.exe	109
PID 1168 wrote to memory of 4264	1168	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1a4d72ddd02d5812edd67b4f125f5a1e_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2044

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5000

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7c36782e346cc0faf295bd838cbf10915770789939b3dbe6712404763e97c399
MD5 2be0aeb5a6c6228a533b4f06efaf0f0d
SHA1 bf6ef706769450d80ed9b23d831c5bcd49a64ee4
SHA512 cd87d3672d1e3504ced7c3125e5e94e3f676ab6e48e28f15d99531864d80ac24c87b190f3ef65f7221f026ba198b7fa0347edf44105234c86a31dd23effee5e7
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn18U7twh0gYUub:23q6sjBebpi0gYz
TLSH
T16CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 6914974c6b451c450c7360d0460cb6c1c14bca933879642933dc7938c8742cb2
MD5 4a838ef55f45b2203049471ea115a683
SHA1 923b262c81474248336ce6d83c07f05f2fd342e9
SHA512 0139e71e05057a3db7008adca0ad05b87a7143d6badb3fde8d3a6c28f6d96f8002ee16e268e970ab2154da00b91c82fd00b70fb628089881a9802b01784a03c5
SSDEEP 24576:1XYfDtczAq8U7tTK3VnChd4Q4PQpUcrf0FGDQ:gtc38U7twh0gYUub
TLSH
T1CE05F128B3D108FAED674239C972C511EB327C554760EB9B03A4AA651F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6ceac6e27b7301d8b58307103dd7d3592e2e66a56a7e6c093862360fb258583d
MD5 630f2a588fa19fc3cccc611ffc30dcec
SHA1 f4314a06febb414ed8b468459ea2795321df25ab
SHA512 4073766e2bea62e81aa73c0d0a3c914d8585c0b0c30df959b91bb68f2126b0556becc4463eb64c51507038608164c95b0cdb265f7e7bd7b3c27f1998baf30021
SSDEEP 24576:N0Le5ji0hmxxrMp8U7tTK3VnChd4Q4PQpUcrf0FGDQ:NPji0AjY8U7twh0gYUub
TLSH
T1EB359E15F6748335D073C0B9C5D2A69AEE3130825B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 400aada96c7a1400b44df29c328cc82285fc3d34e9a32b583a576ec70288da41
MD5 2cdc50aed13e92d7e6d76752b2019246
SHA1 0189d721ed3ab151496c8a610948c9f6bcbe6aaa
SHA512 1c3f5971b4730316896d5fc9abb6eba66a26d57133af78550af3fe02c29d8226711b8293fffbec679ca60a0a9054dc433ecf710e4c1d7337e287c6e4cddfeb2e
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyu/8U7tTK3VnChd4Q4PQpUcrf0FGDQ:6/ezSC6vUzPveHjyE8U7twh0gYUub
TLSH
T1ED755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2691e9b39c48150bc32573673468ffcf8d0d2306b4d96f762afec4c4f1e4b0bb
MD5 69949d68609830491acccf2ce57ed80f
SHA1 943f0b9453762df29f80e356c483a78dbec524ec
SHA512 10ed2fa8380ad75e9f7f938483adbd7bc1352b8a9690b72a55a49367e7ade280461ac79ee9f0d42c8e656c2371eb81bdc20c73742ecb290ceacfa90b37d71593
SSDEEP 24576:sVbqPb88hv/l+Y68U7tTK3VnChd4Q4PQpUcrf0FGDQ:sVO88hXl+n8U7twh0gYUub
TLSH
T11D559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2b00e3e04610af70f1292881da16bed8c8c757af9dd7cc1e0bcfab963adf3a0f
MD5 7f18be4dc1f81021d974e6f40ceab8c8
SHA1 cd45dcecd19f7d22b4342a6492e83c36e6e629df
SHA512 f96a85341a43300a16d2b06f865690527520a0a4e90c1b280ab909e6599a51c7e370c5bcae497f1261af5ca25290e67788389501ad3d53ec49e9e8b06713f84c
SSDEEP 12288:lLnN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:lLN8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T17CC42320A7858807E3662B33FA37E9A4EB115EB45D44CE251460BEE46E3FE5CC9C9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dda0b8772d900d481c877c33b8f4ea33b0c2b78e4fac6e415b2d7f359c77d943
MD5 cf900d1229153c4d88ab51dfe8b72d77
SHA1 cb99323e9dc5e0bdd717b3da2eb6bee56dba9d65
SHA512 d4e3820ec5d27b29152d7cb064536af4872b30a70ee7383171f941e202ec54849f1a9fcb3d25253d5b2d3d5631eb44d6299fefc1bae614881c101a3b12b9c25b
SSDEEP 24576:pJIUS8U7tTK3VnChd4Q4PQpUcrf0FGDQ:pJIUS8U7twh0gYUub
TLSH
T12105CE3BEE28ECD2C27A5D799A61C640E77278304F51A3CBD164830EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 99653a54ed4b5578e359787a2c27edba3388d5c575c513b06f8f35f1b5c318da
MD5 2b4bb782e1d7176c80563c744bfcac00
SHA1 b9dab44d8a09c76103429302c56514ee326b8cdf
SHA512 8bbf45b54c330d2c2e144b83403820f9832c36cba8b9ed9449ff802b713edee845fecc514afe9639448ef998984804dff8d6d613ba5ccc91e597559c70ea126d
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:MQvGAdlCEL8c/DRNw5CPbpi0gYz
TLSH
T1BB266C656BF880F5E1A7E134897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 508aef5fe2c66a1c9f158e307b773be14c9be9b4ab0a02c1e9d724d788971f36
MD5 7649a4dd4a2423c78687d110693a845c
SHA1 e76e0f879bd11af9aefcfe1af61fcffc630441b4
SHA512 f49a2b1719a68a353419470503b04453c1dd2d7b015fc4b36e506cc0e3ca37173fa934f0c893154692e875a40e939099562665ebb6467214e5a050f695dc6507
SSDEEP 24576:V0ewsAjo8U7tTK3VnChd4Q4PQpUcrf0FGDQ:uljo8U7twh0gYUub
TLSH
T1FC15E030FA74E436C37B0DB22B36C716582C7A204F511AC3E3A89E9D5A346D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2020e83817bc43749e37141f4d48ab025283ed661a5fbd109a60719e1dc9f792
MD5 8db58c92c0c35b01d13afe9f8d8635ca
SHA1 34c413afdbc2bb0556900cb9342be6e4add23339
SHA512 e1e4d419579d9a7cf382b36dd9927f7916c162a92ec117546a94da06d17cb6a8c91648c1fabe29548388aa04e0d5009dd7fb270103bdfcfd451cabb464b3540b
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHFH:YUEtQevvqc2W1cpV2tI32V
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e916f868519315b1060a51182ec6516e19ccc23c45c3ac46ecf7252646d3b866
MD5 3b7a7877695a5673af56bcc606fb5285
SHA1 ca3e4e17598f91efb13bc4ebb52b8d1dde69c85a
SHA512 2f1436a30a196b7f56f73832aa0a97356c624fd526a6b5e24f885f87902101cd278a89012fe416a945e8f2ef2938e0ccbc58158615e25bf28c776d388df10a45
SSDEEP 49152:mCbRquA/m2yL5zTfFiV+XenmE3/zI8U7twh0gYUub:LoquVjnmrbpi0gYz
TLSH
T182D58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 efc26dfc8477ab96939e0ce8d7ce732a1e229e6afef460a95cb66041b72dc2f7
MD5 1b77323d3d17e572168cef15b107bc4f
SHA1 676603890657856b23da64f58e188f28de2fc1ba
SHA512 f3eb6b2b623f1d493e084d679469f44abe73ec250d5461645cc67eaaa4988cdc8e81c62011c4a04efdb77575630d71b666da9a5ff15b2a187a9ced21354ac802
SSDEEP 24576:1AhGL3IFoiwtA5l7S53L8U7tTK3VnChd4Q4PQpUcrf0FGDQ:1AMUFoiq578U7twh0gYUub
TLSH
T12C359D80E7F955D4F5B3AA78A9769570EA76BCA65E30C20F2160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a6aa72682a34e94666229793ee78b35f3cd884cb2d752bba2fca62d5e5a64ccb
MD5 c7a3ca2d95692f4e3c9e3706ca75f638
SHA1 cca1e785138b67e80d1584a9aba140b6193ae517
SHA512 8dd8f1649e6e90cc0e55cebf0c12ceb1faadbb7057008d2008b432a452f7975eb64cc3b633eb2e3b49836814f5979b98a9d3f15f21cf3a8a63cd712496b97202
SSDEEP 24576:4wu4OWk8U7tTK3VnChd4Q4PQpUcrf0FGDQ:4wvOf8U7twh0gYUub
TLSH
T1FD05F04573A40CFAEA675239C567C536F7B2BC112A20CB1F1760CA5B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 591cdcbcb8e59cabce55d20a195ff41b22e6dc5b0541f77677bea832b8b695b2
MD5 37c11de8d388a9125ca8cbb62b99a4bc
SHA1 f98652d2a49df4c22a16e642526cbe57f1c9fc4e
SHA512 b77f1116a0a02fa94963a7774b0b687d2b90e71b89fecccaa735625ffcca7a25595004d3c5bc79c8b8a90f19eb93e430e73c3d26b60e554b49f2d9e193b9c28b
SSDEEP 12288:reZ1IyGN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:KZuh8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T10FE4125433D460BAE363133AD9B29A55E7323C62273483CF15206BA52F37ED58D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c7187073fc8b72a58dc7e4b8c4b1f09d1d52980f948cc2a6b8d4e673be63f83b
MD5 64b5d6b9e54ceab46ec0325be1ea7ed4
SHA1 8c97e703f6ec29a141d09f60e02bd3cd6d2955d6
SHA512 bf5de3b3a3371ca28e29237ef0725921b7f3f28e12bcc2ef35d59ccbfe6f212f17a403efb4d6bca73dc7be1f26470e3742f10bfa254454ed018f9f5d58b507a5
SSDEEP 98304:CQRQyi36YOcPbLvw2gAf+PN3ubpi0gYz:ZQyiKa/X+PNTH
TLSH
T12B666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 93929851a9a46f744b749f091b54de5e8d80a5bf2a18515647eeca44b66c9418
MD5 658b9a7ecbadb6335d36ede95cbdd3da
SHA1 2644c3ef9797463e016f0a2233a26d8137fdfbfc
SHA512 d2c9f258a90f4d15f1fdca7c9edb790646177dfcb88a5e5d32d30b9ea0e457a2ceb0b7abb78a71016c2ec392ef9d2d6fead6694a6d6baa925ddc72859225aede
SSDEEP 98304:2QRQyi36YOcPbLvw2gAf+PN3ubpi0gYz:9QyiKa/X+PNTH
TLSH
T1F2666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7277473d650c7d4b7a98ebb23197642905b33ab53d55547cffd2f65eb11cb99d
MD5 de3dc9561c914e6e2ec77f02e89653a0
SHA1 06185eb028b23d5eebec071c92474be93b758ec3
SHA512 3d7d68e7e332fe860ff29b1621e20d190cd5dbdd07a09756e5a2b8f391dfe5e79a9f2e60e7899fbf655290113a61846b60769c1e6490eb514b26c5bf6dc13fd7
SSDEEP 49152:D68Qg55nhceWu7PNU3/Y8U7twh0gYUub:9thLRc/Ybpi0gYz
TLSH
T15CB54933B2F200A9C44DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1251a95841ca9f1c68919f92ff011b496669837c2d1660077a15bca1deae2043
MD5 77ff12eb293ef2bdf6a089ae7413a6bd
SHA1 eb969246f89b94c8d5655768658629629db28d35
SHA512 941332cb9bba27fc97d197555e78409d95fb5ffd0f996df7a9dd9784b27b2ba28fc5c057eaeca0b350c6658384c1566c86cffea2dd48409c8e48695f4a4e5d78
SSDEEP 98304:Gy5112gYy5azzVvt69nLKnhZNbpi0gYz:3LIHEWhwH
TLSH
T18E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5fe6cf6d1cc5ab26a8b1d5341e7e1edfa368e621f533d046daf4037676698985
MD5 b3ef838e4d809eb66fd614e112e89d07
SHA1 f53b90d8c94523093405464a48cce02f2909e97d
SHA512 cc57e183ec869e30f908a377afcb19dc97bb8241df2d0e6aef528f2eb68fa2611807b8458776838705d431a0e750b5060fddda33c97a1b56e0bf389ae7573885
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl68U7twh0gYUub:Du6Jmdxd2d6bpi0gYz
TLSH
T1FED59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a6fb81f646671c412a0410fcd043ae3e65d80d254ae3d1c2dffa053d6a1650f3
MD5 943a439d56e25e3d070ee047fa08dceb
SHA1 c4c1fdfffd3125836a6811166aef78712dfd95e7
SHA512 f6fbb8ebebf8636f05c2a869a51d9c4341cc0d2c450dbe5bbbaed08ca57a61ace1bf93e46d61d71f33e4d395189c360900f0ea5fdb86695f14984a01323ef7e4
SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4xy8U7twh0gYUub:PmifPWRrbpi0gYz
TLSH
T106B5BE13F2D900E8D06ED17887569632EA62BC460B24B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 507ac413507e1479fda6dee6c94c2b85690beb98a78656a20f97605efd8c54c4
MD5 cce07728cb9e69b6a7f2123c404b279c
SHA1 78f7d7b088005b0d3a7691e48e534b7e3646b1bc
SHA512 b4748633229e81c09c7a1f2fc4191295f42b06b10b43813ad37cbc569896b22c62dd1fd558bc077e88914f929fc30d80d7ca3847456e6e909e3c2cf0a6bed541
SSDEEP 49152:dSuZQIY0Be2KcRVtOnks6NMHqh8U7twh0gYUub:z5dKii61hbpi0gYz
TLSH
T17DC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e20ba016f29c4607f4991dab7c45aee6114f56592bf4407e964a9972cfd28d42
MD5 7fdddc9737442abaf7699f65d1ad9fe6
SHA1 4a81e7afd8b9a8e046eec67ec2699e5edcdb25cc
SHA512 50c4b6bf922cde8963252ebf9e4f87737f37a7ae65a85afaac33968413a5c7a7b3f2d7818f5b2c66abcdf196843321be09a5ed9a94f69e06fefa93ef00b1e80c
SSDEEP 49152:8htSn8EApI0fig3giDn0AP5w28U7twh0gYUub:9X2imph3bpi0gYz
TLSH
T1CF95BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0b84225ef1ddf199e78699fa69066f3eb21e49fdc7aa4079f2b03d2c19396459
MD5 c7b74c0b8faaa3d239038ed8c1bf7a20
SHA1 a2a8fb19050dc2c3a94aa9e6560ac5ececbdb9e7
SHA512 3db4ee05a57e74c8386ad69a0efc03ae59e7f4cf161bfbc005e8864ea4f3749a0c268f0c427ec5237b3f987a69301ab21e5fa102eb74825b07ddd5413fdc33e2
SSDEEP 12288:6fN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:6F8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1CFC42310F7868D0BE3112733F537E5A4EB141EB5AE448A292550BEA07F7FE9C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2104c767ab9128f4f4f4cecbc9e3c41dc977af450804a0db0c1daef579b5027c
MD5 7597c75804254010fa5df48bd3abc7a5
SHA1 981dbd81eb9dd7d25ab27ec807d072f08b52f9e5
SHA512 58bc460aaa37ef05b36821588a1aab8f6e3802c7cd45488c760f0464666bfde0fcf4a5d20d36a7eb21e48c340ae9c0b94b5c63aca517a7d69d2597e966506f9c
SSDEEP 12288:PqN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:PM8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T11EC42320F7964D0BE3112733F637E5A4EB101EB5AE448A292550BEA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 72486ebc2df1a5619bfb34e7a9b0d3753ffcd11380937f0239ee74f94c38c952
MD5 8cdefb1de6e78532162f0ec365425385
SHA1 d7351d69a4866ca216b6eff92df57e9b88bb146c
SHA512 fb1592d69ab69656a9c2123fdc47681adb4b590302b8ba994fc5c064091b8ac5653d2eaf57461bc2e393e4325e69312ae60a917e9737ab96bf706080767900a2
SSDEEP 12288:awN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:aq8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T142C42310F7968C0BE3112733F637E5A4EB101EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 8ce597ae29a65687a7010763428309012e6f05ce5870fad080c0b108617f4507
MD5 ae7cd4b273d4de982b756b0c4a8c4b43
SHA1 afe909ae19238072b4e615a7fd58d9648654a3e9
SHA512 3e78a83887c23b5d74a38b108a1316612951dd7bbd8ce630d82426eaad74cd923ab4697d57ca761a30f744db15a67fd30d69ab234f0497d28c4bf07d860827ef
SSDEEP 12288:CV1N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:08U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T12CD42310B3964487E2222737E933D5A4F7217DB4AB108B6F19107EA52F37B9C9DA8E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2a255f51a0cd55d458ff61de248ddfbf058aeb49313369459dc0561f9479d713
MD5 16e8202afe6fd8e9a378f79d6a9d7ce6
SHA1 073858ae0de4506033e08087ac22ea824e7b2c9a
SHA512 34d88042a3d88b64a8a340141446a7a73304d3197602f22386e2e227c23f0fcb2fc0b0a003986c3c6fe8ef81f5aa811d3e75992a30f1ec502efa0884b7a727e3
SSDEEP 12288:H9N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:HT8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T120C42310F796880BE3112733F637E5A4EB141EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 477eb647f59471148097af310a28ad7b6405cef56ab05de4dc2ca2e82af72a21
MD5 9094cc4f376783721d96a45bbcda7842
SHA1 cffd3f9341d989aef29e331c30df737981b986cd
SHA512 23bcee98c371e16a860ab7405faccf605e5378cbd6ca8a57bf8cf895028d66bc783d005adb39464d38479ac1fe934b7ef85b68f9f83f2931926e67de9bdc280b
SSDEEP 12288:VON4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Vg8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T15BC42310F796490BE3112733F637E9A4EB101EB5AE448A292550BEA17F7FE5C89CCD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 bb6a64f5cf587982b0e3a48e4c9fc4362f8731e0c02b6f20b5abfea498534513
MD5 a5e85ad38ff618f704b6e03fd70f7de2
SHA1 635f377d5d559c46bdf6532205c7e31ee4bc8c67
SHA512 70aac382b50fa3ca668e06673a7e484367596de58297099d2e43e6b9c1088f4d7b66fcc80c719e2af958006dd75d8438beeaa4f7c761c51ca879098343ac61d6
SSDEEP 12288:vyN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:vU8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T192C42320F7964D0BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8082459e168a984a9280f2e41c7b1e0c579b0d63424da409ab52dccc3f12c523
MD5 4f3dee1b68f49b4eb7578061ad488941
SHA1 5df2d4189598715fdad513b11210a63f7e87210c
SHA512 707c021d7a4547c60ed9b7c1381f5e3bbf693e29c960e248545c945ad16c918d1f6db2a7f8786cb1caf8e44eab846c82249f7d03d5f87ce2b2fcf304f64a144b
SSDEEP 24576:eZMRzFVSOs8U7tTK3VnChd4Q4PQpUcrf0FGDQ:eZMRzfw8U7twh0gYUub
TLSH
T1500502A4B3900CF9ED63423ECD269915D7B27C690B60C61F03A43A665F377A05C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 44d0f6c0fcff167d18f3577d3eebeea1e1806ed20354b480fb4611b5cb8c7940
MD5 426f494a31bfecc22bb082e1d2ddf9a9
SHA1 5742e83eabff53a1555107b01b69b4659aa54762
SHA512 edaed44102958af9b4e64ea807e28d11fed64da158e3e1a004d98660f4b14fe6159dfadbf5b130c264a211aaf560ebfb80864dc458ea7166006a2726024e8b92
SSDEEP 12288:1bN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:1x8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T141C42310B796880BE3111737F637EAA4EB141EB56E448A292550BEA07F3FE5C89CDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 51f33f052ff1311978292a2a8464e6240d0c9e86b6647c3ad931a55a3fb4f81a
MD5 a8134741a934f2264e33881fcf2881b5
SHA1 0fd749a82313bf2222b2c4b9ff397fcfe823220d
SHA512 dc92bcf909304cebace0af058e7e1cf5c6c1eb50c71606773f9a37c51595fa1ebdee0879289f22f602706df9db0cbb00477b5154e24543f46b4ee2825a2f2826
SSDEEP 12288:W3N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Wd8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T125C42320B7964D0BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89CCD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 59aa3ffef137e8f3d8b19f9e1a178ee986e4dc221145ef222b5c9f2ed79147d5
MD5 9ca445c5c9e81e6b57b172da27d97df0
SHA1 5bb3768383c4368d6f37ec7e2e8a2b076458bc45
SHA512 965b19946132f304cf60e96fef2cf9cb16f3373d3b97d08187ccadf726a3487baee56a3e472cbc7faf1d961db25e83e29b653e6de0f6e9d61a65b3f9d820bea5
SSDEEP 12288:9yPz5L8GN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:0zy48U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T19AF4021773A120FAD2365235C9225A51F7317C324B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 fb6cde90a06fe14acbdf419b6f7fc76000b477649630d8a08ef0e77e9df792ed
MD5 6b260f2f371e6edba8d894a6c6660b8e
SHA1 25b8b606e8a481c20403c03dbae5eab82c544d09
SHA512 dcbb4c408f6ec43b6ba488153b57454a6f6d87934136cea7b09d8c25b95850fd639dd27fde1d8d6d0ff903c35a1aff44aefaaf05f9ca53603686b1e5a392ed08
SSDEEP 12288:dbN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:dx8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T102C42310F796880BE3111733F637EAA4EB141EB5AE448A292550BEA07F7FE5C89CDD41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bfcb5b66688d2ed1303f629d6b65977e614e366de1e3704634f4ff12f16741d2
MD5 99062310e7bb53875355a991c29b7b6a
SHA1 66e9a31b5477872409131a5fe8d06b2372edf2f4
SHA512 feb41cf1781a602fb006b9785f2f500094ace7b4ab7f90facff0fced533603edd97b8771a1ed6d3c157b296c086c7bfa316bb8ecc76613962d6ded43b7e572b5
SSDEEP 12288:YbN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Yx8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T175C42320F796480BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89C9D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 9da45e1035972bef725bdedc5233a0ea895e9f9f14b992f6f0e0986dfe3bc4fa
MD5 0c7780d64db9d20eb062d098247961de
SHA1 d952e8d6ed2fc24afe93c83eda092e1c80d469ea
SHA512 a9fc523e67216e9dc1791f95183421dc7d5da3f2996e774748211ffb175b8c77ff5dd4e93c366222a5666e7ddeeb70856066cf9fcf5bda197f64b4a7d4023f75
SSDEEP 12288:iyPz5L8GN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:/zy48U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1B3F4021773A120FAD2365235C9225A51F7317C324B108AAF17606BB62F37AD49E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7837540dd5f43bcdd99215ba5df3f24ba3d703fa529434c30a0061ee30b5efd0
MD5 8dd3e4f8d66baa4354beb72fabfe354e
SHA1 b1e6d620b8b0be4cc207be866a8acc943723e57f
SHA512 9f97a747e6c7169df6fec50e0199cdbd3cc0c4835a873013b109a329f288810939a0f6934c345df66a92c66af7ad593b46763ec701f782cb336573072a51f26f
SSDEEP 24576:rTDaLl3z0zDa8U7tTK3VnChd4Q4PQpUcrf0FGDQ:rTuLlj/8U7twh0gYUub
TLSH
T1AF0502A4B3900CF9ED67423ECD268915D7B27C6A0B60C61F03A43A665F337A05C6DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3a9b1ecf401e7e7a193597e976dd9fa3cefac2324d6ae2c9bb8fe0a3c37a9128
MD5 74a991af4e6d017b2391c7a302eebb49
SHA1 00991bb26d6a65a1557c7ad9fb8dc9c6026fec43
SHA512 00ce6388a4e231ca26c6cbfd9749977a99584eaec54e446255182971383b481364b139f4a5afecc9ef4e2a8de226aa6cb786bfd9b8597c661010f5065ab4b7db
SSDEEP 24576:b3vd9CHKy7GZO8U7tTK3VnChd4Q4PQpUcrf0FGDQ:7vd9CHKyaw8U7twh0gYUub
TLSH
T13225CF90F3E414E9F1B79A35C9769511DA767CA91B20CE8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e8058e682de8f96bd02aefd2bd824ac7ecdb5bf7623502b74b38a6d04c85c505
MD5 05ca596c2cf5bc4e1381bc160547cc23
SHA1 eb87100425b0b20e9364ccbb2adc949ca1957f7a
SHA512 5de01b6d45a5453c4fdaa28b8c7af077bea4a8ec32393412389cf85ab5c2e5df3913b50f9a236e39a3fa063b395aae9c82802ab8f85583fb45a1b823a2d84479
SSDEEP 12288:oQN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:oK8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T13FC42310F796880BE3112B33F537E5A4EB141EB5AE448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 ccdb0a68857326f761e5810bc2fb56e02ed12fe91a10beb28126b1b84a6f30c8
MD5 c60dd079a8b25c808253203fb43d33a1
SHA1 cc5b12541ac8b476f84dfe2b2b05ef2682711c08
SHA512 06de22012e864616e292ed7f9370a6fc4d25e552ca48fe1eb60a5a418ed2aabbfd07df3ee02ad29558aed53534c2c6c37a5b518bde61624c0fa1ee5b34c29128
SSDEEP 12288:0mN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:0Y8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1E2C42320F7964C1BE3152733F537EAA4EB101EB5AE448A292550BDA07F7FE5C89C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 cac4e214ee2650a0bf7e5badd8517306fb7fcf52d7d8f77b263ba91145af1238
MD5 757642510fec3a90db344239f886f416
SHA1 5d30550132e123110e3dd8e2af4eee6e2b170284
SHA512 461220a7b4eaa79daf8576110c79d9594db3fc6eded52aaae90c1493761d3e0398cd67fded58ff8dadd5b443d35203af02b78f2d8e7bbe16193e40ea287c5dd1
SSDEEP 12288:RxN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:RH8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1D2C42320B7964C0BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b3b925e7bc65575fb9cf0ec9e05df41fcda057133cdf8d138cf75a8ff3fb0319
MD5 2401b7bf9c832e2b01f1795ff86cf34b
SHA1 bb27c1fd9ed9fdde166c51434356ece6550d9330
SHA512 caf660986e1538852b10f51424c4177b09d29d2747a5f76a891190fcf6bda1bb4ea5e0387f8a849faef342c0ad14864af63f218cb02e861ded445f0e93c85982
SSDEEP 12288:wbN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:wx8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T157C42320F7964C0BE3111733F637E9A4EB141EB5AE448A292550BEA07F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 b67f68e2d3fc3f061b0adcc8126850a6f06d9517fe62c55aacd0c57feee795ec
MD5 f7a709bbaba67db2b602a29eaef3b9ef
SHA1 81ce09b398eafb0db66bfdfd3d1e1fa1954a7043
SHA512 509c274b539b6c7d9e9bce9e631316c2ff9888eb6f5590fc339be76f428e439f82a41fdae4b81ce476c8c815ae4b8088e6ceff5aae948f1a3bcd9515bb1fca59
SSDEEP 12288:/QN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:/K8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T185C42310F7968C0BE3112B33F537E5A4EB141EB5AE448A292550BEA07F7FE5C89C9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d1b38edc83f20574a9e8d070012338253de97200a7cb2709edf9665e1b57623f
MD5 dfa4819a310fca350c16548fce76e8ab
SHA1 eecbadab4b2163431451fb6ddfd3e637b65e090b
SHA512 38a5d275bc0996f42a214a172798e780077642995f0f0508c36da674228e0d7f5da50933354a27464e9c0e2f98de4e78c71950e921b7cf42f00d98eef9350850
SSDEEP 12288:wjN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:wZ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T12FC42320F7964D0BE3111733F637E9A4EB141EB5AE448A292550BEA07F3FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 984ba7cf5543a85fef45c28411944cae479525b87c86d120531d93bc53837358
MD5 3c264a6d8e2131281cd64bcde40d9913
SHA1 0f593d3bb2c60384d96206e162331a27cbda3819
SHA512 fdf4a8f6746382d2919be008d2a4dbbf7a2b995dc7dd48cbaa216373ff1eb93232c4c0bb278bc30a517d2546b571e1def94638016e623c61089da243a4eae741
SSDEEP 12288:J9N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:JT8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T174C42310F796880BE3112733F637E5A4EB141EB56E448A292550BEA07F7FE5C89CDD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a3d794dd301837f97995bafe9d0f6073ea702146da46196e1571b85a68276f76
MD5 4d7a12deba7c8b573ea34d0cd4bd37b8
SHA1 ddb77b3e6c9e724f190bdd1fe0139ab866c0d322
SHA512 0850f669c916f7bcf74edf734cee4f8df7f1f877a0b90d804b4584f8ec982cb46ba9c03b9ab7e5284b0a44c70f1c7997291b9fda61d352034ceb1f635818c60b
SSDEEP 24576:VfwvUk9RX6wkyAIt8U7tTK3VnChd4Q4PQpUcrf0FGDQ:nMnYIt8U7twh0gYUub
TLSH
T12135DF29EBD844E6E177923CD9B3860AF6B178681B31C6CF025A53AD0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e302e4015604e0638496ceff1cffc0edcc834512f1b1ed204852c62981e76017
MD5 5c30433d8e31972c5556ca7583a73fd0
SHA1 bc8df39c58c3bfb0f5f5c7783ee19981e2056dbb
SHA512 48ddb585e6d99a1da353fc0b9f7913b80857428fac3f5b6ef37468e647a0be9e5504b097ff52442945ad1fd35cd06c3bdaefc8e0aa269ef8cd5e348eb17d89f8
SSDEEP 49152:rYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0W8U7twh0gYUub:uySzPObpi0gYz
TLSH
T1DC066C96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 275455f4d76b247dd3a62b428fccf8e3088cda062e1d8325298d909577e3d998
MD5 93b7e061d91f7cc2dd36bc9411c3a822
SHA1 d38647b9df9fa6551447ddb43e2b629456013e8a
SHA512 d3b52406aa8c8095b249b99855e3d3b8bb69fc2bdfe1a8f46294736b2f2bfcccc9af89b62f3ddc991d700a70d90396983c2579d442d247b766e7e440847d81c3
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY88U7tTK3VnChd4Q4PQpUcrf0FGDQ:w47JUQjTirIhCnDHUPfF/m8U7twh0gY3
TLSH
T15E659D1DA3EC01E5E1BA923885158A5AEA71782D1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f1d2c9349fde9dbf7ffdc82463005e2a8374adfb534b738e0b311af691f0ebb0
MD5 df66f3112ff73ccd0acb7a36e65c1c94
SHA1 64387c27db50b526a2dea5573fc6441938069604
SHA512 2bd1fa695d15d2fb8097236a2a2c5d3eaa871a1493e99a2958935a6d906096e1d238ef1ef8dac392034ac72bfa28fca4078cf9d2b3cc68bd7e49fed1ad8b8914
SSDEEP 12288:5bsfLN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Uh8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T11DE4F118E39402D9D16E2236D7269A40F7233C6597E0D3CB16D0F97E1F3AA949DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 916KB
SHA256 b3539b23a4e30408e3ea03a943910db3059652bcf96f0a9793eb26bc53503b68
MD5 dcbf28879a51a02db6dcc95c5aabe937
SHA1 bce17849e2a166f2410711cc1fa89a8bc064e2f4
SHA512 d10e882cc2ae2f0d34d6280dae2a00c404c0903d0ce84112ffa3383fb0a2172646b6f993c4671e1edf3c6413b77dc32210f54cc9f03972cc568cb71394d4f576
SSDEEP 6144:lgsBC2naukdmZEFak2RZotMxGJ7xU3fpkSTAXVZRcVzR5EbIKI3XmqXb7cNgu39B:lx5ZzsU3fwRcVzRyWPcWu3m0CJnm
TLSH
T10E151751762BD75FC6A940321E33C2CCAB707D41EE059B1372C8872FC576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 91dfc09c421b062c4b60b2389d636359b7cb1bf122eb01eb6b6e54285e03d45d
MD5 045113db5e6931fb32adf40283ea9cb1
SHA1 87c8b2f1bbf2154a6e8b27be739c212c43c0d492
SHA512 1f4851c8a1ff27dc7d795a6a2614dbf8e6edd248036aeb99d5cb10ccc5acfaa1d3bd74cae335bf5d2696dde4f6106a246c41e0c23be747c20a03f2ec4b1af809
SSDEEP 6144:ijVox0Eb4b2f1k8b4IdIzUYZ1k1ivs56eERPtMxCROFZctZZyWw9fnrRP3RPtMx6:ijVZZ1k1DXbVGa
TLSH
T18355A581503BA3CBD1FB3131076A5F4CA764EC06B6495F6663C8053ED82BB66B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d76bc534abb12892da9cad48c836eb9f820e7c72866a105f15b50cfa6a78a26e
MD5 6ed4b65899f86ed5529089dcfea0296c
SHA1 c677939d3de4ea1bac165532507311cc27117ae4
SHA512 2210039b1e4fc112e5140a451a05177197ad5376e58c12242eb065cea22e70f46c5495f2caf91bad940a30c03a71697c69b1470dd4f5e3307fef4904b2c9334a
SSDEEP 12288:a07TN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:bJ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T14ED42320A3998C0BF2752732E53BD574E7156E745F00C9A76400BEA46E3BED8CDE8E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2a7c8551d6bdbccf4e13c8682d2bc40b5711050b046b32f0e7c1bf5616852b3a
MD5 67bc519cb0e7861a25e867a4f2eeb86c
SHA1 a74a4dc6ca7925f1c12a5685767ef8b860406c96
SHA512 22bfebecac11ef53d81aef7b4efce4a44f07c939aa6a2a69f5bde1263a33056bcdc000e7cf2d9cd94e98dd0f7f6ead557892eb0b13abbf0988e6c76a08bbcaa3
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bY/8U7tTK3VnChd4Q4PQpUcrf0FGDQ:agb4mBIBhGF88U7twh0gYUub
TLSH
T19665AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6e09364ab1e149ffb6763bae821c824408719a946314c39d11a801dcf5453001
MD5 456f04abc10cd4f3685de3a3aad8e5ce
SHA1 b4fe1ea4ce5883a990ef2ae8f34026c86229a7e4
SHA512 331eb1fe5b50fa087779c0207991d9e9777a972dfc8c50d439f7d4dff1f2760f4033afc74ad36efbf234a421c7421e013741e1451a5610cbe10113eee28eda29
SSDEEP 24576:lG88u8FpJqH1bzria7/ms8U7tTK3VnChd4Q4PQpUcrf0FGDQ:I7ZFPqVea7/n8U7twh0gYUub
TLSH
T1E435F165B7E101F1D4779138CA528663F6B2B8250364EBDF06A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 dcd5896136a4f43a441f4c4794ce8f148d6f1cdcf9274f20037b21ca51a504f6
MD5 6111037fc208aa62c1379bc0506a477f
SHA1 143cafae936218d013310799060e990e4c195471
SHA512 ee719dc9f4e6c60aef560e896aedc9a1aa5d86a0c2947a2ee79e4fc2a27532bc5a69f2764bd06bab3551a2f30158dbd5a00835ed44291583f183134e0bb7da16
SSDEEP 24576:2PUr+NQw8U7tTK3VnChd4Q4PQpUcrf0FGDQ:2JQw8U7twh0gYUub
TLSH
T12705E12E62E91CE5E676A13DC9528719F771B8620701D2CF02A0917E5F37EE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ff3a7879279aa92ffc8e118f6b2eddfb688c3ec32229636cb4482839648b77da
MD5 fe689c3bccd2fe64b2ab07924a22d569
SHA1 f4cf1dcfb828d247e03a625f98f5353790915195
SHA512 d3ed7043ee5068f053835e9e026847d2ef27f991e4de5f665418e9332fe2c360e29ee1223849e56b5b8594b37b0684fdab158e87cbe6dfa7f67bf4f94e76ad27
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjg8U7twh0gYUub:XG05lO43bVbpi0gYz
TLSH
T117D5C06E62EC11F9D1BBD17CD9C6860BEBB23815032456CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a44f83d0100159304a9043f81c262b91c71b0159af0457f5f6cb283133302616
MD5 3e78871e1c0ca87e824dafb54133e3e3
SHA1 4587c149126b0e5ccc3829094d8e7dcbbd28827f
SHA512 d64fa7f81a22d8b429e40a1dbf56c6a18642d0f0fca52aa472ce94f80ed7298de74d6074d4a2bd209be861f2520786a1901cb6d1db44af684bf4353eb5e107fe
SSDEEP 24576:Vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnW8U7tTK3VnChd4Q4PQpUcrf0FGDQ:1a5POZ3BJt2pasx2+mY8U7twh0gYUub
TLSH
T1D265AF5DA7F801D5E1B9D17DC583861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7899d696a92def686f9bdf3928fb5bcebf0ed42be445116c4ab05406b1ff3500
MD5 d68eb1323136ca1dff45876af53adf83
SHA1 c8ba199670b5ad3ebcb1fc0ee54713de346f0758
SHA512 7566ffd48f36e18476a67173d811adc7b23fcea6ec689c53f917aebf5a82d14894594fcfd899756ed510e7b99f24eed8a1fe110243b29a77d8ccf08e33a9e5ee
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkE8U7tTK3VnChd4Q4PQpUcrf0FGDQ:BNc/zEOVHFH8U7twh0gYUub
TLSH
T164858B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 45d73fc1467b09d6ee7594e63b3394f8606a7409d7c30adc2dad9128a9190657
MD5 3e049f02e24812b83b7a3ab50eb835cf
SHA1 0c588dd85432c336bb2ec08a5127ba6e204aa712
SHA512 b4f86a507fc5fc8ec1d8e8f384823d0c4cf6717c55f8ef8d11b769ef99f1cdb76b5ac914dedb6b11e4d291e3dbb92f2ee0a3c0afa7d0aaa1aa7b65c7b3f08209
SSDEEP 24576:3TkNvNnaFeYhJNtmZBmW8U7tTK3VnChd4Q4PQpUcrf0FGDQ:3TMwBtOmW8U7twh0gYUub
TLSH
T15455AF2EB7F846E4D1FAC675CD238512EA727861073293CB5290C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 8eb13a467699e6b7288689e96d605e9ca74a1ffa73d5457239fd47a4227ed8b3
MD5 8bc995bf37eead29dfbe2674cf993657
SHA1 19e00eef73ce52043a74f39de4ca52fbc7efc1d7
SHA512 097af2a9716a7200bee1db35b589a802bfc18980c1b4c7ff74d9e7c5b58f7c8fe9ff1e287fecb243c392f15250cd262698fb0fb4d542a58d873fdefb149643a5
SSDEEP 24576:jD3FHshBIYQgAl8U7tTK3VnChd4Q4PQpUcrf0FGDQ:jDVHeBIAAl8U7twh0gYUub
TLSH
T18725E13DE79C04E5E57BD27CDA638A06E77138A903215ADB029091B61F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-86-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/256-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/256-328-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/256-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/256-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1168-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1168-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1168-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1168-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1208-78-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1208-292-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1208-62-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1208-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1336-122-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1336-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1336-134-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1336-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1336-130-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2044-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2044-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2044-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2044-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2044-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2680-325-0x0000020CE2D90000-0x0000020CE2F6B000-memory.dmp

Download

memory/3044-9-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/3044-56-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/3044-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/3044-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/3540-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3540-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3540-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3540-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3540-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4108-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4108-23-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4108-15-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4108-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4108-21-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4296-402-0x00000228A97A0000-0x00000228A99CD000-memory.dmp

Download

memory/5000-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5000-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5000-309-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/5000-310-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5000-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5000-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5000-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5624-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5624-276-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5624-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5624-70-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5688-305-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5688-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5840-118-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5840-112-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5840-110-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5840-308-0x0000000140000000-0x000000014013E000-memory.dmp

Download