Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
- Size 4.0MB
- Sample260724-xpjtlabj7x
- SHA256 24f699918f641165f6e6a3b85c72f4d4263555896e6d06502f5c21838ff3719a
- MD5 9eadcb165fea6f708881d6f625947eec
- SHA1 5a699424413128a6579c2048381d96dcc85c604e
- SHA512 b46f059eb0c4dc25b72b195e7be00b074054b2c59c4ac254e6ad94bf2d0d949b2bf88eb089a41dac9b6df8203d70d2d37e0f19614cbeb0f29ad8eb5081518ce9
- SSDEEP 49152:5+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755TF:k/PvOBjcXvvOOc5MtA
- TLSH T1FD165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 3324 elevation_service.exe 4376 elevation_service.exe 4308 maintenanceservice.exe 3328 OSE.EXE 4368 PerceptionSimulationService.exe 5584 perfhost.exe 5708 ReFsDedupSvc.exe 4664 SensorDataService.exe 5124 ssh-agent.exe 4644 AgentService.exe 1968 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\acdac61983806d8d.bin elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a0cadea9e1bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056807ce99e1bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d26002e99e1bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000db0416e99e1bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5620fe99e1bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3324 elevation_service.exe 3324 elevation_service.exe 3324 elevation_service.exe 3324 elevation_service.exe 3324 elevation_service.exe 3324 elevation_service.exe 3324 elevation_service.exe 4376 elevation_service.exe 4376 elevation_service.exe 4376 elevation_service.exe 4376 elevation_service.exe 4376 elevation_service.exe 4376 elevation_service.exe 4376 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2308 2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeTakeOwnershipPrivilege 3324 elevation_service.exe Token: SeBackupPrivilege 5708 ReFsDedupSvc.exe Token: SeRestorePrivilege 5708 ReFsDedupSvc.exe Token: SeBackupPrivilege 5708 ReFsDedupSvc.exe Token: SeRestorePrivilege 5708 ReFsDedupSvc.exe Token: SeBackupPrivilege 5708 ReFsDedupSvc.exe Token: SeRestorePrivilege 5708 ReFsDedupSvc.exe Token: SeBackupPrivilege 5708 ReFsDedupSvc.exe Token: SeRestorePrivilege 5708 ReFsDedupSvc.exe Token: SeBackupPrivilege 5708 ReFsDedupSvc.exe Token: SeRestorePrivilege 5708 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4644 AgentService.exe Token: 33 1968 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1968 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1968 SearchIndexer.exe Token: SeDebugPrivilege 3324 elevation_service.exe Token: SeDebugPrivilege 4376 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2172 1968 SearchIndexer.exe 103 PID 1968 wrote to memory of 1112 1968 SearchIndexer.exe 104 PID 1968 wrote to memory of 1568 1968 SearchIndexer.exe 105 PID 1968 wrote to memory of 4356 1968 SearchIndexer.exe 106 PID 1968 wrote to memory of 6052 1968 SearchIndexer.exe 108 PID 1968 wrote to memory of 1456 1968 SearchIndexer.exe 109 PID 1968 wrote to memory of 2796 1968 SearchIndexer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_9eadcb165fea6f708881d6f625947eec_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4308
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3328
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4368
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5584
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5708
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4664
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5124
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2172
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1112
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 2808 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1568
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2884 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4356
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6052
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2884 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1456
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 2808 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2796
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 982ef51b44a81d8eeadd01f918d3d941813bee098420d5d2ebef08222e4ba6c8
- MD5 4fe08083519b259bf2a1cca5e32e89e4
- SHA1 3a5636796386c99a22a27186ad5b39b1c2895edb
- SHA512 5507cbc325d766d64143c3ea7cd78df736bf8665a40b8c0d11261c47988076dfec16346bfb0f6444a9dbba24d08eec3ae95d605878e1f18e9c0bd702698d8a48
- SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnsZBAqvpZlw:M3q6HjBltA
- TLSH T15ED59D03F2D900E9E06AD178D7469133EAA1BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 8a154cc3261dce048601263f044e37107316793e7d9045e4c830f404bf2a63ee
- MD5 cba6aafd9e49d13449f3321330c79390
- SHA1 950499aa354e00b111e432939eec967f4560b616
- SHA512 c5d859ff64a79fbbc7e28d95782f3b22978d3e414298a1f9bbb3db0e34a2b768dd278d151a8c5e343cd00824ebc822fc65d6d5aa0b4a64c3b6a7e5fef8d135c0
- SSDEEP 24576:mXYfDtczAeKY8fMCBTFKJo4IPpZThwS84:Ftc9sZBAqvpZlw
- TLSH T1BE05012977D408F5FD678139C9A2C501EB32B8910764E78F03E4992A5F372D8AE7EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 510172bf517ee33ebdb34c91b978ff2b6caae3ae24be0430ad4384aa9f2f0c1c
- MD5 1d862503597b1be632fd689e7791f083
- SHA1 194076877ed4396e1c9890397544e3a6f4a8dc64
- SHA512 b90b6846d445590238682b978e79132fa803f56ee6c29d85efea2cc7b8f0ac24dd633c313a006121396b364bc5d91ab72c9bab716341b13f041c0a9463fc08d7
- SSDEEP 24576:q0Le5ji0hmxirMKKY8fMCBTFKJo4IPpZThwS8c:qPji0AcZsZBAqvpZlw
- TLSH T189359E66F6748331D073C0B9C5D2A69EED7130861B308ACB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 aa175bdc01dc3cad2628d9613cdc4192f6ccd762c847df60baea026ef29cc463
- MD5 96b3bfe92f51c9ebfa5130adfe4a446b
- SHA1 84d3a837e7d6cc3c7ffcfe6c0be2eedd0b53b69f
- SHA512 6828f63a03b6df80e56b4057a0ef99e4ae031744265a68789152e545e77408efb91cc622cca8c389a7afc3d3423c0f4e6234823b83e6b66225969024ef3f7c54
- SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuEKY8fMCBTFKJo4IPpZThwS8k:I/ezSC6vUzPvxHjyNsZBAqvpZlw
- TLSH T16E755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 45f4839842d0a322ba41ecf2e0bba2eaa6b546dedb06ba0a2c70a7028e190191
- MD5 530f2d49527acabb3888b6ffc6f658a1
- SHA1 a95157d31468b13a1ee8d1cb55374e703982232c
- SHA512 ff07eb949a444f38f3ea3c3546b14dca1f5915df28f2f6f7dda42b53e604275539ea90731c038910c03c1d34de29f48107a431f577e1139bac52b46cc3dbadba
- SSDEEP 24576:ZVbqPb88hv/l+6/KY8fMCBTFKJo4IPpZThwS8n:ZVO88hXl+usZBAqvpZlw
- TLSH T175559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 f9f9e5c56147072dd11d3a43e63e91291bbb4154a8640f809797a9c2c670fdcf
- MD5 ed1812b2e9762e01a3286baa49bbc2c5
- SHA1 730e8b480872595183bc64f2810738e876135983
- SHA512 33c87264bda7b8f6073e84951a52b06725861977cd55c4d3399463915f15be4afc9050175785a3c65488de35af283400fbb0e5d90630cc22137764174ba32214
- SSDEEP 12288:xRmK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rF:xRmKY8fMCBTFKJo4IPpZThwS8R
- TLSH T1ADC423A61E495192F2478573A16EFE08BF70BD91084CE7082254B85FD8BC5DAFAF7342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 214af69e8b529ecfa2ecc5d2ada67df1fd1ceb5174b3d88889221f63fd68cea1
- MD5 3596b0244c521e6260c9bfff584fd3d7
- SHA1 d1e63ebd3c1def8edfc487b633593f93835b6b56
- SHA512 176c96510d941094aaa5854c8c75da03b1ee5dcddf6c320e39d53ed0f5a7b3f8a0bec2cc22442819dbb37c6a180555580d8b17ffe24c242023ae7969bfe60c9f
- SSDEEP 12288:0eBNUbTVO86UnK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rZ:0JIUnKY8fMCBTFKJo4IPpZThwS81
- TLSH T19B05CF3BAE28FCD2C27E8DB95691C600E77278704F11A3CBD164820EDE275E15E7AD25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 d3312f65443448d612590f2297b855e60f87ad3d41f14e59ebdba212db7a733a
- MD5 6c9e9dbc76b45910783d33887e22a049
- SHA1 f5a1d6208d0f97e6ddb1b30fa3c99eac4b2579d8
- SHA512 9d028cbaba8eac4d1a29e8b61974dcf50da45114833909baa695ae9ccb98a1e9741ced28ec99f591cffa8b4ac8294167456ca9f43f75a32ed8553d92fe010c73
- SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:rQvGAdlCEL8c/yRNw5C/tA
- TLSH T1BC266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 4af8411b18b631cad850d8f26e0052c060add72fbe2218f4da54f21af416b622
- MD5 a868c2784675f096defb6990a1cad883
- SHA1 53da62b4ae9487863cf34863747b9da71a7b836e
- SHA512 c75b0429068a78e30c699804c6a5543a4c9a9c944d1e1e58fb3c0bbc2437afaea25ffbdbc9c271d933c27586dd49a9184e554578cd3e5e8ea5f02b36470f258e
- SSDEEP 12288:hAwSfxL/2Dc34DLLmt0LDQewsAjpK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwf:CdewsAjpKY8fMCBTFKJo4IPpZThwS8f
- TLSH T18215E031FE74E032D27B0DB21B36D706683CB9600B511AC3E3A89D9E99742D26776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 a26f5144ae002d465d9872b6f5b150e67d49a608debc64486c12b4542349c1f4
- MD5 dbdb26a9a8ebefb90b7c11cbc7f42df5
- SHA1 e7a72a40e7b97ac50b50e0e578677d7ebf7dc628
- SHA512 52612603bc386d03b9d1ec3d5196d5827b1faee9999fea3b0f3b9bd2d1ab50c0ce4a1dce9262646f3fe2fe5842f5b44b3c1e6ff1f8f4a6bd6c4d270157511b92
- SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHg:IUEtQevvqc2W1cpV2EI32g
- TLSH T1B9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 60f7da6e8dd69f08ed86bd54bcbfaefa0d2d6efbde80db3d8a774ecc631b2132
- MD5 1e10e80e04801abb929cecb6c275a3dc
- SHA1 85125fc0454feb517615846396df705f6968294f
- SHA512 69d66817f535d035b900d6affe77a33be1178e39977dacb745d454a0f42e9036a76082cf16a57d3518df3017c9d624d40213e59576572bb223dd8c5a7d0e964d
- SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zJsZBAqvpZlw:7oquVjnmTtA
- TLSH T1F9D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 a4fbd60903ee5497213735d7a2c1b6a906ab184ed87711433218ff6b939d5cc5
- MD5 f7d99a49903dcea07f1a4a0a83fc06b9
- SHA1 148b2a147736a45f8b2f21a610ea6c06a9851a9f
- SHA512 51ec880fe210e89a2d2c1ca564ebd10791a63cc706fb0779286d15fb8d47b0815d4c177ad691de8e0481b87e3ee0be35d8ccbf575e81f552a88a8e72251650a4
- SSDEEP 24576:OAhGLJIFoiwtA5l7S534KY8fMCBTFKJo4IPpZThwS8w:OAMyFoiq5osZBAqvpZlw
- TLSH T18E359D81EBF955D4F5B3AA7899B69570EA72BCA65E30C20F2150D11F0E37E809D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 ded06234f33be840d843be86ed0bfb7423712ef8148b282199007dec2f4e52d4
- MD5 80bc2fa18063f12119475b904b54342b
- SHA1 2131acad73b789e7ff32df12ab2b29cf53a1c969
- SHA512 0608c602a7238945c4782143927224cd5eca434913007d186f4bc6eaa660f46f8d2be3a5fd69f021072de14dc432250f0616dae210be66c824d0eb97b5110d21
- SSDEEP 12288:Emw5HEjsChNVBFgl0WDm+CkK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r9:hwuoOWtKY8fMCBTFKJo4IPpZThwS8h
- TLSH T12F05F14A36A40CF5F5678139C697C536FBB2BC022A25D71F1360C65B6F37261BE2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 0e9fc9cbbe53228caf8ea1ca927e8e0e1454d68c74a89d6007657847c7e57e20
- MD5 1331361ecceac5bbc2afa3f88a7b18f8
- SHA1 264180751bed02b8940a0a5d410149f3a5419133
- SHA512 60c3e0d47ebb02393fd80fa7545aefc7950c92949434257e93b59b9ae709c83b4f21f97e77f9b1ed29fd0571506b591b3d66db798400baf55f595dbe9dcb6941
- SSDEEP 12288:pBZ1Iy5K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rj:HZuyKY8fMCBTFKJo4IPpZThwS83
- TLSH T1F7E4229A37D420F2F1538139C9F99A04FB707892173583CF1224556E5F7BAC6AE7A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 039fca3d0f57189a8e4e85ebc868660687b738fa788fdda91d6ea1b7d08a3456
- MD5 2e8c857eeb9e5b0c2fb37678404a166d
- SHA1 2cafde225668c12f3472fe5f3b9a28f6b57fbcd7
- SHA512 822077cfcb4d6be7bbe5364308136e3ef2ac9d9fe992854a54d1a630d8a99e3a7a837032bcd187af65b04c5492a0b351fb01ec498c1a25ae50e754f8c708fdee
- SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:bQRQyi36YOcPQLvw2gAf+PN3CtA
- TLSH T1FF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 0223782e0ddcdc66a4f2a2a521612a6db76f5e3ad510f1343b1ebfae4c4de63f
- MD5 06ab448327768ef3944b4b36cf53baab
- SHA1 dda14bfea942c0286e87662ed236e51231ed1cc2
- SHA512 f4c5f3f191571e88d3e14ce9e2f5d8950efe8c061c9dff181fc821e90f8437ac7f333f6ad7558ed1813bf26d2bef1b79aad026ff0c5b255abd535e3cf0e8d408
- SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:4QRQyi36YOcPQLvw2gAf+PN3CtA
- TLSH T158667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 4bdba2ca349d05c95cf5ff947484dc4db9526e88186ec620109cdaf8e02cc500
- MD5 2fe555f8cdbf9ce565042968e19ff8ab
- SHA1 d68611a866c94eeec2f2c177deb7fb5747d94752
- SHA512 3bf733cfcd278a50835cf6faf7263f5ccc3eea61414f1a2506e6edb849658add3eaa84553176499ed4094b5a2f6d7637af3d021b88aad69d5c891bb42a14debb
- SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0iKY8fMCBTFKJo4T:568Qg55nhheWu7PNU3/ZsZBAqvpZlw
- TLSH T13CB55A33B2F60099D44DE1769F4A972196E17C718FE0E3DB8511720A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 101254dffd481f160916b18b124c44e0fd515961da1c1669478518c8d86f704e
- MD5 141ab31ae2139aebfeb8e8e1839a33d9
- SHA1 e2aa93ee1a0cd8b22ca6a93b2f591453f353dc69
- SHA512 7f732ef4c973e8ff746d69e7c8435d2d8a8910d318070ed4d22c3a30fbf4c70583032dff92912256977a5cf846591c4490d32d39147633826fe91a81db66b9d2
- SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99v:hy5112gYy5azzVvL69nLKnhZ5tA
- TLSH T18E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 9279e169b9a3c3941d48f203aec66892d0cc8dc4e44d73ace9f1a5fbb7fb3b63
- MD5 125f85ec8e834b1853a327fc2792f603
- SHA1 a60090d9804d42d3279aaee3715f5fb5a1cdde6f
- SHA512 76a57ddbc90546bf26d1913a53bdf63a77dd518c625a234be73fe977bf5ac11bca54b285c940d4a550cafa7cd0c6f9ddf891df72e83be3acc4bc2b649f0e222d
- SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOsZBAqvpZlw:Qu6JmVxd2dRtA
- TLSH T140D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9072562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 9549acfdee96c1a0d58a248897bce9b3b6311d92d9cf65bb0e544182bc77249c
- MD5 410e3303f2b1bafbca1cab1356d81f31
- SHA1 bb238318f11031a1eab15b5fae6177f53448bc35
- SHA512 5bb168d0c4eb526aafe6684baabcdfe6c298b50b5ba57e56472f1ca8321577441876486b62c0c5b807b38122a5bb3336c37630f18ec8a04f5fcffee7f27e7968
- SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4xHsZBAqvpZlw:wmifPbRTtA
- TLSH T162B5BE13F2D900E8D05ED178875A9632EA71BC460B34B6DF0A90B7961F7BAE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 59dc04c0ddadeef62e4501d08d5bbc2081ff50d696eefb2602587b5c4fd2f7cb
- MD5 c9ebaf45dd3e3ca289cfcf51a4215bd7
- SHA1 3dfdbe5ba38918440caf308bf9c7e8129b7893ba
- SHA512 94a7f7723319b58babd92d76aa6a26f010279ca2968452986adaf9b38c8e63c92a7d0ca13204bea9b9e4381b429990a74b7886da098aa27f8e1a47f0de07d5ed
- SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqysZBAqvpZlw:c5dKTi61ltA
- TLSH T14BC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 ab57a604f58bc676f120ed9945eb6761fe74efcff9532f4374b52cd2363a5a0a
- MD5 38952c843f012ff3d1593d374bc789a8
- SHA1 3372331d9b77552600bda2bf80aac245f7b3354c
- SHA512 8b1d51ae6eb574c5eceb6a3ea9e5e369f1b887b8db2f9f283ef066c2e8ccb5359ca31d70ee2cb0513c3d761268ba3795544ff700c7e6ea890617ce1f3bd97656
- SSDEEP 49152:MhtSn8EApI0figngiDn0AP5wTsZBAqvpZlw:tX2iyphntA
- TLSH T15C95BE13F2D900E8D05ED175C7568632EA72BC160B38B6EF0A90B6561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 17de8978cbd65f11323b89ed57ae7bd276e76e2bb5537a9bf0c2dd909d28f353
- MD5 3d0464c98595f5fd0f30afb509513eb2
- SHA1 7d1c3291fc188ecdadb9a9a19c53550e8f098ec5
- SHA512 3519ee66699a6d8903445d3837835e91b0d0f08630aec1d2b1c7a3f226a34e567afdc28b2f53c552dad4c8bd7b737bdf6f1092592abc5d23a7e29723e1237f49
- SSDEEP 12288:muK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rQ:muKY8fMCBTFKJo4IPpZThwS8M
- TLSH T1F4C423AA1E494192F1078173E16EEA08BB707DC21908D34C2359B41BE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 e02654c5618bd1f98ab5cb9dcf3b293f1cadc7af21ad7154ebf6f56a3d9b1ce6
- MD5 84714575256c579edceefb488a1cfe1c
- SHA1 b3a90f6a0151a0a443ab5df0341640c297c77f3b
- SHA512 08c5b5b610d4ed285606d7e4fa00eacace032b8d291ae7106f116f279b71a88ac42c8a68f669648f402e818b1aafbb3a5be57881f60e60bff599808b56090593
- SSDEEP 12288:mlK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rQ:mlKY8fMCBTFKJo4IPpZThwS8M
- TLSH T115C423AA1D494192F1078173D16EEA08BF70BDD21908D34C2358B81BE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 49f7296a6605652c4e6867337a3f6a6c2af665bd6bd8165d3bea01a09f757918
- MD5 fcd59a14fe25a1e393f5638028f1deea
- SHA1 d503bbcaf7d96342b71937e74101ede153cd2532
- SHA512 b79c49ab821071dc5aa0d46df9e9c6eaf0c90233c4d2718ee2f84a68c451ab2d6a73e6fb84ab979845632a9dc1fb4224c08c4cb53c52e1d25b10fcf3d6f2e637
- SSDEEP 12288:LvK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rQ:LvKY8fMCBTFKJo4IPpZThwS8M
- TLSH T110C423AA1E494192F1078173D16EEA08BF70BDC21908D34C2359B41BE9BD5DAFBE7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 a09b64650c64706cc6ada560067dd1f173f261174639740bf08a9ae12865c918
- MD5 802aca758e0008b09aa1667ef292c91e
- SHA1 b6b23979e83ed11686cf4511edf77fbc49fda730
- SHA512 ad5dd8d2bc095abb0811d375cd2d00f487b5c86a9cf5339035bdf8a43645a99703c7afd4d48d009736823c17fa345c79cfeffe01b31786c70e3368dbb736e519
- SSDEEP 12288:rVYK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r3:CKY8fMCBTFKJo4IPpZThwS87
- TLSH T1CED423662F5901D2F007C172D16AEA04FB70BDD21A29E38F2300681F9DB92D9FEB6741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 bba249d4119364f04caf942b5de2bc915adbc889bb4e170835803c0027ed6cd2
- MD5 9201b95f1216e9fcc656dbd0afcb69f7
- SHA1 6f0d19ca6ea8d7ef9819b64d777b154d0f13a4e4
- SHA512 c111602f9f7d6da086fbc9b41678ee57444e386926b85ce5fe1e9f8a9510ab9abbd8cfa8259059c3a623ecc3fbc3f019ad4de17a21879fc6374adf9f47556510
- SSDEEP 12288:/QK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rd:/QKY8fMCBTFKJo4IPpZThwS8B
- TLSH T132C423AA1D494192F1078172E16EEA08BF707DC21908E24C2349B41BE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 a13e6fe1cac5cfa2c7f4b5761ea09806812cf0e0e8338308ccd3b7ba3c0d4bd5
- MD5 226f2cee5dad257b6c8eaa5ac59cc6b9
- SHA1 96ae934462bd549ede37e5955806aaed681f3e81
- SHA512 c0fb79c8b04457ac2c12d7fc4c959e1d10c58ca26f7fff0b36decc4e4b798ecd50314072f306f3e7ceb62df10e4abd5bc807ba1502004851bce1e0d3061d36ce
- SSDEEP 12288:bRK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rd:bRKY8fMCBTFKJo4IPpZThwS8B
- TLSH T16AC423AA1E494192F1078173E16EEA08BB707DD21908D34C3358B41BE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 a137b8c305532f106ed04bf39413f3ca57d3ae337a3bc97dc0a91ef72466293a
- MD5 9ab0b5cf16ec0164695cba0edd8fa642
- SHA1 219bea72cc0c2ee4acb03a37cc3ff489a6c5a03d
- SHA512 aae6bf047c4eb5216f5a42e56acde2b04501613120034dc3c7720b139b56511f0ffbb8d1803131d7aab38c0c38619938fc10c0690ce7b29c64d90c1ab5490df4
- SSDEEP 12288:ydK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rl:ydKY8fMCBTFKJo4IPpZThwS85
- TLSH T170C423AA1E494192F1078173D26DEA08BF707ED21908D34C3358B81BE5BD5DAFAE7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 9b4ea5db93e22c004229d8210388773a6087ce087366ed7045d99502747b51fc
- MD5 d3552e3c3dc533053c708f2709648cf2
- SHA1 2db872504dd3eaab7582c934023e979a932603b1
- SHA512 45ef04e4e1506e29aa6e5c7cd43c902bc330de09b2f341edbc24c29ad4ba8a6346e7021228751abaa70a119e26415464209b6e193800e87b50ddafdd54723567
- SSDEEP 24576:jZMSzFVSOFKY8fMCBTFKJo4IPpZThwS8w:jZMSzfhsZBAqvpZlw
- TLSH T1320501A5739008F4FC67813EC9259905E6B1BC5A0B60C70F13A8362B5F773A16D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 98caf0efa355e98e44dd1b95ac70bb899c0e5c9f71b745ba91e3e8211f1653e7
- MD5 cdfb8cfcc01eb504e8d0eee2d73832f3
- SHA1 fd833b3a8c12ed0347f82a897dbfde0f9cbc000b
- SHA512 55173078d61d67c68c266d38e11b49489b2b63d9bc4fa795a4d5e6f14f94ac03d5893b9b836cf5da2538e5bc6fa524c0c8d51f7633b26074666b8530a7ec9a2f
- SSDEEP 12288:WCK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rw:WCKY8fMCBTFKJo4IPpZThwS8M
- TLSH T14AC423AA1D494192F1078173D16EEA08BF70BDC21908E34C2359B41BE9BD5DAFBE7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 61f76f7214de1f936534f098f4406a07e8dcec570c414909d832c176fce7e532
- MD5 56e42c7167668d9c34a6a7f7fa9790fb
- SHA1 2fb32edbf608d4bcc9a337411d205552ef0fc73a
- SHA512 b215ef7997af0445ca6648d6de0ca4ef26d821149e743acd66c4328d907ab8434b533b231d08fdd75c47e6df5c7ad28b6556c0c15a60dc624b43492931498733
- SSDEEP 12288:l2K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rw:l2KY8fMCBTFKJo4IPpZThwS8M
- TLSH T1ABC423AA1D494192F1078173D26DEA08BF70BEC21908D34C2359B81BE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 33e57a49bc897d383a0f0a49f6b44b5d38728231928fd217e1641f9ebdbb198f
- MD5 2efca42b0c587f6eaf42bd681a2ca9d8
- SHA1 0e717082820823aa666f2b99ce48dfc94670331c
- SHA512 47edff6e5745ffa1093abc3d76198465b6c4dc40a5118e351b92c6481a1edfcbaed6de179f161beb6bcc918111d4eef68857718f35a10a0e56485066709b9279
- SSDEEP 12288:8yPz5L85K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rK:lzy5KY8fMCBTFKJo4IPpZThwS8O
- TLSH T1DFF4125737A130F5E1278235C8665A01F770B8720B24CB9F13A4567B6E3B2D1AE7BB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 690eaebd4fdc1f772f73fa9ac93013e409ac9ed7cbdcdd7319d2680f70f3c32d
- MD5 0316d8cee7a480fae5ee3d20adb561c9
- SHA1 dfe1b8ff768afac38d07ce46f35a0a94d17a50d4
- SHA512 b9e5e29678c5d576d8d26282ea0dfe1bae5170f2ba7b3c711e1605fed6849500076f417dc7be99cf039eb4b95359465efd1110a710b4adf6772707cfbe7a2dcb
- SSDEEP 12288:OCK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rU:OCKY8fMCBTFKJo4IPpZThwS8Q
- TLSH T100C423AA1D494192F1078172D16EEA08BF70BDC21908E34C2359B41FE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 958fb996e0a0409e6ca8432ee6d2092cac4c85294b6cb1418e9328de85b59279
- MD5 5ca5230871733dbabd9e3bc83bd13013
- SHA1 6c98a70f95b6e979965551e24ee4ea9773e91830
- SHA512 19165c00bd01b10cd2ee5652546edbd49575c98f588fed9409c96dc5d1a40292b3c8d407a00b033ba064d6e0d519ce8f8890c7a423f58d2ea030d1966442fb6f
- SSDEEP 12288:KCK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rX:KCKY8fMCBTFKJo4IPpZThwS8L
- TLSH T107C423AA1D494192F1078173916EEA08BF70BDC21908E34C2359B81FE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 3903ca5322529b7d225edf6fa9c1bf692533f57e2d8355dded4e1bbf86eeaf2c
- MD5 4ba73bce18383fc2455f8e1980126262
- SHA1 d7832d0030e85b653fbcc2dd10b237f3666ff2de
- SHA512 eac8222706a8c1969cfd33f6df68edae39444f650f753422ade70449e5796c2c80891d8d7d22930542668a97580dc967270b8bf980fdaac986137b7c36c9a8c1
- SSDEEP 12288:2yPz5L85K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rl:Lzy5KY8fMCBTFKJo4IPpZThwS8R
- TLSH T111F4125737A130F5E1278235C8665A01F770B8720B24CB9F13A4567B6E3B2D1AE7BB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 c1feda3472088d1d2ad37412621d016690fcc6b7ba778f681b37e37b0c382184
- MD5 c7963311318a168e20d0b4020c1861e6
- SHA1 2c9b4cd8dc26d7089443afb78f9db4323cdfe067
- SHA512 9d4e06c9ed76080f03ff848f2368aeb906f02499cdc651c7333eb97bc6a0a13bd16d2d2a4ce404df3595ff251e29722fe7e9f1ca07eafef429e23453a5edd698
- SSDEEP 24576:MTHaLl3z0zDfKY8fMCBTFKJo4IPpZThwS87:MT6LljEsZBAqvpZlw
- TLSH T10D0502A5735018F4FC67813EC9268906E6B17C5A0B60C71F13A8362B5F373A16D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 cea895c44443741de03de140fb4c93eb1a8f66efe8829f9383d0a3840e99bc31
- MD5 1fd904bfddef9ea70626ab6e46460aa0
- SHA1 46dde293bad6ad6c3690c6a7741f23c2f1e40428
- SHA512 9519f35231c545e561ab88a71bf7aa45049491e408808cfda7f5802148d298b3c241277f01acc9fcb3e77e11d66db09c362ee1db5a727cd3d860be99bf2e7f09
- SSDEEP 24576:y37d9CHKy7GZ7KY8fMCBTFKJo4IPpZThwS81:U7d9CHKyahsZBAqvpZlw
- TLSH T1ED25CF90F3E410E4F0B7CA35C9769511DAB67C9A1B31DA8F03A8651A1F336D19E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 02d8502768b6ea14127cb3259ccaba8ed5ac43b7539aac2809e844f2ff883399
- MD5 9f4fb48c5de263bc797ca8a2033cfd4e
- SHA1 8f8768736a6d20745269ecd16da935bfd4157724
- SHA512 e64130ce6242c36465c7408749fce94ba3887bb4a2b89eaa10d1a09f2b5a1e43a417b538b3f70254f6638c26b459161852a92d50cb25515f84d8efc3f82a8cda
- SSDEEP 12288:ePK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rI:ePKY8fMCBTFKJo4IPpZThwS8k
- TLSH T17FC423AA1E494192F1078173E16EEA08BF707DD21908D24C2349B41BE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 6df0dbe101b1bd36dd93af131da377eb16b891dfe0456aa1425b7caeaec9b47e
- MD5 51ae31af65237785acbe9be5a2e4dcdf
- SHA1 e77fcf1ef7a5be1f3b506221dab6bf9f3cc85ebd
- SHA512 07750203755f28f5d09bd445362745d918b1b0b79a4bb5f955d515e0aa47bc62a25247e1b82e0c1c844083207f81ebd25ce92bcf1e0cd5dd517b5740e16879f8
- SSDEEP 12288:cZK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rA:cZKY8fMCBTFKJo4IPpZThwS8s
- TLSH T18CC423AA1E494192F1078173A16EEA04BF70BE821908D34C3358B81BD9BD5DAFBF7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 da0265b5b2b385dfb606bb3a51e98cead322dbb4ecf59d132cce0beb8bf0b273
- MD5 6a27728c207bd3f91eaa3a243e378fd9
- SHA1 bfe67fac069cafa96f03eacbcb278ba0239d77bd
- SHA512 592d139f91b536ffab95ca095cb1c3f76059bc1a15c49465a4fc90a248bcf4531ef7eb7a5773be50b3eaba02f6d317cec1303cd2ae756dfddab5cebcdd6eb8dc
- SSDEEP 12288:Q8K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rx:Q8KY8fMCBTFKJo4IPpZThwS8N
- TLSH T14AC423AA1D494192F1078172D26EEA08BF707DC21909D34C2349B81BE9BD5DAFBF7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 7664399d38e91881f8395e6a9c68834c5ca6529fefc0944d0e8030dbaf509b1e
- MD5 1d26ad3c72908c655d715e51d3880c22
- SHA1 1e914eab9a9c869d43e174f431240cf5fe807e18
- SHA512 53d9a0af528ba44caf52c627fc9772135074fc92f8ff650c49d40ce736ab69300c1a04fce7616e610a27e2a4f86b066420fcb865cce5b679cf1042993e1ad4b3
- SSDEEP 12288:QCK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rx:QCKY8fMCBTFKJo4IPpZThwS8N
- TLSH T159C423AA1D494192F1078173916EEA08BF70BDC21908E34C2359B81FE9BD5DAFBE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 ffe6006301f0f85ab522b95d49a37a5b1819eb6e94a0ed6de58da505d6f57753
- MD5 d7f4a1acfa2cdd299791e7dbdfcb8d29
- SHA1 0750ebf984f8a0a02beaf1786e9c64da74238e4e
- SHA512 0cc8061322796b444ff5f891139be2ecae1b26bdd940aa3f2a76584d7ea6d2df9fcbb5058e20ee3ca07d3c049341ebbd3c2550a36c6ce0076a8f17ba817081bc
- SSDEEP 12288:VPK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rd:VPKY8fMCBTFKJo4IPpZThwS8h
- TLSH T190C423AA1E494192F1078173A16EEA08BF707DD21908D34C2349B41BE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 ccf672cb8a1aa6161d40822e45eb5a48faaef3da2949a7d3032e8a76a516bc0d
- MD5 341efcb09227c07aa4a8521b22bff5ea
- SHA1 5ad1bd3ae0591acb7a68b90ffcc27cd2dcf7d73e
- SHA512 c891f45faf794c5a9e91738cebb0beb5e7f4bb22082131ea90571c2e7132dd63e162e262a0466392cf88d812ac79d9c3b428dea5a784960ed452f5a38c6262db
- SSDEEP 12288:R6K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rG:R6KY8fMCBTFKJo4IPpZThwS8K
- TLSH T188C423AA1D490192F1078173E26EEA04BF707EC21909D34C2359B81FD9BD5DAFAE7345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 d254b2db98f236afbc885a0da12437bd671332fa78e699644ea1e191d26cc339
- MD5 3a79b0864851363b1cb8846862f36968
- SHA1 60d555f3a1200276b53b2dab617f556e339439be
- SHA512 0c5f931a99cec6a6fae1b8f7bd4a87ee88c5d2a26128cd7623bf3251466b5436d69d4a5511eae71cd207b99ef1194c0dab51b6d4e2dba975e2a8f53cd19c1b05
- SSDEEP 12288:iQK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ra:iQKY8fMCBTFKJo4IPpZThwS82
- TLSH T18AC423AA1D494192F1078172E16EEA08BF707DD21908E34C2349B41BE9BD5DAFBF7385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 c4f6eca2633c551c371605147ac0bf7e9b98918db04a5e96e662feb4091caba2
- MD5 48fc47f7958b7a04c35caee9f63ccbdf
- SHA1 170e89cde14daedf3de2d383b381baf32de1683a
- SHA512 6ae088917e722fc00d4d0198c895f2b9d3a36dfd71f34a9358ca01c577371b902f581b03493aa5fa1f9eb553ac2ca0bff3ca8a4e5fddf54b27102c1bb0ba549a
- SSDEEP 24576:2fwvok9RX6wkyAIGKY8fMCBTFKJo4IPpZThwS8e:6MnYIGsZBAqvpZlw
- TLSH T1C935DF29EBDC04E1E177913C99B7460AF6B178591B31C2CF129A536E0E37ED4AE3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 191952dd7e81f6de60b3f88085f27d6ac4bb342f2e09c4adbceb23fec24f6463
- MD5 141dc040736e6268bf76b756e016f166
- SHA1 209f7059447aa4c8711f74c72baa8be1d3e3ee14
- SHA512 52a42728154de75baa033fe2f685e7ea5a58029fc49b774269b386262549862b0f1d069c996dc4761718b2195381e992dbb16303b04a4b01a06a54d27ecfb343
- SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zsZBAqvpZlw:vySzPitA
- TLSH T16A067C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 0e53001f6274f4e90d7e32e88af2753b53635b4d23b45f9c1c60025fcedd3067
- MD5 16a4d635b8219d297d7b10ccd62e764d
- SHA1 6ab7ceaf1dc1db22130413cbfcab59a367e41b9f
- SHA512 59cdb0ab683282192aeb17e8d47f3751d5634858f1e176fc216aeffe57fba981b6973654d05906caa3344526698475c8f5b379fc2497cbd904cb90615357fa1e
- SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYVKY8fMCBTFKJo4IPpZThwS8M:N47JUQj1irIhCnDHUPfF/DsZBAqvpZlw
- TLSH T11E65AE1EA3EC01E5E17A827885158A1AEA71742E1F31CACF1270837D6F67ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 9276ff0fe0539f8f0d4aa0aa90f3282adc0b9d755efc635623c4b4deaccf912d
- MD5 842e7487b13c63be7caa137da68e7809
- SHA1 595c7d84e2aa0a8bdbddf03ab3e0420ffb34313b
- SHA512 0a1842c3c4431d17261b32c4dd0b89ff42609025bca710dacc88eb762ae5cf3d758c6ca4abcc7e6c2995b2253c46a1f9b1aba88a41d247b87eb91d0a8cb7d391
- SSDEEP 12288:cNsfyK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rt:NyKY8fMCBTFKJo4IPpZThwS8x
- TLSH T14EE4F05AD29802E5E06E9176C7569A00B7337C6147E1D3CB23C0F43E1F7A695AEEA703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 948KB
- SHA256 5679210c833c4ef78ae0c815d7381e2e9927b9c6f00aee4c9a92f8ea14417160
- MD5 67f6b16c43e056a8b29cff2d21404cdd
- SHA1 3ea2392df9c883aa3a3d04bffe0f5a02f9a9cd69
- SHA512 16f8f2a0732b60d047a86a39e7c9e8f5d940eac5378ea4626c4a81e864f5e906a61e76f61c6490663579d937a20c5e1c0716d4e0af0bb428c2337c4897bc159f
- SSDEEP 12288:RiqJU3fnFB40AdO0hIkQSazdA+pyiJXoY:Ri2UPnvdAdVQfzu+pBJX
- TLSH T170252700766BD75FC6AD44321E36D6CCAB707D01EE459B0372C8972FC576668BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.2MB
- SHA256 e3585ddc55aa87143de6329b6a4733df7b8e3419ca6a98d6bb10a50671602354
- MD5 0bb5778d3d88f51741894585eb1443ee
- SHA1 be1c6a26f6f5d9b9a85aaaac1483ff92f5bebbf4
- SHA512 b59a08ae80fdaea709a4c7aca5933b9a49f603d7cc5572facdfa8d0539d0e6166e7d624d60706ab35c9bd8302a5c57deeef69aecc14f9a38baa3968441181712
- SSDEEP 6144:15TeIcy84AUJDiTeIcyB91/J4rnlcbVtMx3Uaq2uhj+0+zg7Iq36KzLhqy89FEbO:frn+24j+0+ziIq36KHgVfY7uBhv
- TLSH T1A445B6816137A3CFD5FB2072072A6B4CA764EC46B7456F27B3C8453AC826665A0BC3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 290988b154dfe67ad143f37515c46f96c26d3639506428124ce12c93322f2f6d
- MD5 61112b327b4344b4bedb7c9199051f02
- SHA1 f4eb92aaae7a2dbb00a2637e587353f9b4dbfffd
- SHA512 1e137ca332fbd48f9c48be96f291db0f85b9693e0c026ee0a45de6e5e44e3ee13c9e156d63c7f238290618f7ae8e449e543ef6ca0537f1ef9b19a6c4269a54a9
- SSDEEP 12288:H07qK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rT:EqKY8fMCBTFKJo4IPpZThwS8f
- TLSH T16BD423661F495582F02B8572916EEA147B30BE910F08D2CB7208745FA8BC5DAFEF7346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 6b69254766fee4c1c1867382274b23a9709c3a0a517648d1aff40c97c4c909df
- MD5 39cbccef77b2f646e1bdb854eaa7c04a
- SHA1 83acf9f37c0703eb657c57f0dabc7dfbc25ae152
- SHA512 2871161f3caaded269c78bf7503afd8302226ddbec785c6f1b247a89b91fb24e803658ce4c68ca419f88488f276260ce7333cc5170ebeb6d8db92e15a9dedece
- SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYEKY8fMCBTFKJo4IPpZThwS83:hgb4mBIBhGFVsZBAqvpZlw
- TLSH T187659E1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 6307040cd718a545f2942db670f7df0f0cdd9ff25fe2408979b50ab06bdc9e69
- MD5 5450004980a2dc2a341ca65ba2b1fa81
- SHA1 dfaa2f3523dcb64f09429dff0aaf05e9df634a95
- SHA512 42b2c67ba02f2c8d4ada15c683e86db2beaa89d821f0248b36f172db4a2f94b1d4bf6b3470608971670d0d122cc8a9fe5e529364c92197605b6030cec4b9f326
- SSDEEP 24576:oG88u8FpJqH1bzria7/mFKY8fMCBTFKJo4IPpZThwS8a:L7ZFPqVea7/csZBAqvpZlw
- TLSH T1BC35F16577E101F1E07BD13889864663F6B1B8210364EBDF07A88A561F33AE54B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 7f85998b6f2d115d4a03ca6c69ac6aeb4dd1382465ecd3b28b40e831915c1231
- MD5 f364cb95b10407b18e11519c72b94798
- SHA1 5678a4ed590b7f96ab314a347d8821a2559c6a71
- SHA512 a07dada4fe1954d79217477fcdb1ba721f8bed6f73f0bd950cbd33baa7c0749ff2ed7178b851c218fc446bf02206de09accd7f537a2ad7ca89f14b21b6aa1b11
- SSDEEP 12288:4HvUrBFrEjwaQhK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rU:4PUr+NQhKY8fMCBTFKJo4IPpZThwS8A
- TLSH T15005E12F26AC18E5F676E17D85868709F771B8620711D2CF02D0817E5E77AE8BD3AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 8a895253b31615322d70cc1ae11ad8ec89170e042662d77270a9207e8fb38053
- MD5 a38488e91564fef250ef5f4b14343d52
- SHA1 8280b436d093cc7ad3f9c6e1568177d3580d04c4
- SHA512 2e0fe0328c73b24150a06d47e452e093c2046011f5bb03d80e59c5ed712076e6879061996fdef4677e690792117f1e66517d0d085f9c50319ddfb454e621ece7
- SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRsZBAqvpZlw:ZG05lO43bBtA
- TLSH T11ED5CF6E62EC11F5D1BBC17CD9C68A0BEBB23415032556CF02A486A91F27FF4A97E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 b5f56b99160873d7e6b0d093921808376a8423bb3951c12bfc1f9e687b80cc7b
- MD5 865b8819f8cc7c896e63f5746e368f58
- SHA1 350a2ad23e70985b99f70237910282287cd144b3
- SHA512 90b740925142c165c6fb2612fa418ecb182d950ee625f7e8bec6c9cff4570bb9b22eb29de363d022a93fe7fbf6963dffdd7b3c5b30773f070df67784ba9f7b29
- SSDEEP 24576:Qfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnzKY8fMCBTFKJo4IPpZThwS83:oa5POZ3+Jt2pasx2+mZsZBAqvpZlw
- TLSH T1EA65AF5EA6EC01D5E179D17DC583861AF5B1346213319BCF122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 8205b9856645554b0c7bb0425cdf9d126ef719b9b7fe1ea3cacc159998a7d678
- MD5 593d66a93cb76c59a47459f0db5d253e
- SHA1 a752c37f7af98a0726fcdf296497bae942de1fd4
- SHA512 fcd42957b48a133984e4cebd6171efaf67abfe0bca17396d3cccbf848aeb2881490b7e54a53129f7a2a86541e4996c34ab95d51ef8678c01f3ca1810cbf23eeb
- SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkNKY8fMCBTFKJo4IPpZThwS8M:1Nc/zEOVHF8sZBAqvpZlw
- TLSH T1AC857B2623E901E4F1BBE1BE89679546FA717865133486CF0291851F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 83bbde5e8d40646ca34528d425cb9be8c4f4a4d177dfdfe49ecef4b45355fb93
- MD5 faff16d2865395fa2417f683f2159b26
- SHA1 992129e01f4e66f49ac6c82359d62cbb5b763a06
- SHA512 41d653a7f0ff57309f294a75a16e596fd12512962b9a8accc85e28ec8aa897a033cf5c5b399dfeaf5c3c62ed7aacc99573ca8cc119f12747c5b4ce41ca6e6c2a
- SSDEEP 24576:e8kNvNnaFeYhJNtmZBm6KY8fMCBTFKJo4IPpZThwS86:e8MwBtOm6sZBAqvpZlw
- TLSH T1E355AF6E7AB806E0E1FAC675CD238512F6727461073293CB5290C13F4E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 7e66718be5549a0ded6f865542e6c301991d254046abc169ed3962e3738f307f
- MD5 71bf244cd00b13b59a2072bd47260363
- SHA1 9bdc1e19beb6dbed3c15186e807e33dbd6d06d99
- SHA512 8157bc3b69f36c3a84788ab3e6854a8804071ac5de8cc5f3d98994b31a3d627747b8b64925632c02b231d547570fd09e812525a9eddeb61311d57e6d934a6501
- SSDEEP 24576:zD3FHshBIYQgAOKY8fMCBTFKJo4IPpZThwS8f:zDVHeBIAAOsZBAqvpZlw
- TLSH T1AC25E17DEA5C04E0E57BC1BCD6638A06E77138A9032156CB12D491BA5F6BEE47D3AF00
- MD5 SHA1 SHA512 SSDEEP TLSH