31660687b4226168061600fbe05fab3f5b69669b64fda2aec0d68869973faf07

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260728-yrbrfavbqa
SHA256 31660687b4226168061600fbe05fab3f5b69669b64fda2aec0d68869973faf07
MD5 c667ab58e61e40f89d28e6d0b767fddd
SHA1 c074485483a00640d6814e9703e98c5146f7a22f
SHA512 934d741bad8aaaecb906f2b71341c158b6f7bdddfe9b04c43cf61f768a9b81e7be46127d18b746fcfede54c77dbdea5887f9d9d553c54a3d8cb2ca4d1a434564
SSDEEP 49152:Z+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN7558/:E/PvOBjcXvvOOc55Lm
TLSH
T1CD165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1840	elevation_service.exe
5664	elevation_service.exe
5688	maintenanceservice.exe
4724	OSE.EXE
1108	PerceptionSimulationService.exe
1420	perfhost.exe
3340	ReFsDedupSvc.exe
2536	SensorDataService.exe
5636	ssh-agent.exe
5268	AgentService.exe
1460	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b45a8a83e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab0b57d5cb1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040740fd7cb1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4208	2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	1840	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5268	AgentService.exe
Token: 33	1460	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1460	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1460	SearchIndexer.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1840	elevation_service.exe
Token: SeDebugPrivilege	5664	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1964	1460	SearchIndexer.exe	103
PID 1460 wrote to memory of 5228	1460	SearchIndexer.exe	104
PID 1460 wrote to memory of 4440	1460	SearchIndexer.exe	105
PID 1460 wrote to memory of 916	1460	SearchIndexer.exe	106
PID 1460 wrote to memory of 2612	1460	SearchIndexer.exe	110
PID 1460 wrote to memory of 5076	1460	SearchIndexer.exe	111
PID 1460 wrote to memory of 1188	1460	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_c667ab58e61e40f89d28e6d0b767fddd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4724

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5636

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5268

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eebeafd914dc504fa966ff7bfd659b6e5f4dc62b1d49862c3388c07c766dca5a
MD5 4aac2b583c45d59442c8203fa3c6b562
SHA1 5f2e45e52623ea3fd10075abbaf637061b405bd8
SHA512 2085ec3441c3e698ced67f8651b6c81d03ffb4685d3681e4e1f48809e8f629ce21d2dea534789b80315e0aec95ce95b927abb6af1cfd2e378c1dbcf21cc7df90
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnyQ/lFTjN4:v3q6HjByLm
TLSH
T1E4D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9a49287331fac57e6ca04b4f6cd411df7e03f9fdeef300c7e2de45553db55d6a
MD5 47068475c7a61f1f1feb122664bf0ffc
SHA1 25d04fe7a43c451f7f493fc083830eef52e03a06
SHA512 9b3960a343eb7ac8de004955516d440faf6e97bdc8a7bf2b6af00238d756a5e98b9170de36ca614da64dccba3d624964e1ac0f9d0dfbc2ced342b2f423839a6e
SSDEEP 12288:E1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:CXYfDtczABnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1F465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c595f74e79c1f669ff7a9988315bdc2b1a1b27eae625f8a11f9bac063387fde6
MD5 81283462fc24237aed065c4e222efe1e
SHA1 e919c845f4ab028db37cc6a491ea554ae9f52c25
SHA512 0551e64ac716b6d9bee0e3e6b9d94b4e11ab9cb7b7c9a624315e2f99a0167158b35d18d59bfc99f2696f474dfb259cffe72d5b4d5675c7990c3cdc42caa0c5db
SSDEEP 24576:m0Le5ji0hmxLrManQ/tbw/2Mkjy6Fr7g0om:mPji0AlXQ/lFTjN4
TLSH
T193859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c41f8bc9f913a40bf3d794b33fa27876c142debd04ea8d701ccb1b1a491ca03a
MD5 a1564d2e0d76e48110e5b30860738c62
SHA1 753ac7a2b7d16b9ff1176bee46a4755eb2d1b40e
SHA512 c9bee3339e1ada18dd64df7a74db5260c941e1f05e76f2c20b09d56559cc994c3fa97e6288dc96a1b5e01f8e1c8d5fbdcd78132c213d89fdc26326a9813aad41
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyuMnQ/tbw/2Mkjy6Fr7g0ob:q/ezSC6vUzPvxHjy7Q/lFTjN4
TLSH
T1BA755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a692c091169e9d79e67a7c77a7467e38dbe04df89be4e5131a7cff88dcb86a20
MD5 3261db9b02b2ff62e39bdf842acdadac
SHA1 e2a03639fc703484db60aed47df33e0ebd9a52f4
SHA512 9948cc631f4ed862a0569e7c4b9bc321f931bc068c5210218f88226859ef5e21db94cbc044b6bc2ecb872f50a8950022ebe0ed62eff7741e812b632b87747ce6
SSDEEP 24576:EVbqPb88hv/l+6NnQ/tbw/2Mkjy6Fr7g0oS:EVO88hXl+OQ/lFTjN4
TLSH
T174559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 40077320f265670648749753974ec0f5532d2368ba83f6d5d695182bdc0a4c3d
MD5 0b716bede8aeda70a20786f78761396f
SHA1 c7785967ca6df672584da7ee3ca25aea8e1a0992
SHA512 2a3551869a2b600268ccfb9315b6e80e6335f6ba09d5abba11d6f696363af6295458d60ac14e615564ffeb43434f1f15d2799904f71c768a4a9148999c87af30
SSDEEP 12288:ozmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:ozGnQ/tbw/2Mkjy6Fr7g0or
TLSH
T19B5523696A24F887FF2B06B15CC284826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f5bf0ce5b40b7f09856b29fa47086a5fbbb4e1df308b1357b87bdc42bf9ed75f
MD5 c80cc79f865aaac05a1327735b00cc34
SHA1 81510c159b783c233251f1cff8e9c2a524f1c9b0
SHA512 4391657e1d66dcbe813e5c6234752373ea9475ecc7fc85e38ee0d2e10ac5fdab98a3f61aa24e1606d7c10c3279b39e1d40e99428829f66159120437cbb32cb1a
SSDEEP 12288:QeBNUbTVO86UVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:QJIU1nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T17C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8f00a9f7888a48d255fb82b671665b45ef113222a8dca1f8d21a6adbd7bc1edc
MD5 67793a9c2c0955d893c8d23297a64349
SHA1 7424469185701f98bcce5f1e460ea898c3a75402
SHA512 5774c700405c25ae38b0eb31ef789fdde236600e690d16e91a02821dc819704edc842a128ff05b46b76064be0c1b7e4d85d736cd6d44cda30d9365c4f5599540
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:2QvGAdlCEL8c/yRNw5C/Lm
TLSH
T1E2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e447cf44dba8935244bad2c6d6375322a15a889a25026480dc0443cc3648d33f
MD5 7308e09c2f5182c12bf765e1d75bcc58
SHA1 cdae5d11abbc959b52acc54db8913e85b5cd59ab
SHA512 c4425826ccf7499ee4795ed38c5592ae8cc356ffe23b65d14ed0c9f4ed49b9f656141287b908a54a59f8df6fa8fab480cb1bd7461e12e93598aeb878cd310302
SSDEEP 12288:UAwSfxL/2Dc39DLLmt0LDQewsAjHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgp:pQewsAjnnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1A975E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5113aaf1ef8a3a50d8b70742c839f9d634c4c8d973acc2b42b5fab52a4e39a4c
MD5 97b206b5e5743dd194d995cf444c2cd6
SHA1 cfbf69f9f8c158209475e0dd20049be057af7bd3
SHA512 1458522d98c946364789d42d8cdb3e20f23848f10aebaaf3f9adcb7e7240812e7fa82f677d0cfd057802a11add7776893f9b23344ce5777689c26ded2ab74a1c
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUL:MUEtQevvqc2W1cpV2EI32
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 139c871833d797e6b43156bc72e85d639cb54266722457a1597b93c3303b4893
MD5 378cb77f8bafcd12507cc0e4c2128428
SHA1 6d7438476c51bce86693377ea6c813d70eaab681
SHA512 f47d7d168b41c44e58bdcb1db0731c39cbb8d5bab1986f4809a31a0b8b15af23a79006526e6ad46555535a00ebc601ec78b7ec7ee2b556e51b4dde1ef550f497
SSDEEP 49152:ICbRquA/m2yL5zQfFiV+XenmE3/zHQ/lFTjN4:hoqtVjnmjLm
TLSH
T1D5D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 55f475f4ecd52c18fb0462d20a615539ed3d71b44d6451a444ebd183d962657a
MD5 e92cef840c69b7b0080fccd085106134
SHA1 3bdf4021023177895018fd5ff8d430743cbda3e4
SHA512 eeddd47f7922695bd31bdd6f8046d684e09096b510249f0900bcd9ab408f7a8fc9c8d899210c862bfd33ea75560f0a0f48883bcbaa926a3cefe7d286f4428d26
SSDEEP 24576:hAhGLJIFoiwtA5l7S53wnQ/tbw/2Mkjy6Fr7g0o4:hAMyFoiq5gQ/lFTjN4
TLSH
T17C35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 22a64c34faf0f2e906267b0bff96b98b3a1222404b66d2d577deac9234cf6720
MD5 cce304a8d09fec5c6c80cc55283005e1
SHA1 dab8180a5c92ff015780f20480e70a12cc803ba6
SHA512 e27e3e8687443149e960e7d9a0cd2bb85734c0748105bde5b4d5aaab6ddab833932e68ad74e63011e6c02705cd93fcc3b4d4f93faf91933bea78241ed59c87a0
SSDEEP 12288:zmw5HEjsChN2BFgl0WDm+CsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMJ:SwuHOWbnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T10E65F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6a651d03f56b2ddeae1a4cff3c9720ad2769aea7e11260ce55310eb6bae9637f
MD5 c6eef91aa4831a3a8ec2c6af84f6ae7b
SHA1 abfeeec7ee4241751a3e84d10d23986786089e26
SHA512 37826710d61b1b32d9c74d6b48ee6122696c179e951a004dcb2cb09e599f6efa0e99b7eee1b630cf202b1c5b7553a78c698662ba4b458362b899e9630eecddaa
SSDEEP 12288:lXZ1IyXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:1ZuCnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T16755126933A4B0FAE6674278CCE28646E773388267B183CF275442695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b8ce9facf310a064a991676b58abb068c4b0069eaf23a073598e2526f3edcf60
MD5 4f29a8c25fbf0c38b90d4785a0d7f146
SHA1 7449a8b735878b199bcd8edf8f344b18dc1af9e5
SHA512 23b9f639f23d4c4b62a236e242e60f6e004b00d17b4e0a0d0898b5bfc2890f16ee3f3fa08e51d8c445cb0d9a42c5ab055a2dd827514ffdb5d2ef58937f6deb3d
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:UQRQyi36YOcPQLvw2gAf+PN3eLm
TLSH
T1CC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6701e313d3df9e5e0f476c13570d3605d2d3ac5ac29b930fb037a87acf1a04eb
MD5 64e9371bdd6c71f0fb30d3fa91f2e948
SHA1 c4eade242c23b25cf540c8d6a5ca40269e33b66e
SHA512 2b8d04b44ecab22e4fe56a89dd4fe1f64ce3918f7c55e8fea58ab4958c316d96aa15c19b4904c8f0a7bce91d17e6642f4ec72f6cc003dcccaed38a81cc62dd33
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:5QRQyi36YOcPQLvw2gAf+PN3eLm
TLSH
T123667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5e3de30550a5763e82a52b1fe832c5a9fb1729eeb630565dba92a49c753cfeb8
MD5 b8fb4d3b0c74138e7763b9a9d4b45fcc
SHA1 99b5ce14f87f8ac604e12189dbf1c4f237df4bc4
SHA512 275de008770de8727821beb9e3df5d1fc8f44f09c311805fccff9458868a8c8bb6e555a8e0156923c8d867c9673fe7f9b5e8a848dcdf2c6f869485305a5aeeab
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ynQ/tbw/2Mkjy6Z:F68Qg55nhheWu7PNU3/XQ/lFTjN4
TLSH
T182B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e86d12e01d3722a04a2f070d0ec27953ba20be4ce56143287f4d6766d93e156c
MD5 9eb07cfb05c79052fa6999b9af2c3efd
SHA1 8ebec5f751151606ed533bd8032bbb668ad0ddf2
SHA512 94d3699971cb07f6d503c19569efe323ecf239363952c39242e968e825f45bee2e9d1257bdebd852eba6e9647bab3899dc3d56c693b1b2ec9fd174929b85af6c
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:Sy5112gYy5azzVvL69nLKnhZRLm
TLSH
T183167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2c33ddf37d71ea22a8aee3ac4b4f4b2221ca05d8eab67fd97740f038787b6ad5
MD5 df3cc9280e1f98bc0534ec38bb807e3e
SHA1 8e769b8d80ff10f822af4996b6b29e24ba61a63d
SHA512 7483946c27d0fd844f972e3140df7fddfd811e129427e5d8e79727e0d5fca8870a00ef93601b5ea6860b6f1942ed3878df234ab6cb5aa95dd354336f2104bc47
SSDEEP 49152:2B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glLQ/lFTjN4:Eu6JmVxd2dALm
TLSH
T1E0D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9f34fad25350e16e2d834f98d6d4953b893bfd0e61255e76ab68df911c44c260
MD5 8510452dceae541927a8ed6f1fe12f98
SHA1 efd879838517595d1936095050a3450a736f894e
SHA512 18481d628b577fbf6f4c53f05af8f62593ad63d67c4bef675b2b2fb28d0b390984c3fcc675068a8d8f8a05bebbc482e919c85b66bd4563975b96951aeb75556e
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4xVQ/lFTjN4:8mifPbRjLm
TLSH
T135B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5f7839167cdafef03c3e2a94bf238b3e4a3792f38f5674d499e44aa14b07aab8
MD5 4008e8ad04d3e3aa722d7aa738944369
SHA1 789df9d8d7fab70ce9920e2f0b53af4e12d8773a
SHA512 19c50ffc5f041f13b8aa403fc8882000ee56fe111c30513cfd7ac2117db266efa726a21d5722ab9c23d4cfeae05fdb1856aa871b3fa9ef52e19fe20d5240373c
SSDEEP 49152:kSuZQIY0Be2KRRVtOnks6NMHqCQ/lFTjN4:25dKTi61NLm
TLSH
T14DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 37a71eed71497571f7f13639f209cdafc3b8bbfc3699659b44964486f43ca400
MD5 19eccc5eb1265482a4d7d20de9045b6f
SHA1 040b1100b56e9880871aff6fff7df3f1e07a4eda
SHA512 51ff719a58e48a4d461e5d85342ede3599c6fbb17b301ea51566f95efaa72d472a099274feb029686cedfa91618854d3ab8f4bcdfa0c8b9db833b71735eb77b6
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5wBQ/lFTjN4:DX2iyphHLm
TLSH
T16A95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9cf4575811e8386180c2759d78277f7da2cc3a79dfa21968a2a91658f11ead1b
MD5 dc718aebe40bd6eb5b44663e8e9510d6
SHA1 00838f37f35ac52e34fa82c40f7b0b79bf14c97f
SHA512 3884483c9bc4a5ecacd4d2fa9ae9bb086031f2b43eda6b7784fa4fb9a3a4e8441c442e31d64c66f17747961066c69ac1c37efcc7e4f56b94ff2335e60554d5e3
SSDEEP 12288:5OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:5OnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1675523697955F98BFA1706F18C828182A73F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c0aefc7dcbcba10267bc770546e676d8ff66f1c26306a2b07516ac87ef17316c
MD5 b6bc32fa2144aeeafc30f0e21c740218
SHA1 1abf4edebbf94466c9549947b2ddb70d8a742c24
SHA512 edfd3fc96797471c70c1f1ec051e581c2dd2c30e3e2a23f58397987d2f2a700cebaaeaff6e3bb72faa397fa0546ea5427f5a7d22cf2577c00af6910b8f09a0c3
SSDEEP 12288:eDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:eznQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1205523697965F98BFA1706F14C828182AB3F0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f83d9892427169695689240aa4257c66b70f6ae1d45386cf67cabc2c19a67bab
MD5 2c2cc2d1fcbf6a478700f821670e2531
SHA1 e602b1494c9afa813d07855eb7d77b1e1d31b6b6
SHA512 a37d1dc7f367804ab1d3c709407e4d51fe9e8bcccb1aa11a55253c49a9a87bda9cbb4b37b7f719a346a71d1b8e50fb5b917d33b6c8bc20c0bb6481e1085310e0
SSDEEP 12288:hdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:h9nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1445523697925F98BFA1706F14C838182AB7B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6b9f856e175deac7f8865d478ab281b3d8d631c0aad7767e23b201e4cdd54e7a
MD5 f968b279658c2896a12ed12bac25a512
SHA1 c3fc641f4922721849f900cb5d704c16026572ce
SHA512 3a8a13e5e9560fb3f07ef804c639972340adb27cc1772a6aa0d004863c1237a672741c818463847a468ab9edf3d9910293021b2ee9e498083dedaed6d8d237e5
SSDEEP 12288:OVwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:HnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1785523693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9e79683888ebd2dfc34806e7cdd43a5cdf3ecd7d9e7038e0b1b2452ceac1fdb1
MD5 37c4a6c915c727f3747aebe751ea728f
SHA1 1a4f25d1fdbd9800419bd8a22d9dbbef57b045b6
SHA512 923e2a7fb5be82bda25c2b458c5bbaca5da8898ca0db043f2706717b10973de54491c8a26b27ad0a209ed79d52345e65f5a91181333158f1d831ff96e75a3cf4
SSDEEP 12288:EIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:EInQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1075523697925F98BFA1706F14C838182A77F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9d77198fd7c1064dadcad2fb52fcd41a046e3d7302dca90d7dfa084778b650e7
MD5 360ce86625b2f24aba57b1f1ad825d51
SHA1 bbe08e4e1c4bbfb13b75b6d5a786f89376e009f6
SHA512 4109c1ebca7ff96a0a9d7e2d8178aca5d4a5f3c73a743d2a1cdb4875ef1d01835e939dcffc0af77509409ae309bee24cb2f324a406aab7121dfa52364a1fe51d
SSDEEP 12288:jPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:jvnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1935523697965F98BFB1706F14C828182A73F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 de8368079ec0738e9f8e9f37057e6aee06c232c101646c0addf607e2696fa8f1
MD5 8b3e84a1b005a0210386f988e3fa600b
SHA1 1707e15ad354d1fff572a91064e0ce71219d24ab
SHA512 6249ea27390719d664a16a4221724674ad866b0e0ece53308224be9dfb24a4582cb4ac98ba2606ebb308bdfdaeedc6d0dac0e80a097c072474d3824f4244edfb
SSDEEP 12288:ibGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:iLnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1545523697925F98BFB2706F14C8281829B3F0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2ff953706fd00054fa092119511d4fa8491e3238755f5f6486e91c7c1b2f06ff
MD5 0d36020b32a368f7a2f43056337aa8a8
SHA1 ca01311be9be6fbae4825e81f54fc8caabd053ba
SHA512 e5a3b4d73e3d4fd88de2daef4f7e6b750ae4f458c26ec9258f307d87afa559d38a996b7e0d61c8080ae07d5e109453e36d95b8936e9f04b782b2a001e01c68a2
SSDEEP 12288:WiZwbDzzFEoS2cPvyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:ZZM3zFVSOTnQ/tbw/2Mkjy6Fr7g0of
TLSH
T12F7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dbdbe031192f6388c7b1c386cbf3942cb7a65ef5b2978ee8582e75261f4054c7
MD5 dc951031e28e76320b4cb64015373bde
SHA1 f662d7f734a5440e4725915b6b588267bf4e72ac
SHA512 5f8ddca97d0bb2c0fd35c70e9869f5cc5091d77dbaf636d00b1136577a7cfb52bd7bc92e3ad86fd7507da496ee28a8fe0b81eb5da5d644eeccc7ece400e45343
SSDEEP 12288:0SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:0SnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1165523697925F88BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d9780d17e2f6a1e72cae648616736c969eec0bf51912fd688b8a6383685afeef
MD5 25a2f78dff1c2e3c9378cd7efaafd994
SHA1 38eb60cc9d1869ad428d5b75f0ca3229f49fb462
SHA512 0d3d66d7987c5b4613379451a9eb66d80911a6a81e91c2697b9af3d8144b5108797ea348fd62d1833567fcce977c7c60ac1cbaac77a2a9ef669e518cf137e399
SSDEEP 12288:n2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:nWnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1825523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 dcca0a251249f7d25e12aa37aa55950086896136224ed560cf7e7ba945956e01
MD5 26a6541bdcff394cfe69314023524dd0
SHA1 8471fc450ecfce613ddf7f112ae01debd9842a1a
SHA512 39eef82e2a5f7d3fcc6f6e5ab41ff0088d00e5de0e544918620f8e6a920a59b6a1bceff42139435c0801135af4bf2847c8db0a432b62669b998e11df75f92cd2
SSDEEP 12288:9yPz5L8XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:0zy3nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T13C65021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bfd49ee68d66bcdac8ac87386948f08b3d0ca886917bfd9cefeb6aeb02badd9f
MD5 9f9ad1259ef17e9db37ec6c9434531db
SHA1 7be3307aedd8731571bea428e978510b1e1b2cbc
SHA512 98cf680a0326898aa78a89cdbeed207fa1992e238f5e98fb5deae239b599d3131ade3670fc311248521b2fcbe0fa2660eae0318c738b6dc9d63333b642f880a9
SSDEEP 12288:DSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:DSnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T17E5523697925F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 173383d893653913635d9d525a257265e89165f1cd4d54655b33e76607336ba0
MD5 f4c899e60752308b69d920fddbfe1b08
SHA1 0a0c267411655e2ac9b37ac830882c34a3809c75
SHA512 a87ac13af13c59c9741b64e59de6d26c756b33c0475c01b01fea02f711267bad26bde9d42436d9af513194e080abee82031407ab57e2830a26394d933b487bdc
SSDEEP 12288:NSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:NSnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T11D5523697925F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5695531d671c9d884708e0214fc28971fb027fb2ad47d073ab03f65c32737570
MD5 ef7fb2b318fd6695774324fe44f4a26f
SHA1 c61076402cf8337cb8cbfe9a5f554a45aa0c5101
SHA512 f5a450fc21bed78afeaa64742c7f3f00e408cdcf9e2df01582554bcf7808394919e4f10009e0ff146d4af3e101b59d704552c7a2f71efcae5b886f44516e3436
SSDEEP 12288:EyPz5L8XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:dzy3nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T11165021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4cd61f384ae341a2870d5d040d017364d3ab560c14cf51b9df564e9f2d026a1c
MD5 02a9bed55f839ce282a9e9e0098fac07
SHA1 683a7b9fd25c55d1310e2b00083371f05ffa7a76
SHA512 643ed67b4982a02d6e543da2a14cada8b1ffe2158833b3640dc371660ea2d9c649369552fe961b7a1639438ede3f81e2bd4ee5d95c6372479acf3dd67a95e192
SSDEEP 24576:HT0aLl3z0zDtnQ/tbw/2Mkjy6Fr7g0oc:HTDLljMQ/lFTjN4
TLSH
T1EE7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 37bbc43b763b9f5a38eb2b056e983cda0501ab0fa0fe3f176508d7002813623e
MD5 3cd0159e80e6b88d3b667fc67fe6a2a3
SHA1 16755eac74e966ba88da6393c10d8d58ad07dba2
SHA512 a75eb83d7b72859d186937aad030d338ce99576451dbda52c39edd6dcaa7cc48aa2f64f95463ae45d3c30b508a868461869a215b9641da76127710d3304ac813
SSDEEP 24576:D31d9CHKy7GZJnQ/tbw/2Mkjy6Fr7g0oy:j1d9CHKya/Q/lFTjN4
TLSH
T13385CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1985dede93e2604788e03d16f87cca8b553f773c65fe38c3f16da2b1d0b43308
MD5 7fc466d632ddc9d38de37fdbc001b82a
SHA1 1df957897137332d5cb5f97c6d2ce1d6c6c5cac2
SHA512 ea844b7d0d5e4d298bc144be9a18e7f231575c62cfc969b9484c8831a6491a3df2dd781caabc22c642ce9d784471a0024e197f690cf04914a8b3989f4dfbeace
SSDEEP 12288:89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:8dnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1E35523697925F98BFA1706F14C828182AB7F0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7496cc5525cb243503d860ab8f81e5f198dd661872804b540a8d51490144e055
MD5 35682d83d52d4fa0563aa3f779d1b077
SHA1 b5c96515cca381863d4c438a4622df4debc65675
SHA512 3b3ef807e2352aad5fbfd4a8724afc56b468882244218bb1357d03502a2f458d7854940e9b250683bac2c337d2914a763863c2284201a208c36f52866a6cd112
SSDEEP 12288:e3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:eXnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T18A5523687924F89BFA1B06F15C838182A73F0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1fca1426662646dc4cf538b10b1bbb84e04851207980a46c35b080dd9aa2e9bc
MD5 692ebd4fa62414a6a61c917ff5880ec2
SHA1 4b7cf52598db2e53ae206e8e9111a98025e83b3b
SHA512 827dffafb67e49bf4c3b2e4d7fd5682d93b80f9596a4bbfdfde52c7e29abb754b2ffbac8b34da6ef1134eb688675bc295238f6bd79644e8042ccd59ddcccb545
SSDEEP 12288:gEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:gknQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1185523697925F88BFA1706F54C8281829B7F0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b76a05f259fe848ca44e06c9736fb6f9accfd92858e7d3476f5141e607997591
MD5 3a1469b993ff08ea451303742f6f571c
SHA1 74a17e1b578791c99d16e90526904d703d656b1b
SHA512 7add212c0d242ff741f8d9d85fa3bea359ff96aa88c2ffcba31c5b3cd0b1134e157889545f9a25ba903bce31e15e28e2ca58d4c961c22ade40db6ffae2f79ce4
SSDEEP 12288:YSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:YSnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1705523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 01b9ec85efc5ac9ef129ec1bfd2585955317179a217045b7d91e21875d43bbec
MD5 8de84c622f65fef4c31bfb5fe83ee4c9
SHA1 a94561a8fdb0ce0c1c2fad1a84230ae53108f410
SHA512 7c7a479277b2293721d02e82fa16333725a6df020cd9f48532633e1110d44ca7dab9ceddfa03064ed2702eb1d62665115fdd0240d850545861c7b75ddc674b81
SSDEEP 12288:f9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:fdnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T15D5523697925F98BFA1706F14C828182AB7F0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 eb36079c5c240c27e65bcc4c3d15085e2b16360d126f2d0ae838197fa9478b92
MD5 5b85e7b95020da938a961043dad25188
SHA1 ea0db2bb8312c5cd2c78f398a85462dde81f7ec7
SHA512 16c5223eef6ca6c781c4828723bee5780a87e6eecd3100d4af7a0e7810c7078e95278f310102143d034d80864a3d68cde70ab2fdac0abc76fcfe13a1135c2650
SSDEEP 12288:yKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:yKnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T10E5523697925F98BFB1706F14C8281829B7F0EC6BFD1938F7B481128967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 54df9daa9bc659d4747a2e9d8725f359602f2232ccee6009fb904942ff6e7f43
MD5 541ff87eb9d61d7f8445b80db679132a
SHA1 b7376ab91d18e136a8528ed0ed0be4ab141d1955
SHA512 0dd530b593740621f1d20ac534b0fa087902ffd455c1760829166513df1cca8cbda577b8256bec25af9f209ea7179de2a589e34c6f8ef600665191c2c68dd5f5
SSDEEP 12288:1IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:1InQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1545523697925F98BFA1706F14C838182AB7F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ecaa1ed6c745d238b974c98acd63e3e996255b5d3e084996853070d40960fa28
MD5 a4a55235926f4f0208703cf5d6574dff
SHA1 985ababebc295ff6da89921883c810c443ef4c23
SHA512 6282fbb19cdb3cfd9d47726cd5d37cbf34890585b17681f2a281ea4f7af1ec25d8b25d2693ed57899bb10cc1e37d8c8b60a2f4366da2a1205754244e6903ff6b
SSDEEP 24576:Hfwv/k9RX6wkyAImnQ/tbw/2Mkjy6Fr7g0o4:2MnYImQ/lFTjN4
TLSH
T12E85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 74199073700281e253f7bcdf2e0025f84e15eb46fdf57e85a0a8815ca4fc4a07
MD5 fcd195dd375c9a262946b85f216db606
SHA1 f8bf5df92a1a50e75d8192d5a99f6041c19f2aa5
SHA512 2cc02e61b1da6775ff19f7041599035187d3249db411f4ab9c96b0aedda8ebcc8b857311d99b33209fdf44b0a415aca947e4a7deaed10ad73f8d1a2c1bd5899d
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hQ/lFTjN4:dySzP+Lm
TLSH
T199066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 64073c16f678de331066dd6c9cd077b176dd61ed3fc74a4756cefc0a0e655859
MD5 9792963017ee9ddff18698002ca27c47
SHA1 e4c9da07c8f239831a63ee247bf131a7249940dc
SHA512 209891f20eb5ab3051ee991939c2286dc55f1adc5783f2ff8e6a40ef070e7f8f520ea23080ed4fcdd680b92cf27226b9e91c91aca9dbc1af8a8a941b8bf0d7ab
SSDEEP 24576:T47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYjnQ/tbw/2Mkjy6Fr7g0or:T47JUQj1irIhCnDHUPfF/xQ/lFTjN4
TLSH
T1D065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 73cc83ffb14315c52727860b09066a0f352c4252924c08f8be8cae877f47a109
MD5 eea7ba35ddc0ab73261321be24eebf32
SHA1 49cc844db1f2dbef5ca967ffa616f25130f1ba15
SHA512 4029e594e3df9b6fef10c5df1d20d749a16861d146efd3fb40481902b7bb43a5e7510593263bed3e6d816ff7f1c2c81d42a45a3e54c6014914105e32a77ef638
SSDEEP 12288:wssfCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:+CnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1D465F019E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 38da412e2f1f9eef9c0c0b461953e939b3809853b1cf0b7edbdc165d9c27bdc7
MD5 653603a4e588fca44b38ec488e55552a
SHA1 af2e3d6532defff2e09571f33d7555000d5f01b1
SHA512 305b6a5935c50ce61a94404e525696a42e534eea6d14c3a543a5c3bb1f47359b176b4f9a8e9cdf5576133227258f677099d457f805c9fd193855c71a8d581dd0
SSDEEP 12288:p676GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:A6nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T16C5523656668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e3bca70416a3d8b47b6176455cfa8dfa7238b562c1a3445dc6906fbe435bd1eb
MD5 c2d0c3cd1af4be9d36eb1ce14de24b7a
SHA1 7c96ee4980a1d1d96bd0d8a8d9ac85460c3af5e3
SHA512 189f4a0ae2387ca9539e854a3b42e17bc9b9f0519b7026a234281c3c3e8b89629380b6b860270330b2b98516f5387bae6888bfc7b591f8c815e1cacd50804bbe
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYMnQ/tbw/2Mkjy6Fr7g0ok:egb4mBIBhGFjQ/lFTjN4
TLSH
T18765AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 85c13eabb40f21bed2307581eaf452d624282db4bb71ce73a11119ab4d3b5505
MD5 5763049781c8ada509eca962fbaf5e19
SHA1 322139e55d6cd0eb4dba400e42a44dac2fe9ad1d
SHA512 75073dfafc0a6172be824d69858d7f23576f0570284f68b7abc805045780c02491191e8659ffa3a935de96ea4bed2d5529787b6adacf27227832ae3edb57bcf8
SSDEEP 24576:0G88u8FpJqH1Qzria7/mTnQ/tbw/2Mkjy6Fr7g0oo:H7ZFPqVva7/EQ/lFTjN4
TLSH
T18385F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8ea459bd78794fd95afed270359be498cf3585900ee53fc9482d87f01496adb3
MD5 943aeb4910e3e51ff7febd86826bc944
SHA1 a3e9338a36f730527688ee32c811a86ff977b146
SHA512 3c575d021377d3053b7c16389b7d68706248fcca0beac2e5aa7c59a6b26f75df87b56ae0f8e46be54d2cd4692acc5a90b6da47caced5b200e2b8dd31754bea70
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvQ/lFTjN4:EG05lO43b5Lm
TLSH
T168D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dbe4e98ad5cd2351595e791ecf9373e65ca9828672c06861e37fee161ad46c45
MD5 918466f20768a595ca9d19f37b5d774f
SHA1 8f3ab3b76fa3fd581fafb4bd2ee9f819930fe525
SHA512 3c4cca130fbcf0a27cd9911985a9fa4cf3d49d8686a08b51339e6830927e6d20b34fa9aff0056d9b8264d011e26257f8c559c3aa27926955f00b2d40f585c03b
SSDEEP 24576:/fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhnQ/tbw/2Mkjy6Fr7g0ov:Ha5POZ3+Jt2pasx2+mXQ/lFTjN4
TLSH
T18C65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 913afe137724dc82ea9211922156af1cf7a237acdd07f7745c5a0b819049ec60
MD5 f22b926ad8eae2de1b18185e9dd164a6
SHA1 e398cb5041a81caa034477b9b7a7d4c86e610740
SHA512 bcf189658565d4910411c21ac2636104a770681946c2781cbd536e515d72ae6e047ae91592c230a82472fb507cde8564adcb4419fa7a4a2e3b3e0606d110b1a2
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7Fk7nQ/tbw/2Mkjy6Fr7g0oO:QNc/zEOVHFkQ/lFTjN4
TLSH
T150858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 570e20afbfa9c754b27c205468a3b71551fe53f3b4490f5f5ecc952baea69a33
MD5 9bfbc36eeae5c587fd7bca4bfca2cbdc
SHA1 8a3db5ecf5b1686f8555521c2d80b26c26508f9e
SHA512 909facab3e50731b74dedb680458ef75affe377e63d5b7089927bf97a5a485957f3933f5f1054264b52125c036c10e043dbe0c508181a1c3607e3204f7e968c1
SSDEEP 24576:E8kNvNnaFeYhJNtmZBmHnQ/tbw/2Mkjy6Fr7g0oU:E8MwBtOmHQ/lFTjN4
TLSH
T17655AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6b178e53c30737b29a8015b0fabf1010d22bb4ad8569cada71c97d4ea61313d2
MD5 4ba4d563d4f88ed520e6b7bd85d1c187
SHA1 289a9efc3917735be8ca12b07aa22ae075d91491
SHA512 5991dc0292d7e398a9f9236ef04316a4a006ae210857981af2fa5c7237598338c871055e6cbfae67c19edae7b94456961fb003175e75a16e4d79a2fccb24200d
SSDEEP 12288:FwHvUrBFrEjwaQfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWcd:FwPUr+NQ/nQ/tbw/2Mkjy6Fr7g0ocd
TLSH
T1DA65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ef2a21cd81f62a0e5c4d7c6f14cd62fac9918ee61c7556ca6bb094dbf4261668
MD5 95cd603b48be7244217ec478b8ae103e
SHA1 bbb5175ccf99b2cfa224ebe89e6f271b05551408
SHA512 b368a82c3e0426310be807e943fa35189e26b3a975f264956bb0c5ec6febcb7ce1a75bd9a6adf755c0fe311c07c744362ae3d3ffe313bfce92da320741a52667
SSDEEP 24576:6D3FHshBIYQgAunQ/tbw/2Mkjy6Fr7g0oJ:6DVHeBIAAuQ/lFTjN4
TLSH
T12475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-70-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1108-72-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1108-299-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1108-78-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1420-314-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1420-83-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/1420-88-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/1420-82-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1460-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1460-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1460-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1460-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1840-21-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1840-24-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1840-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1840-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1840-14-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2536-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2536-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2536-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2536-318-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2536-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2536-112-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3340-94-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3340-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-334-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3340-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-100-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4208-7-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4208-26-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4208-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4208-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4208-8-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4440-324-0x000001973A400000-0x000001973A50A000-memory.dmp

Download

memory/4440-400-0x000001973A400000-0x000001973A50A000-memory.dmp

Download

memory/4724-282-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4724-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4724-59-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4724-66-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5268-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5268-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5268-141-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5268-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5268-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5636-119-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5636-317-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5636-125-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5636-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5664-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5664-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5688-57-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5688-44-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/5688-43-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5688-51-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/5688-50-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/5688-55-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download