dd567b8f5a69e948d7012a77295ecd77f4e32e4c71988f4f850b227cfe905d47

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260802-m3qtysha56
SHA256 dd567b8f5a69e948d7012a77295ecd77f4e32e4c71988f4f850b227cfe905d47
MD5 af745e4597a5cbd71ee8dd6dbca65b73
SHA1 7adcad7d90531a76a22b7ef1bf380c58523bced2
SHA512 bb04bad7586268c8f68578d37676423f79031d128168b96411413f77d33a436735b4f50e774ce8efed3ac7cb47931c0be3de5df4c74311f83992b9e0d9b26d8e
SSDEEP 49152:2+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755n4:f/PvOcjcXvvOOc51wFRKIh
TLSH
T1CD165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1076	elevation_service.exe
3572	elevation_service.exe
7068	maintenanceservice.exe
3672	OSE.EXE
4956	PerceptionSimulationService.exe
3828	perfhost.exe
4620	ReFsDedupSvc.exe
6412	SensorDataService.exe
6360	ssh-agent.exe
4452	AgentService.exe
5896	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\becfcbf3957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a7055696e22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dd8a9276e22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e3fa7d286e22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6a0ae276e22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b34ed8276e22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
1076	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe
3572	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4128	2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	1076	elevation_service.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4452	AgentService.exe
Token: 33	5896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeDebugPrivilege	1076	elevation_service.exe
Token: SeDebugPrivilege	3572	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 2036	5896	SearchIndexer.exe	104
PID 5896 wrote to memory of 5692	5896	SearchIndexer.exe	105
PID 5896 wrote to memory of 4124	5896	SearchIndexer.exe	106
PID 5896 wrote to memory of 6468	5896	SearchIndexer.exe	107
PID 5896 wrote to memory of 3792	5896	SearchIndexer.exe	109
PID 5896 wrote to memory of 6020	5896	SearchIndexer.exe	110
PID 5896 wrote to memory of 5804	5896	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_af745e4597a5cbd71ee8dd6dbca65b73_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:7068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3828

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6412

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1776 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1776 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a77cdfeacc7f7c15e72e88be1e6c14de1af8e6a640c55335873af16855cd3eaa
MD5 7d8363d05c99f84fa6877e834afde245
SHA1 e2fa411628a498a4b61daad6884d2aa70b2749e3
SHA512 ce00daedd2c5437fee846462bac04cb876b8c3d6e97aa835e41ec2ce92a0ab67fe009f464a099f53012a7afe8f4d6082e10c198a8d11679c97c78823fd821cf8
SSDEEP 49152:Db+632BuPkFKRrdE6ohrstBhuXjfS4LWxnwXozsr8zlLwJIh:h3q60jBlwFRKIh
TLSH
T139D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 24f57b1fae6e08ebc13bd57c0ddea2a96b69b8a71e88c3888e883b877f39a863
MD5 98d4e6546f79ac2ca30f2e4c82bbdcdf
SHA1 1049a91a6c6c4aba18a7e9da081d4cabec12d748
SHA512 f3d1606a79c0665b0bfde9a8dc458ff265d1430ce21faab80773eeccfc1c0f55ff5a60b64ed7c699b9960163f70060ee06876f8e78278522ba1e5d2572ce44bf
SSDEEP 12288:d1XLsswWkxy2lRq2czA/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:TXYfDtczAN9Xozsr8zbhN6GwXOGIh4
TLSH
T188850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 4568488f198ac84287fe74e4ed602b4b4658983df692c267e74277a30029f0a8
MD5 4d351af4d6997d2502260407a121a3fa
SHA1 6003a7b8cafb0f464c8e395c23b0224482efe82c
SHA512 d0f031204fbb6021dcff157568c6b19d8e80f349eaa82fb91e947d7980f2c7a71e3190053502f04f50ef9ad57d8b6407ee633d4974f64e4068f24fa8c3c6c440
SSDEEP 24576:10Le5ji0hmx3rMg9Xozsr8zbhN6GwXOGIh4:1Pji0AhZXozsr8zlLwJIh
TLSH
T15EA5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c7de57c5349ba588b07c1210f87ad0fab36b2709f6571433848b45f3d3975374
MD5 3594a40cd02af8ae9ddd9fc2377879b3
SHA1 08637b45f028177344c6ef063870e5ad69a6e5c5
SHA512 5043e20cb3a341e464a9503a92648d2771d2b1cef483b8da813726408c7ea445147a2d1d9f4c83e408c1ce190cc1c70c4ec3dc4ec9bf233a362a8dc19b316225
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWr6q8wyuy9Xozsr8zbhN6GwXOGIh4:O/ezSC6vUzPviHjyFXozsr8zlLwJIh
TLSH
T1DE755C25F5788323D0B3D0BAC5D6BA99FE7230465B3089CB0246976C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1c52c82b0c1f0426011d2f84028a0b2c9d0587a0aaed5c29e28450969c9d20b4
MD5 5cb8987397a109a83bc161d6c2ca3cbb
SHA1 8cac09f7322d5df8c0b0b8e07754a4a07bbe13f0
SHA512 1eea498ca2b2a2f73754b6788b63a44b52582247049754cf40f126f67e8b344449d7de6cee1f4580dba35eeada6c19f235999d4d2cf1f308b323c5553bdcf876
SSDEEP 24576:SVbqPb88hv/l+bR9Xozsr8zbhN6GwXOGIh4:SVO88hXl+3Xozsr8zlLwJIh
TLSH
T11055AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 be4500338c329e9b7631fe63c79b895c01e48723537a6857552e283ce62d0c29
MD5 a6ddd0aab0dc11391ebd609fb3a3c51e
SHA1 21355e4534cecaba4b28e0f69f33f4be5c965d21
SHA512 c16c126d1c5df2396e751b55ec444d2c8ebc2250b691c2ffea4847ab827ea59497db3994c58a6841547637a574286e507743c6113203982db6f43d0442d88865
SSDEEP 12288:+RoksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+RE9Xozsr8zbhN6GwXOGIh4
TLSH
T1CB6523F7E691A442EF671F3139916AC4DEA7FD9E49811B4112382186CC7E47AFE21332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f6db4e43b22483deac590b50d62ce5da8b60dc9df6ffb6980e1cca7278fe12d4
MD5 b69057ffd2587ed41c3fce727947dba8
SHA1 2054c0ca05d1222bb341a625a67bc2bdd2308963
SHA512 e9acf945be47d0b3625174809e56e7b2de103008e97bd600eaeb1d8ebca91b1f31f27096850a928da6a8e7107af5eff11bd36812224609d51d7df4c24d6781e8
SSDEEP 12288:HeBNUbTVO86ULksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:HJIUZ9Xozsr8zbhN6GwXOGIh4
TLSH
T1D485DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eeb7b5f22ca529615829b43edf13e99862949a6a8568c3f5c43ecf17af8a3db9
MD5 2ac8c3fb2beef37e9855e3dc932b182f
SHA1 94200f6174ba72e5ed71562f1904dcf0bfa8bd2c
SHA512 30195b6a5e41ea6f8a525d56d5b9058c0cf88e8bb4e42fbf11d4bae7ec79c88b6a5c1203db8f59af91244f7f0ce844338c2e4ee3f0231cd98f31114f293dad10
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THc:nQvGAdlCEL8c/RRNw5CQwFRKIh
TLSH
T110267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 1903dcf7cac23a76950f0be4cfcb4c4683d982846407da6337822f0df2a133b5
MD5 8c64ec8485b44edbda37d24e8acad99e
SHA1 1dcac17416418cf02807224ce661f1fa2e4a5f6c
SHA512 354ba57c1e5c7dad0b0a6f5fcee0fc7386729928dbe534e957473a08db456315f8aed2698355f9cb37957d60b2f9754007a6c8cca2ca50e51ad899fa9f59c20a
SSDEEP 12288:pAwSfxL/2Dc3VDLLmt0LDQewsAjFksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:a4ewsAjj9Xozsr8zbhN6GwXOGIh4
TLSH
T17E85E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d3263ced340f8a54a13d6e79fc1849ea98228c55ffca1b156e2e2a7b620b96d3
MD5 defa552821b22d34527760508a793569
SHA1 16d8370b9711161300d6810dca3f4c41d79044e4
SHA512 3aae6247e82956da726dcad64f985196841a3e3025629aee693437149087a0e14f1e61feef8ecb0e78cca4706d93219bb0959fd40458b0a89ef975644acca565
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHuDKI:ZUEtQevvqc2W1cpV2RI32uD
TLSH
T1A4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d1fdd5075f64959697fe4d48ff149da07a35f4a564de5eae5ed11f9f4d7509d2
MD5 21fe966b4a37c4376be49dd40a15c3ef
SHA1 61bdcb283258567660bd261952725dd85d0afe9f
SHA512 519a4a992d5b28532f0b8bc9bc0b12fdc0e8812061239b408626ac65dab77a2a718c68b6efc7f34bccc29ee823f64f2a0486df57fb5134b7017fbfa8afd944ac
SSDEEP 49152:pCbRquA/m2yL5zifFiV+XenmE3/zpXozsr8zlLwJIh:moqHVjnmswFRKIh
TLSH
T127D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 72e31ab20345125698f52852f397d8879c6167216feda42f11aa02f96599675f
MD5 0a36ff29bf88ae45535b96d7881b7f65
SHA1 958fee1830a60923113124c8bf13900ee0b79318
SHA512 fda8c30331095540a5ca2a1b6a0d13520d38d88d04701dbf607e8fcaf44216c1ed06766883dc1f72ea659f41815e492389aea9c69326c74c825103996f5afa2d
SSDEEP 24576:DAhGL2IFoiwtA5l7S53O9Xozsr8zbhN6GwXOGIh4:DAM1Foiq58Xozsr8zlLwJIh
TLSH
T1D4359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 478107faf1a41bbf181ec07c596e28257245bf949449feba97c17d5a3a2d52a5
MD5 6393dde99f69cec134a54c01bdc2d4d3
SHA1 a9d60a97941e8500564bde3edf319c743105ce13
SHA512 794604a4c8e3f52864095882f1e2b9228cef69caa49ca45de4d4fe33c08adfbfb7416249f75741bb7db8d265050aab6ecbee050a8fc474f800d120d8c052ca5a
SSDEEP 12288:bmw5HEjsChNkBFgl0WDm+CeksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:6wuVOWf9Xozsr8zbhN6GwXOGIh4
TLSH
T19485F14676A41CF9EAA786398587C535E7F3BC062A21DB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2ddac2150d0344831f10fbd33ab15be01dedfeec73bd2806b64f117fb8c7a298
MD5 4687f12a725926b75724e1ab0088e7d4
SHA1 0b1fdbef682c5aa2076d85b579023f7567ae18c4
SHA512 b2bee91336566697435b9ed4489810deed59c7392c606daa7c03930101e1d04799ee1b44f82a8069130452743660c9da30c2b841cd07e9735e86cce73d9a079f
SSDEEP 12288:aZZ1Iy1ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:8ZuI9Xozsr8zbhN6GwXOGIh4
TLSH
T1827512AB73E070F5E6A3473898E15A44D7B3B856577203CF1238029A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d75a58dc81e798decb9a73bf4eb225b700417e80dca6339cfc4b6abd159c080f
MD5 0f8bcb238e4696ac9c30d6e448aa4977
SHA1 41f9ef376b783dc04c80d946390c006234a41824
SHA512 ab81f59f9f8aad9213c58fe88dcaaf8a0296c9c5ef99e91770d3678f828d4ec70c9819b625425e4b0dd532d99666affb32aedf4332ecfe3d655db7bce0e946ef
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UQ:yQRQyi36YOcPhLvw2gAf+PN3XwFRKIh
TLSH
T1D3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3b2b91e3d7ce6101732f3578f52090999c27a4eb49804b627266a9048e2c4757
MD5 6bcebc2d5b8689948045889de0c154ea
SHA1 0d30cb653becc5a90345ee637395f486dade6b24
SHA512 9820039c859449eb24c18f3530b738b92455a5f473c1809119c8dca1a422cc9844515795b2b58436b7d83ec0f9ab780ac59b4629a52c9fc1bb382a49a5c92611
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UQ:4QRQyi36YOcPhLvw2gAf+PN3XwFRKIh
TLSH
T121667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1543e46003cade7420ea83c9f50d3fb4d4584a280d328859c97f8bfb9ef3b04b
MD5 ca67eec95f040e8ad35479d0144ae0a0
SHA1 a3ec67edd572b6b5009104c32b55b3d84ff2534f
SHA512 77dfe030f725766632091d5fa1dac43d21723ec67846c2fc9508327fc28cb8d70a2e8256a970f00122c35ff517f6a7830b7390e50f0b779c42d7fcc887786d6f
SSDEEP 49152:w68Qg55nhceWu7PNU3/ZXozsr8zlLwJIh:qthLRc/NwFRKIh
TLSH
T16EB55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f8bdabb1175bbe1fdf55c89f5f32cea2e08e26f930c7f011ace900dde079e720
MD5 04f27b2ca1ace03100dd7a3efa0285d0
SHA1 c8983042707405bc8d0b005269f70e3237033668
SHA512 bd0380b4c363ec7b34b1869e3767b2f68c3ecb90918a7a6e91acb178d2b6d43dc62f6528f0fd67632bd85cc732872997353463725664aa5dd175b369b6950533
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99u:xy5112gYy5azzVva69nLKnhZawFRKIh
TLSH
T158167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5f9ecc8e69aab79b3e71255923ce465b0f5ecb30e8be73e63e8c407f342efb20
MD5 89823a78605da24157730df595f64cf4
SHA1 13d1042ada0a4600dd3ca27a1f68d43d3da70e7f
SHA512 c658b67a53be60a167e8fbbece187a76a5e2ce5c8bf3a862ca5208a9c220716562c71f0320866ccff9c293d064fe4760d3ae7d572414f608afc1ec09ee905d06
SSDEEP 49152:DB+taZ3usBWOBr4tEG20bqx0z+n217aau1glNXozsr8zlLwJIh:1u6JmUxd2dxwFRKIh
TLSH
T1B5D5AD13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 86111e09cca2a13588d1ac37f656cf86647d0442add22aed379c8225f45ccea9
MD5 416b1f8c6eb3b3e4f697700c992e48d7
SHA1 d600f82381dfbc917002379ecd1c396b0bf55813
SHA512 1077b99f9ca805815ed04a9526a7a48128674e75515a2d3445621c57a5542702a4ee50e20d78c5d0e323f551020a2026f4a97d304223fa565c607ac58ef55611
SSDEEP 49152:N1hpsNoJpF1A6BU44CwH7R4xbXozsr8zlLwJIh:NmifPkRswFRKIh
TLSH
T158B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8b03052f84b5816e8b1891d44c4cd9f2420fa56bce4a46eef4b478fae67db94c
MD5 3b216af2218468ad8e876297e4837acb
SHA1 1099b9c097ef4493c388c5625311eecd88849228
SHA512 da98b878d17ba627664db2309ccf48b79cfbbdc749b2ff56f172cb940781a3fe4befaf892e88f7849879b75488ed2c100829efff539bf9d0a728867a23e663ed
SSDEEP 49152:zSuZQIY0Be2KNRVtOnks6NMHqyXozsr8zlLwJIh:x5dKvi61+wFRKIh
TLSH
T17EC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 194d3f9ed3136dcea19864e821c65b4858ef0d8070210756972b5b2c0c0aa1cf
MD5 06699a8eea2f1ae5d932b696df63cc0b
SHA1 4bc4c4a140c4233a3c5f6e5f8a32693d02bfa139
SHA512 ae70bb15ce7b134688cde7ed0ece712073d2e5dff8c107315d778fd124b585ac8f5deb51390dd3222a5ca7875ac94ac8457749aa5ab64b10756da3ebb0357ea0
SSDEEP 49152:hhtSn8EApI0figXgiDn0AP5wvXozsr8zlLwJIh:wX2iyphowFRKIh
TLSH
T10395BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 d6223f9c0c903afb66eeef95ec29baa6cd8b597f2c0b781c877a34d83c3aec67
MD5 f357dd2efd46c1fd4f5289b648d34c39
SHA1 34158e252455c55d5a4ef2b3c5142be2799ac1d4
SHA512 37e8a5d6f777045063f77266b6dd3ab1b6f132df8239b40819518d913565c8ade2e7d8d082f2f778e955411f6b84387a8540257354cf74c14ad597283842f63d
SSDEEP 12288:IAksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Is9Xozsr8zbhN6GwXOGIh4
TLSH
T1F06523B7F992A442EB575F3129811AC4CAA7BD9FA9C21791333D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 5df06be45657376d0b8d17c44582f7f2166887e77edfd50003ee00d8107a09d4
MD5 6bb549cd76abbd43b5d0170f0ed2004e
SHA1 54d3ffcff16aa91b4daa2b0068c652ab07d73c8b
SHA512 739896cb30f78cdb57f1fda671894e76c18244a93c2eb3b22be9c92d6d8461be4d399271f74047bfbb9fc008b6297dd188b251602a6bb02d5b86f5e92a4073d1
SSDEEP 12288:uJksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:uX9Xozsr8zbhN6GwXOGIh4
TLSH
T1F66523F7F992A442EB575B3129811AC4CEA7FD9FA9821791333D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 472e2b0c62431c0f694e39ec95f23de89d19528a90b898f1ebda7694bbe11e67
MD5 0a1f6390c34e4fd3a37874659bc6dae1
SHA1 b2f20633ee8d3a1205acd918c7696b6cd83e4836
SHA512 539bcd56e0bf213342050e4865151d563b5de17a314395910da35e98a22c14cc13d1893b150223878626214943f615ab9b7ac58cf770304ce3bd125e470180a0
SSDEEP 12288:RjksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Rh9Xozsr8zbhN6GwXOGIh4
TLSH
T18E6523B7F9A2A442EB575F31298116C4CEA7BD9FA9C21791333D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 64f6ed0849c839dbae2c374ead1a4590da30bb84e48418db8654b29637396ce3
MD5 2b9d30421dbfd3d50c8fe95d0fad6178
SHA1 91dd7012244248e4b9e3b3d2d553540613572542
SHA512 dbe8eab685c25bfb20a5cf16ccfbb7bcee33283cea08291865a392f7cb82c5a1b865527f925392f7e9b3ec4ce0b956e47282fa1d85dbabd51268c1d73cde2458
SSDEEP 12288:3VaksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:s9Xozsr8zbhN6GwXOGIh4
TLSH
T1C36523A7F7A550C2EE679B3198915680DAF3FCDE9B5217CB232800468D76669BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 71db38b97dba191917d7406d4fa7e66df0413d246a74fc9328f6e6ecd4efd79b
MD5 870c67df40aed8f87c8e74f20e8d8299
SHA1 854f62c19e6fdde2ef2b2d153ce45c4ddab323c9
SHA512 7caf7f139ed0c02cb3f746f54901211065813272221f644396c88209389e46265acab86c6601f790e9b0a8b492663fede96285c3a682bf6d9cf97461ff18c599
SSDEEP 12288:giksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:gG9Xozsr8zbhN6GwXOGIh4
TLSH
T1CB6523B7F9A2A442EB575B31298116C4CEA7BD9FA9C21791333D1042DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 36ceaaf5cea47d60afd91bc4347ea7df478268de995b81241666bb569276785b
MD5 81b6cae0ad60fbb1ea9b1cd7f8dfa6d8
SHA1 035725207dd52b095a3fd7f380d97ceca3279165
SHA512 42cb9884596ecebf5d72b6badbc27dad500dd7011b7188eae0375ff7b9d7f9ae3eced69567192fc49a05f603dc2f5423ee60454409257ade7927c71d3c199d95
SSDEEP 12288:o9ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:or9Xozsr8zbhN6GwXOGIh4
TLSH
T1796523F7F992A442EB575B3129811AC4CAA7BD9FA9C21791333D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 be60cdd4250cd100f8c2fa26730128efac09c85ee6afafa1318c3a91f5caf53f
MD5 1705138579a914db8d043c7c053665db
SHA1 eadb2c895765b0cd8320505b39893c4a7d73a5f7
SHA512 151443106eb70d6557215ab43df9caa4e619aed6b8d561db6fd1ce864cd21121611a34828b09a46e1ee156bd055aa68e3b68c6fc56fedc8f3a9711340591d6df
SSDEEP 12288:URksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Uv9Xozsr8zbhN6GwXOGIh4
TLSH
T1D96523B7F992A443EB575B3129815AC4CEA7BD9FA9C21791333D0042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 8580262736559878c25adeb1657c713fdfb7e623f89de31c49c94f0a1e4e4d58
MD5 2a1850494f3ac3502af38dcf3ceaaaab
SHA1 503606924aa7c5d920e8be41b21950a599d024c9
SHA512 9451f7fa22aab4d6e3f837bdd1ada940a110949a6731ec55bd67b5f38dbcd2b6e78c54d8f52d6753642b6c2ac6f4e6fbda2a24d6bb1123d45ee661d2b04e06e6
SSDEEP 12288:yiZwbWzzFEoS2cPvypksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:VZMWzFVSO39Xozsr8zbhN6GwXOGIh4
TLSH
T1E28501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 d06a94137bf980e579f34747a062e011f92327380b6635992e8a88486fcff0c1
MD5 e50e3e9775934f3ce8653af255da58be
SHA1 bbd812fadf17a216342f339f055c3927698e5581
SHA512 564b7d989e56f11c0f88924500c749312bc79cb018c065f2bd2aeda7ac359b8dbf16691b2a7787b6eb96f57ac2aa7beda9a525de80c7f0af4f497cfed93f1c74
SSDEEP 12288:N8ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:N49Xozsr8zbhN6GwXOGIh4
TLSH
T1A96523F7F992A442EB571B3129811AC4CEA7BD9FA9C21791333D1046DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 ea548c89406ef2b5ecf8f46c0d8d29002eedf00b14072915e866f355996382c4
MD5 4cdb89bbe2b80192753a9b682c7a924d
SHA1 be896b795fa849ba81210c8109d4375bd8dc2c1e
SHA512 32c73716c19c021d1e9bb66b9d34d6cc0b50a7983a36cf855948bf812659e135cbbcdbef4a67950fad4ca820a32effbccb9281a77e6ac4508a9cda7a525b8062
SSDEEP 12288:4YksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:409Xozsr8zbhN6GwXOGIh4
TLSH
T1EB6523B7F992A442EB575B3129811AC4CEA7FD9FA9821791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 fdfb10137bba761a8dd9aa1263a296eff3c5c5d4152f798383b35a07402ca210
MD5 8b8c3011eb18e45f0fe9dce0aa7feacd
SHA1 7cd7b04714a411678b7d8a66e8f6593dcaab3176
SHA512 0f7c199f891061bde65fa832d8acb394445fa76250f7311e4af850b881ca06726ddfd069fcf5833bae310b63b12194ee238a4d626a74bf70db142deade7c057f
SSDEEP 12288:gyPz5L81ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RzyT9Xozsr8zbhN6GwXOGIh4
TLSH
T1DF751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 9b3543b55e4b040b9f9e960426839f3ab1c3faefcd763af608507c04add494e2
MD5 002db3795112b024be18769e9af5ab9a
SHA1 7a48b2bad9a0afbc38f23b5a278845838db437f4
SHA512 ee2d663816bb4f8803f6c29d63eacff979bbf1181261b2fb9df2bbfbd0279483d367482ebccabcefcc1a78127c7980a59c6c39047cfe779d4b945de1eb287dd7
SSDEEP 12288:v8ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:v49Xozsr8zbhN6GwXOGIh4
TLSH
T10A6523B7F9A2A442EB571B3129811AC4CEA7FD9FA9C21791333D1045DC7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 1123510b593494cd51ff3aa881bf1c00ec1d2aeac4a0fecfff5395f76530e9ca
MD5 e754d8b07c9b23396df4981717e52cdd
SHA1 852f845f766235f4bc4ce11492dc369d266fcbb2
SHA512 c7b7a509f9fa16de6fdb7def304704d212062b3e6158214e815eef98ebfad299ba8c71937a455db5dfc369e602cbea6ae79f3fe86e57e0570bbc74ec14bf6088
SSDEEP 12288:d8ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:d49Xozsr8zbhN6GwXOGIh4
TLSH
T1266523B7F9A2A442EB571B3129811AC4CEA7FD9FA9C21791333D1045DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 d9ab346a11c386cda5b9ab9fb622a37c41348afc1896d35300d6e6e10416e150
MD5 dffad6a538c5746c4434a8491f8f1a7f
SHA1 6c1e69e8ef92b3ccc57d8b64088a978ceb67e387
SHA512 4aa82cffd79ab4d22ff87ed17ed83a74b6f3e30860d4a904abafedcab19c5ce3f690ddf8ab226176ad46e50d471ce154577b29eaafaedbf647836fa4a74e7073
SSDEEP 12288:9yPz5L81ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0zyT9Xozsr8zbhN6GwXOGIh4
TLSH
T194751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 45ff630abeb0f87bf3e26f9b9865226626fc721ac73d5a723aca47c9510873ee
MD5 1e76d66f8fba46fc96418c37684306ff
SHA1 bec54494077ac166577c6413018acd509ecbf700
SHA512 ad45915afe75050a2ba88fc61bb864aefa1ab101cc8917246b14ab563ebd5b5f0c7944bc10c4952241a5e8dd7c601e0cfcd0968a133eaddd6774a3a707e0c77d
SSDEEP 24576:uTHaLl3z0zDx9Xozsr8zbhN6GwXOGIh4:uT6LljAXozsr8zlLwJIh
TLSH
T1878501A5B39018F8ED67823EC8518905D6B2BC5A0BA0C75F13B832575F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a3a7f87a9f6f3a72a024a7590d2bf39e8fa0f98ccd274c8575210d7e0c69477e
MD5 4588bd95f3cc14f072d19c48a3422b5f
SHA1 d11b9ef4eb0dbb1ee03921237b144c8c6ddfc8e6
SHA512 fe5c1c617674b57ff8cc9f1f2f05b41fdf831d2cb0d3891ee2e9ab6a69f8dfbe8035da663223e3ed87f683d42bd18f6a68fd1545777674aa11be2a6b2a760c6f
SSDEEP 24576:r3Ld9CHKy7GZ19Xozsr8zbhN6GwXOGIh4:LLd9CHKyaRXozsr8zlLwJIh
TLSH
T10495CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 3d2f5641c0178ed66530bc4ac72c1f1c7a7881713c4fee5fcc4dc2a47f0b8c95
MD5 024e2fed8993a9d2fce95f6b95d3db52
SHA1 66fa6e7cd8520b78f647dc8563c49c6f9bd284d6
SHA512 4531f358430daaa16f8ca60cfede74293ef14e7dadd1468eb4c9cd636646b352a238bc276085f5228530c99768425d2e10807fd032acf7229a830b302d16152d
SSDEEP 12288:uDksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:uB9Xozsr8zbhN6GwXOGIh4
TLSH
T1F56523B7F9A2A442EB575F31298116C4CEA7BD9FA9C21791333D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 4706e53482842172facb89eb913841f3694707f29edf5253e19fe5d868dc1f89
MD5 ac3814f2448cdeb634faafa5e40ab8bd
SHA1 16619ba7840075eb9f2c51dacaf3d3135ef8fc9c
SHA512 33e2f3c129ee462dc363fb420e4cc6d661108e5693310f0e167063f4e38f4e0260523ad5a0829cedd01cc9ce4fc4b5695490580c74d51a3053c18628e4ffb086
SSDEEP 12288:NVksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Nz9Xozsr8zbhN6GwXOGIh4
TLSH
T1D36523B7FAA1A442FB575B3129815AC4CEA7BD9F99821791333D1042DC7E83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 7c26a58fe4935bf80af6a9bccbddcfb89f383b9b8caac88462dc0486d8ecddb7
MD5 6b4f6e84cf7f971b47a62f279e35b5a8
SHA1 ef0d326b1d6c7ed405396665b109fbafdf9254f5
SHA512 09a8e7b549907a944044b8ab9b657ea3df4581d955bfd0a5274c0d4a68b245b80e00611788dc92c6e60253bc95c289829ea431c4afc1825cffd368df688c36ef
SSDEEP 12288:5mksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:5K9Xozsr8zbhN6GwXOGIh4
TLSH
T15D6523F7F9A2A442EB575B3129811AC4CDA7BD9FA9C21781333D1045DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 175e97384a49239a3fd02e486cb7adf7d87410c17256b8a021cf482ec776a708
MD5 3fa0471ba6dc116bfa8a3cbe60dfa835
SHA1 c6b9d4bf8fc664792ffb2498265c80db33142645
SHA512 4b1700f76c4a27a5d3680e9ae84ecc5cda8a98ff69abc9b9e9f02ebde25b95ff3036de4d0e8fe3e5ca20a6ea6b3cb884260dad19f568fed4e505d939ae380a4c
SSDEEP 12288:a8ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:a49Xozsr8zbhN6GwXOGIh4
TLSH
T16F6523F7F9A2A442EB575B3129811AC4CEA7BD9FA9C21791333D1045DC7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 d7630c3a5d40508106ccd1d134d8e22fb96b518e83a165a58498e9f362417525
MD5 d96bacfd8cc156d44e9fe8062d85a76f
SHA1 f66d42ef52dff6e213a036560b350d7940f6b6ff
SHA512 2f8f9b619d00038a8a67eea3b9cd835c57005705ff076bdb6293a35e05aba056b1c48151d378c0731e2301112da715407ea00aa2ff8a2b89c4bcbfa0e7e01626
SSDEEP 12288:3DksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3B9Xozsr8zbhN6GwXOGIh4
TLSH
T1B26523B7F992A442EB575F3129811AC4CDA7BD9FA9C21791333D1042DC7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 e733d0ec245dbc8239a10baef77d8c0d32302eac71665709f3cb43fe3cc87b52
MD5 bc08e9231cfecbdcdec9c5aec81e3d3d
SHA1 7b6836c76bfecb42a367cc47a4d3bf0f5653eb43
SHA512 806383562e3262857a057df81db874f1145d6d4a72db38f47ee37588f38ec8cded536b6ee4e3ef3495467d339854bd625325120b047e80a254e96d3acad475eb
SSDEEP 12288:kEksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:kw9Xozsr8zbhN6GwXOGIh4
TLSH
T1BE6523B7F9A29442EB575B3129811AC4CEA7BD9FA9C30791333D1042DC7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 70fd2d6e0836f71610eca7bcf8783861b5fc7fdf8d3557863186f3dcca2e5982
MD5 cab6ce4586c45f0dded73f29d98081ef
SHA1 6ec9a056e6d44da5d0ea26c42827eabb231f855d
SHA512 0c240c09c2bdacfb9c9a946c0c712a92b65a2784896ae92d6919263672c9e9f4b0f00479531ac3331c0f0dc2b98920938f6f6903eb71a8b4f4e8b936727d1ab6
SSDEEP 12288:giksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:gG9Xozsr8zbhN6GwXOGIh4
TLSH
T1216523B7F992A442EB575B3129811AC4CEA7BD9FA9C21791333D1042DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 96003691b97b4f35bf866e0e9856ed4aa74aa0cdbee9cd2dfaf4d0960035470d
MD5 8495d65f08157a4bfe4b6909dc85dbf7
SHA1 80351b2a62a5bb941cae9684a609961237308abf
SHA512 0477bad2e7324eca13a7a2669876895587c26980732b5ba8928c5156792f03c27e4b32e617d28567e6e3342d2c92706e4e1fd4e83446c45e2db2b3fe9270807c
SSDEEP 24576:Wfwv7k9RX6wkyAIk9Xozsr8zbhN6GwXOGIh4:pMnYIeXozsr8zlLwJIh
TLSH
T1A495D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4b2c7cf8e0e8bb7b418cc6500b8bd8b5efcae266953b12fd9559ee7bd5a59aaf
MD5 d1a6374939df117565d69454c265dfe1
SHA1 0e42d3fcea11d01be3a4c92bdcbb0346c967e5fe
SHA512 e5afd546c42ac590c4dd3b9fb2209f1068cafe8dc3ef52ccfc505e53d83ef74df807197097dc860128cb434e5bfc13de839f3e9aa9b8b42ec968c6826ca99ec2
SSDEEP 49152:kYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PXozsr8zlLwJs:MySzP3wFRKIh
TLSH
T19E066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8a196bd237742cc7ab43592cc05dd5e3a00f4fecfefcdb8074b13518dc644f6f
MD5 e15b17db7c818e3f95e7fb31892d6565
SHA1 0f26f5837106af6556f37abfc1c176eeb4bc66d8
SHA512 14ac91da50df77ba7d0acfbc2a113a0466ce20675315b9f50ba19ceba6f9ce38c65baf18c3f3a224fbf3b5a413a3a373d8161eac10e8d25f5ef51dd4b0968b23
SSDEEP 24576:A47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYn9Xozsr8zbhN6GwXOGIh4:A47JUQj4irIhCnDHUPfF//Xozsr8zlLT
TLSH
T14A65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 958174b137a5421ff0d55bbc1603dd8a5b37d76e9b27d4c01e85e6232987e33d
MD5 4fbabac960d3bcf3354a0a796a88a9d1
SHA1 c801a07e7bc6b3b35d5dc43893d74f7e1fb00955
SHA512 cf3876a9481fbb9727e72a74c4eb69ac8062d1c5cc41c1b8b767458103456e2102e85c016a0d650fc378cff179134cce915013bbaa20e511f24ffb6f54d0e109
SSDEEP 12288:pQsfMksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:JI9Xozsr8zbhN6GwXOGIh4
TLSH
T19675F15AE29411D9D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A5A0AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 cc1a2fbc531d81c4c6d61d1d5f53811b54ce3b4619208afce211c5cb27d21db7
MD5 fe467bb0a7ff59a794ebc2aa28e12bb2
SHA1 9fcf8960bd1c314ccca8a8bc37e490c33edc0c1d
SHA512 abec697c1f08844040fe9b28031aaa66fdc743b949bcc268d669c01ea4c9b07abf70037e889545d651693a7d728bb58ddfa34bd1d274b55475b42ba3279b320e
SSDEEP 12288:ScBbdU3fFaPclm+x4HHysNv0p3vcykFas6sM:ScZdUPMclEoE9Fb6sM
TLSH
T1FA351600766BD75FC6A940321E32D5CCAB707D01EE456E0773C89B3FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 4c1ced6c43283fd9c5866f47b6e80b9e1ebd91a4a3a156cc32f2c6a2f1aad865
MD5 f5186b94e6f764d12205af145925dc12
SHA1 8ae51a8b37b8b5a3a123085dcf2a59a45e8566b6
SHA512 4033eb96bc00f9cbab66d4abc71eb7d678afd41162e2d2d17fdeeb3dc85c1244bc9fd3eb3b91ea8e93aad3d3d71c0c57fc603d3287440e876478c9a481853d2e
SSDEEP 6144:da0g6PPz2UXLdCvnJozdHoIaFNnQMwmhci1LHMrQUNOgIl5MGm/sdQn97bqthRPk:jz2UXLgvmRvaHB6ynTWKF0ZBJQMAo
TLSH
T1F0750A415537E3CFD1F76032072A6B4D67A4EC06BB056F22B3C8453AD86BA25A4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 4073ec9fd2159819afc3f47e59ae343834c7f6d840b19981dc1624cca1f38160
MD5 1ab0fff1af0456cc0275315c9fdc6024
SHA1 68b37b4c1a37b8ce34bd60cbadb6cdfc2ecc3ad4
SHA512 542a36a7031882e07651372e94891b158022568d3654353a60b96a3e15a954c1c5c914b611878251706707933ca7c4ffa4f078dab098d463ce41ed4b22ac5a75
SSDEEP 12288:7d7UksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RA9Xozsr8zbhN6GwXOGIh4
TLSH
T1F16523B7E795A802FA771B30288556549A5BFD9E4F8107C3322C1186DC7A8E6BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1c310106e31147304aa15ef3489edff10f253787d75b588ad2dbe6f52dfbf38f
MD5 b63a4ab7c25dbf90bc9a9c17b3e5204d
SHA1 2305da0d3015ec4f9a853ca6108b73f47b393bde
SHA512 0a4939f8a93c5d8ac26c560d899898651623112928f99702cbea01fed28c46080b3e10054e8f2b6e4720d01d395b358fe6dd6c8e60fa6aac6cc1a8e832fd315d
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYy9Xozsr8zbhN6GwXOGIh4:9gb4mBIBhGF9Xozsr8zlLwJIh
TLSH
T1F365AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 601fdfbbd65d135dbec74048c175955b025b38d4e2907ee714347cc5363ea2df
MD5 efb723ebe9a7716cee0a80ba2c5c3643
SHA1 2959dd242835b144c271f69f8ee2bbfeb10dad1a
SHA512 5606e3a11b0e3a0d052ec45043aa3a814955b11e1cf83349bf384d81cd08e309666dbe0805d46b0ff4f627adc7fff17b3e81ca7c7e28c4ed68e5528987d1e8b6
SSDEEP 24576:iG88u8FpJqH1czria7/m39Xozsr8zbhN6GwXOGIh4:57ZFPqV7a7/oXozsr8zlLwJIh
TLSH
T14CA5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6f68008eed042bb07a544409a855410c297d2d1c8290686bda8113e5ca5eb77a
MD5 2ae5572de29f1473a54cd14b639f33bb
SHA1 0863f96dac736ab089d595ef4ad2da5289592907
SHA512 5ceb239c24c37f2833f15fb43cb4bc19125dd2bce4ff29c53bb1cc0ee4cd1e9be77ab7a17016905f172532552712f7f4a544f5ad9225665b616389c0a721f6e0
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhXozsr8zlLwJIh:2G05lO43bSwFRKIh
TLSH
T1A4D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2e817a5bee9168d13133f29d6d6854bf1606833464fee6f0c2d04f8105ec781b
MD5 5832e18354f2afe8ad166da24d100d1d
SHA1 0093ff48352cb57c427b2514a4177a7512f3d98a
SHA512 43e1b5d81970a8011090dc6ca8b64e1cd4c8f3e82bfe73a0387caedbc593e0a43ca55d87318f85d63973903c13c6b0513e8324710ff4046a7388df9ccddc19a2
SSDEEP 24576:afa5POZ3dpqWVM50JicR2hG0lasx2+47eidnt9Xozsr8zbhN6GwXOGIh4:ya5POZ39Jt2pasx2+mZXozsr8zlLwJIh
TLSH
T15765BF5EA6FC00D5D579D17DC583461AE5B2342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60c9a4e079f6df326fa069d67296e6fa259ec78f2491c229a6249453605ee611
MD5 3f615b91a0d50504b1e22a2f6906ea61
SHA1 43cb01b97977216da3ff86ada2dfef8c31ccff5b
SHA512 c8be483a906d1ab31dfb99c493495582dbc014e0a800d2604e211151f9292dd19157e184682b74f1437abb2084479ff1707d9fd3993afbd2fb00a40bf19ec204
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7Fk/9Xozsr8zbhN6GwXOGIh4:WNc/zEOVHFIXozsr8zlLwJIh
TLSH
T17A858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4e1d29a37392947b4ef46d0920b04a5ceb93a8fff6dfce99a4d4fbf83631c9c5
MD5 9515fe1029268237bd730c5aba8de05d
SHA1 0df5122eedaf3b65deb25edd75410c48c98befae
SHA512 83cb4bd02466c723533e8f2b696796b8a373f16b63f84c0da0bc6c32f27bdc2050d0cd9e07221333a6d96b99d7aa2fe258e0fd166ef87b204b0b06894e488c8e
SSDEEP 24576:QtkNvNnaFeYhJNtmZBmz9Xozsr8zbhN6GwXOGIh4:QtMwBtOmZXozsr8zlLwJIh
TLSH
T12A55AF6EBAF845E4D1FEC6B48D238512EA727861073253CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 fb1a7e175d1977eb79da0f1b6463be1ab3e89dc9378adb82e5b9067e80ccdd40
MD5 bc60a04b86564d20ce6c6b5df6a07f63
SHA1 b0be0ef8f1116f7a811904f338a7532cef688323
SHA512 108b0184734c356644aaeeaa0c6b138f46bcf376f65a03ee931b0f0abc4a4510681f44a1c63e7646050046c1247f9615ceac7ec00df8e5e94f31e9a1bf5cac09
SSDEEP 12288:1HvUrBFrEjwaQtksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:1PUr+NQb9Xozsr8zbhN6GwXOGIh4
TLSH
T1DD85F26F72E918E5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a10f840ed31e4234aac86045b5d46661a4a7c1955ed5212959f52aaceeab614a
MD5 dd1c6a6ce62017ff19551eb063a0655a
SHA1 d8d689de02a63851446de3d25af8be95f2c1bec8
SHA512 14eda6d8525a46e27b8e02e0b9b92a02c7958efaf2325ee114734100a9269b0c62a67e481a8c163dfcb89d2606fd72fce00c874a8cf5ecadb2540c30017b578c
SSDEEP 24576:WD3FHshBIYQgAM9Xozsr8zbhN6GwXOGIh4:WDVHeBIAA2Xozsr8zlLwJIh
TLSH
T18E95E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1076-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1076-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1076-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3572-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3572-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3572-98-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3572-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3672-270-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3672-57-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3672-64-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/3672-58-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/3828-80-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3828-81-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/3828-311-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3828-86-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/4128-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4128-0-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4128-30-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4128-8-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4452-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4452-136-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4452-130-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4452-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4452-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4620-92-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4620-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-330-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4620-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4956-76-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4956-68-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4956-70-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4956-296-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5896-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5896-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5896-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5896-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6360-314-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/6360-118-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6360-117-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/6360-124-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6412-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6412-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6412-111-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/6412-316-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/6412-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6412-105-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/7068-55-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/7068-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/7068-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/7068-41-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/7068-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/7068-42-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download