6df4542e07684d1bb73c45e1e002d390656d346d6fe5ce35f00bac0e363a16c5

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260802-nvkteasbpc
SHA256 6df4542e07684d1bb73c45e1e002d390656d346d6fe5ce35f00bac0e363a16c5
MD5 4eb62921fa71aa03580b625c5ac3fe34
SHA1 2824d31075be10c52128cbb970cf4d079e637725
SHA512 099628949e9b75fbc22ffc154c65c6b9b37ea94dabbbfafeeab2d00f6c7aab1a1d41c86138f55295ac1d6304a6c0d0ff6b555c48e70614b081ecb133c47f0b9d
SSDEEP 49152:W+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN75504://PvOcjcXvvOOc5ywFRKIh
TLSH
T181165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2240	elevation_service.exe
4448	elevation_service.exe
2668	maintenanceservice.exe
1540	OSE.EXE
3556	PerceptionSimulationService.exe
3496	perfhost.exe
1556	ReFsDedupSvc.exe
4592	SensorDataService.exe
5096	ssh-agent.exe
2108	AgentService.exe
4456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4dddb3f6d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db6428647422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008204ef227422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055fc4b647422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001f7dc227422dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e3ace0227422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
2240	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe
4448	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4812	2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2240	elevation_service.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2108	AgentService.exe
Token: 33	4456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4456	SearchIndexer.exe
Token: SeDebugPrivilege	2240	elevation_service.exe
Token: SeDebugPrivilege	4448	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 5856	4456	SearchIndexer.exe	103
PID 4456 wrote to memory of 2828	4456	SearchIndexer.exe	104
PID 4456 wrote to memory of 1764	4456	SearchIndexer.exe	105
PID 4456 wrote to memory of 2524	4456	SearchIndexer.exe	106
PID 4456 wrote to memory of 732	4456	SearchIndexer.exe	108
PID 4456 wrote to memory of 5692	4456	SearchIndexer.exe	109
PID 4456 wrote to memory of 2880	4456	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_4eb62921fa71aa03580b625c5ac3fe34_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3556

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3496

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4592

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 3.3MB
SHA256 206702b0a372b180cd75b52fe670ea135f7ac9f35201b7eec6df14b70e418353
MD5 8c3868026f7f35c78e0be7669f9ba9f5
SHA1 a75ac15959569a3bf0a896599c0df9d61f9c6101
SHA512 146530e5a079679088c70c9e335e964beea334e1045312b8ed3bb8b29769925285a718fd2cd450af0b5a275e9ab1bd65636e385ba88df5e78c525709c3584de3
SSDEEP 49152:4b+632BuPkFKRrdE6ohIstBhuXjfS4LWxnlXozsr8zlLwJIh:S3q6VjBwwFRKIh
TLSH
T1A4F59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 3.3MB
SHA256 1587fa61e2b299ab7cca12af4cf0ad87c62599de412fe0930146c496e864c663
MD5 3e7f5aa6f3558403b3b672511515d08f
SHA1 877e5a083286bbf3cbd4b8268384b3c3d541341a
SHA512 abb181baa2cdcb0b59a4f50335d8fca62f264b26b696bcce07afcd2b794ef566e0d22e42cdf274f0f8f002d08c68d6e8647030c598594fc8d549708742cd61fc
SSDEEP 49152:Fb+632BuPkFKRrdE6ohIstBhuXjfS4LWxnlXozsr8zlLwJIh:b3q6VjBwwFRKIh
TLSH
T1BDF59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8cd6994e319f6b0793e695a84f55416bc46a7040616450a390603d3f93ae1e52
MD5 3af4d6f06d1464f4d2156ba7d4845a81
SHA1 cae5c0ecc63f9e52c3dffa3043ac79ffbdf33a60
SHA512 f58b494b5990307d4c3b0e5e583735f29e9f5ae738c02fb3f506a4e58a4a2404e5cb469bbe27582a1d26f25bf9200f696fc81bf7111ebd6cc765647faee4b0a5
SSDEEP 12288:l1XLsswWkxy2lRq2czAxksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rXYfDtczAP9Xozsr8zbhN6GwXOGIh4
TLSH
T1D5850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 02c44a318b9e2d79c5b031252ced146fa3788941a59a6d96424254e6066f762a
MD5 c5ed7698d5806646bccbec9a06f29bfb
SHA1 e1f58c3679ad51b4e490687a1abafb942b5b4ed7
SHA512 3961171ae9043fbba32aa90c042b35d9b37212e9e757c2644be50567ad3ad5dbd417aed05aaead51b937f263d6b1c827324b4b82ab644841fe5eda9d21f03c4d
SSDEEP 24576:30Le5ji0hmx3rM69Xozsr8zbhN6GwXOGIh4:3Pji0AhvXozsr8zlLwJIh
TLSH
T16EA5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c766246136aa39c1c8f006306b7db537a2b65459a679632af5ad463445d9fb3f
MD5 32b3a69b8f682bc64c2d09f1eab164a7
SHA1 433396cf94dfe41d0efc138d4de9d6d605c525f5
SHA512 c71f0c2a26ce565d348ac50973f77d5afd78dc045c8fa253d3cfec7a5ce53def30b8593d67181d8b30d656963ff053781da39d80675dcc9d20f2f8b3a9f45287
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWr6q8wyu09Xozsr8zbhN6GwXOGIh4:J/ezSC6vUzPviHjyzXozsr8zlLwJIh
TLSH
T1D6755C25F5788323D0B3D0BAC5D6BA99FE7230465B3089CB0246976C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fe571b33a983fa144ab752943c85def1e22ccdf2a059d4a007fd9476711d59df
MD5 069e718c6cbdfa443e371acade590db7
SHA1 62db1e81f0f20c109a6b7257a1de5a0ab655db55
SHA512 2d4f28a53530029797696055badeafab32f6f9df11b6232c4b6f30fd34d246e513a3c3ed570d9ba59a6b35f09a4f5e25e90221a01fbff5cee8779118180d2871
SSDEEP 24576:eVbqPb88hv/l+bb9Xozsr8zbhN6GwXOGIh4:eVO88hXl+9Xozsr8zlLwJIh
TLSH
T12055AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 dac0f6a8cd646cb2cf3fb1800e4c9d7477d66d5a2389b3650ac82a7a3152414a
MD5 dd3ca25e0bf1708ea319e2bf393fa191
SHA1 009ce7341b7a21221319084e5ce5d6cab8b58329
SHA512 a6b75641ebcdbf4e8c4de5a499d8e579510ee8f9586d2e96ba088a2ad8f3f7c15496449241a0a1faa15c94934ba7ee1723af09d9a0eda545573e78f45c5851a5
SSDEEP 12288:gRSksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:gR29Xozsr8zbhN6GwXOGIh4
TLSH
T1176523B7E691A442EF671F3139916AC4DEA3FD9E49C11B9112382186CC7E476FE21332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6ac557c366e78bfd8f37584562efa20d185f853e62a697f19b2ae63b9ce9d5e2
MD5 cb7223f5cae1d533877acfe53e38efc3
SHA1 9e706c8bcf77b419813556435e436f186e963155
SHA512 d26db5e9dd411c4384f1ffa38a2bca001b784ce907d7829ae4e09ce292accad320cb141b3861fbecfe830658d3954f0ce4e31522b7c025b4cc4569e0d76abd42
SSDEEP 12288:seBNUbTVO86UFksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:sJIUj9Xozsr8zbhN6GwXOGIh4
TLSH
T19A85CF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 11687a8a9375858a21cffe669a262af17881ac4ab26dc8e6710d5781c1cb3b64
MD5 bdbe42788469f75d5410e29208535216
SHA1 01f3aa5a0bf665b9b489b6606d4e2004e91e01f9
SHA512 60eb6bf2cdf3c771d2df1e7599751d325949a97d29a9ce56e52c151c29ee6fb3d774149e05d7c8ed8cebc942f6e1ad7f881a955c9be09631d87796b08a82cb91
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THW:xQvGAdlCEL8c/RRNw5CawFRKIh
TLSH
T192267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 25d0c4233e2eb9d4c6b4ec2e31b1be8a0c37e58dc57e3d7d4825ce1d67481b54
MD5 3b349f193729c4272f5812f072b958a5
SHA1 4f7456d8b590d3bcbd96d889cb71de97e61f2694
SHA512 87e664e1bf11943eabfef4844254ccd00d70da3490565987d67647d3f6df855db9629f3103049f28049f067fd0529282493b4cb07a2c364783d21d7f194bcee0
SSDEEP 12288:RAwSfxL/2Dc3VDLLmt0LDQewsAjPksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:y4ewsAjd9Xozsr8zbhN6GwXOGIh4
TLSH
T13D85E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8d3a4be18551a21e08766073f51194793f8e709240bb0f86fcda4198fe401e28
MD5 b4c1f67567801e69eac39feb1ed04b77
SHA1 08c231cdca6fb990724d3a018d4c7fce5ab44cab
SHA512 0d3ae25be34dfd1b92f5353cb5df2ab0809a74d3c181c7dcdbcc42d11c8b40e1fc16be75ccfff93224fde3eadcd16a84d87733d76a35460d515af5ea581986b1
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHgDKI:kUEtQevvqc2W1cpV2RI32gD
TLSH
T1B8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e027b6aa3d0e46b5461418bb65e46cffe702752d6b93930a687d8d65ec9074d2
MD5 7b9b1111111c936003ae27dfa6a2baa9
SHA1 0e9691df614f123a7234329a590438c5564eaac1
SHA512 04d0067ccbb45b681e9e278f3dc0dd3642a635ac388041f6102ea3c0dd6375193d92f1c35888833ffb2f7c10c225bdf6355f32bd4b29a28436e606e7359520bd
SSDEEP 49152:fCbRquA/m2yL5zifFiV+XenmE3/zfXozsr8zlLwJIh:4oqHVjnm+wFRKIh
TLSH
T1DFD58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3feb5d392a861cf3a323b7cee91b204f8920b11029e924548a7a3022b61ec444
MD5 ac6e5a3c1d41bec7017029f12ed9c2f9
SHA1 514ab8013e1e060b685f410ef1f562b96386a9f7
SHA512 8caf3142cd70ec3863937cc9d48c1534f0d929c59756678daaff612c2d987991768fcf6cb7102d6cb2a25bd5c1fa54bdd09d1130ef082c029a7e8801d47a85c9
SSDEEP 24576:NAhGL2IFoiwtA5l7S53o9Xozsr8zbhN6GwXOGIh4:NAM1Foiq5CXozsr8zlLwJIh
TLSH
T15F359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 094771b2bbe05d5d1fe18d3e3323b4b2721968897c690c22cc549b09f4edf6f0
MD5 a71902d61036f9c4400b901e4d5a54f2
SHA1 aa0de9346683a00fda0316fe02716ac2ee38cc28
SHA512 67bf92fb0c4ff3b12ca80d7b28da5b9cba330efd965571a1cc39920129d737252bad9fd837badceff97312f23fd46f790a5d2b0c6b6d239571dabdf34962b5ca
SSDEEP 12288:imw5HEjsChNkBFgl0WDm+C4ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:7wuVOWh9Xozsr8zbhN6GwXOGIh4
TLSH
T11985F14676A41CF9EAA786398597C535E7F3BC062A21CB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 9d28faf74d3f2d10945f424579bd48e10a2609066dd07e5392c69fa204269a43
MD5 4b1ce4a3018f9a434f340a993e088e16
SHA1 40e32122f52851f32f83882f2c917c8d72971633
SHA512 b01226cf24aafd7bd506b73e8f9e62cbf1d4301c7a1e3aa1c012db35c161c821ea6e801bb5b7bfbb0a58feff174abf56d0b768ad86ddb5baffea6c71bceee5d0
SSDEEP 12288:NZZ1IyfksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rZui9Xozsr8zbhN6GwXOGIh4
TLSH
T13A7512AB73E070F6E6A3473898E15A44D7B3B856577203CF123802965E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 212a08994d43b775eec2d9675c32adbc5694b10a06b055c05c6cc950bbcd480a
MD5 898bc9735eae09c98c79306710a87bb1
SHA1 b0a62b42faceeaf526b0930fc2ef4259659677ad
SHA512 897e828012478736ac36645f96bbf3c78dd630669514f343a5115583862b0192175ee4fb4253a33e66d5013860cdde61a7bc141ee394ba5f461a239c0dcbf5c6
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23US:KQRQyi36YOcPhLvw2gAf+PN3xwFRKIh
TLSH
T170667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c86dcfbc322c676391c309d2dcd9aed67cdad0efcdf877cb2a9fb266324f25f1
MD5 2bf1683b73e67dbfda3c09e60dc42cfa
SHA1 403dd605e44c5e712224b80da02b2062ca705655
SHA512 115def2ffe782e2aa8651dcbfce3f2e6b85cf3b5fd58b04a87d802c948a719077631f9b422159c6f34892cb25d0e21c3d1609a28f8109331687612014199c718
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23US:OQRQyi36YOcPhLvw2gAf+PN3xwFRKIh
TLSH
T183667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7ae66cc55c82f13eb7b06b4c8edc960fdd67c324edd098d80e24708c26f3b4e5
MD5 5ba1095d94589a875cfc7cf658c40b06
SHA1 b41815a16dc64da1b4f187979a6a49da2aff3893
SHA512 a843df679e7c9ef5d18be222cd87a8b3a770f381e351dd3bfcd2cbc1b71111b5b2a8f2f219c1d79cae4f523e425b0d6dc9c646ca1410e9a3fdaadde0cbf0167f
SSDEEP 49152:t68Qg55nhceWu7PNU3/vXozsr8zlLwJIh:rthLRc/vwFRKIh
TLSH
T101B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 11b666b996c9a5f5cfae8a9e46b3d0b37b6a13d502508a65f767984b6f252fa6
MD5 cf2885d61a8ed3d401eca89c461fb4c6
SHA1 0c41a99b49145bb50cc7aba591c48fdd4e89f2ce
SHA512 05948d8b0ce8dfed645b889abd2b4c89e5b3acd50d3030d825efa9da2523562215ba7b3b4f2b6317eeed75d61bc1a6c05b5bfd86b0ee8e90a1565985e385f3a7
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99:ly5112gYy5azzVva69nLKnhZUwFRKIh
TLSH
T178167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c872a9cac3c274f3e89524e0d859aeef1d797b6b94ca95a9fb234956f44932fa
MD5 58544bc6bce401251d97b1746f631360
SHA1 c8d74c938054ec7b0bbc0ecb88ea3a40c4d668f3
SHA512 57d83934eec9bc94d65bee314a158b39bbc2b5eca5b0b5844e5df6e4868640efc81f262d6cebcb2fd0db7d2717e589deca7fd34fe5c4f29c5b9ce51e5a0ced04
SSDEEP 49152:tB+taZ3usBWOBr4tEG20bqx0z+n217aau1glPXozsr8zlLwJIh:zu6JmUxd2dPwFRKIh
TLSH
T161D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ef836ebe4a3202d9f7c09674fba6d2e04615e114836d251de0dbeba606879da2
MD5 7f40d2f803264e10fe0bddcd81ef3483
SHA1 60a7fa2b10fa08c69cf3bfabdf8c7b09620b2cbc
SHA512 733908458b92e2490528f67665dc6aa4bb3a2a5c059816c65b3d87009d0e09a74aa54535b289defa70b134705ce18ddf12c680e526707ad56015dfaafdae8aa5
SSDEEP 49152:y1hpsNoJpF1A6BU44CwH7R4xpXozsr8zlLwJIh:ymifPkR+wFRKIh
TLSH
T106B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3d14c9108ff33807c89da7d3caec9c321cf3b1cc97ace8441701d0e027865b68
MD5 3692086cf28575fc347f4899f97b8022
SHA1 671a44d13ab29dc86de7a31eb70845a6e89e88a0
SHA512 7c630f3aa8ce3d5488a224cf8d894b5dc522605ff32dab6ae6d09c2c1ca68cba8dfda0532b79b250fb5e46a29e1ddbe5457596f31536a2a976899fef707d84b9
SSDEEP 49152:HSuZQIY0Be2KNRVtOnks6NMHqwXozsr8zlLwJIh:d5dKvi61QwFRKIh
TLSH
T12CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f1404bab9201234dbcffcd138de760d31c3d639b2426ac0f5dd5d31c30d253f3
MD5 c76ce5e44ae7a47854846dfc6d95c8f8
SHA1 fe55401b520667fc1559bae828224cd06eb50dca
SHA512 06f2846d65779ea5e93fdd63c1556cebbd6c7b1781b1fa704d4b84b555d8d79eab960e1049d75afe35c9691a94b63d0456cfa7283c807429aa79ddeee9b87111
SSDEEP 49152:6htSn8EApI0figXgiDn0AP5wVXozsr8zlLwJIh:7X2iyphSwFRKIh
TLSH
T16D95BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 d794e15f7bfe38a97236e70a8b3b47a18c93ce579d49cb9ca490ee2231598414
MD5 1162a236b616d6bd019f00eeda14d31a
SHA1 148ceef464e2b80d0962e5237bdedb03e8597047
SHA512 33d5ba309bdfd91ac12d7a2ff01fdddd4174ee6abdc5dc2ee2997b3543fa358c2cb5a0f2d4db348ae046b16603d38952382d4a142f1ebcf927743cc3cd061330
SSDEEP 12288:ZqksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Z+9Xozsr8zbhN6GwXOGIh4
TLSH
T1B16523B7F992A442FB575F3129811AC4CAA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 bdcbc519cc194207c531e57553bda496f97d06d0a0d17205be9c6c010e038c66
MD5 3ee7f08bb5288accda402a8e84ac9700
SHA1 a5106d8f0cfe7077be3de27d531fa5236c85cf9b
SHA512 14ea740ee3bb4765ff6608ee9ab2194eb348a2d0ed950a8c1f346f7aad1411803557b1497104baa5af2995780ba16f0082fbb60ab75d6cd8fe3704153b38a52a
SSDEEP 12288:CLksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:CZ9Xozsr8zbhN6GwXOGIh4
TLSH
T1E46523B7F992A442EB575B3129811AC4CEA7FD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 2506d11384ff115bf91197444d070014fa3e17ba5ea038bbe65ea32a35be2200
MD5 c5e57ccb42bbe29a943e53ac9c7f3ccf
SHA1 a15284a40435616b7dac13cd4730a10021599c61
SHA512 b8dae5d8cdb55c6718b85e611f41e9149b4facbdf7f8ee15b2f1d3dda2d262e6d968946ca30868b9845c35ab07a926eaacaf05f99d1ec9061ab139d3e03d0123
SSDEEP 12288:KdksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:KL9Xozsr8zbhN6GwXOGIh4
TLSH
T1B06523B7F9A2A442EB575F3129811AC4CDA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 5575b2d6790d5db037bcb40a588503f7ae9bdc3dfb034d03749849ba8b8dad34
MD5 1e381f4e71dc7ac67c04c9231008f86f
SHA1 eb3cc7434d90a4aafd5a53f753e52bd286c8577c
SHA512 e2cc32d14c85e06b75b062cebe347f65e13daefd2f72f44e155e755475fb124381445666a58488665053de835166251175e0f4407a1bf1d0d9b79d8a594578c1
SSDEEP 12288:cVMksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:v9Xozsr8zbhN6GwXOGIh4
TLSH
T1AD6523A7F7A550C2EE679B3198915680DAF3FC9E9B5207DB233800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 1d117be7dbce194a7ba03bb423ebf4cd76bc99054a8c2655fd3cc7bd530998c8
MD5 4af29430667125c4049a691a4b062524
SHA1 8e8f0bc2c4b87d8758650decb2e7d4d7e8c1b737
SHA512 561cf43736f3ed0718f59dcd4d89ee28f4e3527f6b6d0e1f28f3d7d03652e23c88d11a042a9cd34ffe1411c2a6b79081e83486fb8011d5e3df50c4ed662f5e6d
SSDEEP 12288:jUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:jA9Xozsr8zbhN6GwXOGIh4
TLSH
T1346523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 5ad5858e9b488c6a75528b3b653721905f97158dae391adb80ea5c80b9c8861c
MD5 9fed5ffed2d36fed35e6d683f18550f6
SHA1 7bdc00dcecd90daf7c71b4c9a132cce6ec462cec
SHA512 daa05973cd14abb0a7f5b9b6517c714a23949224bb825063437b0f03d5cbc11d65abdd99314f3185f5048ec755dba3755b34e6a434e64601dd1a40884611d5f1
SSDEEP 12288:onksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:oF9Xozsr8zbhN6GwXOGIh4
TLSH
T1426523F7F992A442EB575B3129811AC4CEA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 83aebeb5909d87fb68a20c08dba615f604b094fe302de745b4a44061b1525359
MD5 6d63bbc0f464261fb9d058b063f82e93
SHA1 1951f2f102dcc9ab6a6e81a1570c82c1d7dc3b6e
SHA512 cd882f0dabbf715d23a165e33b6a656c54572c15ed6193338ddea640a32617d2c22c1e53a3e12c4d9d2351118188216976144f71202f5ddd38c61b75bec263c2
SSDEEP 12288:rTksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rR9Xozsr8zbhN6GwXOGIh4
TLSH
T17E6523B7F992A442FB575B3129815AC4CEA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 dd860c0bc19ac3a65a107f642b6d62bc479f76df81c342ad070c9ffeb087de97
MD5 64c1c3586969c13265e7840503dacb7f
SHA1 627c8eff08851a639c18dcbf8c20efc5176c3545
SHA512 959830a6c743c2f1b29ba53f99d44c93fb0be8dc025076faa40f6e86170a5e1c9d0482ccb9661196d368487201dec5fe5cc84104b423beb91d3b298bd9024d35
SSDEEP 12288:riZwbWzzFEoS2cPvyrksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:WZMWzFVSO59Xozsr8zbhN6GwXOGIh4
TLSH
T1D58501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 c8a0fb3fa2a94ea285ae1b37c5773f844d31d62d08a03849b730dfc65c110952
MD5 883f49ebb938e7d73bb6ebecb2648b4a
SHA1 640cf1c1efd277eacf09031ce54f1fc12e29cc6d
SHA512 8367fb29f9ba59bbb83042047f719d3e7f71f8fcc91f3caad2cf30caeb2f64c6f995d3da262c28aa02cae50be6ec15c4fc84f5fc7e371f7d0e9b85e421476fac
SSDEEP 12288:X+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Xy9Xozsr8zbhN6GwXOGIh4
TLSH
T1B06523F7F992A442FB571B3129811AC4CEA7BD9FA9C21791323D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 4dbe88514d6c2d714af368e3a51ca7180259cbdf9b3d0ba3e05a45a4c448b069
MD5 c32a3d7824e44819711c5b986b1fde57
SHA1 e7e984744195a2e67594e3c14e57a9154984b955
SHA512 e43bdb0d9ab415e981cc835d251c7863dec01e37bc312732b25cff0a7674febbac5b4ee83cb3a1a9b3654408e6444816c16b80e9cd3bbb06406b0d07d4c36dbc
SSDEEP 12288:FiksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:FG9Xozsr8zbhN6GwXOGIh4
TLSH
T1E96523B7F992A442EB575B3129801AC4CEA7FD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 94287e9254b4eef0bacacb0347b2b78741e6047737a8dbe85eeafece60ce014a
MD5 947e2a2471395d1d0f6af2e46ba793ee
SHA1 6d8e1981992abd346ec846044fe2e3c6ffb68e1b
SHA512 d659c023252379a002b9ac1592ed32f31291ba1a3f4dc921dacf52538e325fa77a1d4511e6d6269afffadb29b5c7cb476048286c55b927ec9f66077a828876a1
SSDEEP 12288:MyPz5L8fksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Vzyt9Xozsr8zbhN6GwXOGIh4
TLSH
T136751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 e776675320b9d755c587e66553b4387c931e97605d92902cd27aac8b31fd2c66
MD5 25475de6e389e763285a061e62f1ba34
SHA1 39b9c8a0b3ca477cd764e47290761b40f474958f
SHA512 a3363b2ccb1063d63932472754a9f952bc7bda57cbbdab95547455af1cdaf63f2834b4937ae09197c3202a37fbccaab4c1d7cbc8d4de48a474dc0d689cc79cc3
SSDEEP 12288:x+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:xy9Xozsr8zbhN6GwXOGIh4
TLSH
T1E66523B7F992A442EB575B3129811AC4CEA7BD9FA9C207D1333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 8ebbc6a71b159e4843642c8b1d806865b98f61643af6be3f0ac515f3f8aa1a99
MD5 1f4d11597ec72b95b5d0ef2c620a1eb6
SHA1 637702f6cd8232630e3b762e0115b298007cc4b5
SHA512 18cb501f4564e31990730a0edddd419930597f1590aac7b5fd1c9db992e632f6518c43ec183b703943d6312b00170c25a427e8e474cd9f50f3012898ab1526f6
SSDEEP 12288:Z+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Zy9Xozsr8zbhN6GwXOGIh4
TLSH
T19B6523F7F9A2A442EB575B3129811AC4CDA7BD9FA9C217D1323D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 8c2959960e80f18f000e55ea6cc4693268a1f2cec5ac22f69abda5867c797749
MD5 9d5a1a149a361bd50d1a4f7e8cdd978e
SHA1 a84e2def626b6728b9c6443109790ec9c53005ac
SHA512 0165b3c6dd36057f8343aa3acbc5911bd10cca6e57289f3f6f7408d3320017fe580b4c760cbaafc62d851bdfa7240c4ce7481ae8bd26c9ae36138cd6afd1ada4
SSDEEP 12288:uyPz5L8fksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:zzyt9Xozsr8zbhN6GwXOGIh4
TLSH
T1CA751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 90ee9a71308ff4c789994f7170a29e170720abc5c27f4d0c6298f72e0f217e75
MD5 108dba096756494fa6b0bb3d4c6c9052
SHA1 5332e767c423ab5072eadcefef50fc11688355b8
SHA512 8f0c5e9c5770595d8c551cf31a13aa0031b12d3f584b716ffe5837bd1af64a9e9d8db4dd630dedc831684f1fd4dbd7c62f5d6b5a44c0d3cd94572c587b0cc9d6
SSDEEP 24576:WTHaLl3z0zD79Xozsr8zbhN6GwXOGIh4:WT6LljuXozsr8zlLwJIh
TLSH
T1D68501A5B39018F4ED67823EC8518945D6B2BC5A0BA0C75F13B832675F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 fb0daa212e0cbbe41662436cee94e4dab4db403acf649f7948e15501b2047160
MD5 2da17e5924023e0576bec75e0d8f5979
SHA1 7514868acced161207de6e2f9113f8f9333f4f35
SHA512 c27d86fa183ad3874620fb35a3dfb5c31dd0ca0c7579d3bebb444edf367f971974d77eeb9fad448d8137d6ec64fe6f1015b39809460dda10b1930a126b6e0b80
SSDEEP 24576:i3Ld9CHKy7GZX9Xozsr8zbhN6GwXOGIh4:ELd9CHKyanXozsr8zlLwJIh
TLSH
T1AA95CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 6ea0031b2cadc813708b4a792eaf031ebd8fc0f3138851cbf7c5448e37e782d3
MD5 c7f14c9f3f4e22dfedb6a6a474dbd276
SHA1 937a9b573fa1ee030a2c240988e68bcfd3908029
SHA512 2870b99476fe4b4992c0039703f73ba49449cc0e726740a2470f3e3ae409e4d5a6f740cf4365dccd16bd35032bc03d7681982712720b4cf243c5bcf25493f09f
SSDEEP 12288:19ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:1r9Xozsr8zbhN6GwXOGIh4
TLSH
T1296523B7F9A2A442EB575F3129811AC4CDA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 8045555552f30baa856759b988106b05f6cfde249dab8268201444310cbfc5a6
MD5 eb8cfacd048b1e584a40072acd718700
SHA1 68b9971230eea9dd0dfe9e88eb1a9e586e90d095
SHA512 c91bf58a1e02cf8b7e12dc248907885b08c14b3a4e3e4ef5f36a4d5de3cc691ffa3cfdfb6ebe37dd339944b77f1afcc8be0b0c72750d056cc676d952911edcc3
SSDEEP 12288:7/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:7N9Xozsr8zbhN6GwXOGIh4
TLSH
T1756523B7F9A1A442FB575B3129815BC4CEA7BD9FA9820791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 7eb03b18ed8a38834b2b977fa10b274eee8feaee920dc389fafb21604d9a73eb
MD5 b362f120fb4d7aea372184acb89a9586
SHA1 74c473346a80e628f1969bb66cab520201ddf63d
SHA512 a78855489977513b9f0c17dbe32acaf741e2167fe21fe51ba3b6ee8e98782a93127a1e60be70f1f78e208b6371b123745594e01a0e86c0886192b94ca2a95f2c
SSDEEP 12288:5AksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:5s9Xozsr8zbhN6GwXOGIh4
TLSH
T1B86523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 b9e7291bbb1e7f452a395c2bb773365e292f5c882934f6a33886497fc68423aa
MD5 049195ad7c836470866731650552bc3c
SHA1 94a8f0a74e8d104f838dcced22748bd4507f2e0e
SHA512 6200bf947a30a02b8284b501e45d1c3c406b9b723873d5420effb299a3a37558121e17fb47cce67c6cef80df83f4da4fb9d5d01b492d9b04675e8bd0a1a19c29
SSDEEP 12288:G+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Gy9Xozsr8zbhN6GwXOGIh4
TLSH
T1A66523B7F992A442EB575B3129811AC4CEA7BD9FA9C20791323D1045DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 a243a71a203ce590d41b5c6b9d1625c72a5d1c616fdb3b77a9e18680b53f634b
MD5 b70ffff537abaa8759f722335cda073e
SHA1 1c0a15323a3bdec94048f5379db9e23cbcab92be
SHA512 1140f1f7bb8a7284925eff45edd0fe09ec590dd89ac951df1ac6388bb35e33f1a962affed1fa4b76d5546dfe1bbc63830967e77df9192ca065748b1e45dcfea7
SSDEEP 12288:39ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3r9Xozsr8zbhN6GwXOGIh4
TLSH
T1876523B7F9A2A442EB575F3129811AC4CDA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 7e308b803e5e4c8a41c25846fef8c9b277eabd950372e5c640c9c8cdde703e15
MD5 05722641876109b1af91142d8e4818fd
SHA1 56624a8c64c1f2f278d110550b93d4dc5f5d4db0
SHA512 dbd659b7f1ec8a3f16b13f154b2a7978ea57b4d92ed83e54ceaceabb589e975553af63924c311d2863d3fad8a9631e0a690134062c5eb340c21a3c72bfbeba94
SSDEEP 12288:sGksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:sq9Xozsr8zbhN6GwXOGIh4
TLSH
T1966523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C30791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 0487389cef2b54a0dcc013a43e24a91b82c8f97edb390048114458722c972f3a
MD5 b584ed526b6872b517f5a5e13e70977f
SHA1 dc6b863998320a5e0d0fcccababe64ba744a6aed
SHA512 aded9e3ecdc05fcbfe57d361813ef6f055ebf6b494f4efdec5d481bf82618793688eddfd2001b8dff6c97cd3b57ba889682ac5b549b42cb441d479fbb634d932
SSDEEP 24576:0fwv7k9RX6wkyAIW9Xozsr8zbhN6GwXOGIh4:nMnYIkXozsr8zlLwJIh
TLSH
T1FB95D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4640aecaacdb22f0c2b8c77c5bb568a9526e83b0ef1c7bfdb1da63156dfe9702
MD5 ebb90a0dd04e058511896f59de151a92
SHA1 6ca692fb44dc4a7ea4dabba44ac00f0b17b26570
SHA512 8790dd2169061020ae0aa453324b6dd6dca2c1e41d6e36d910e3035887ca75c349516c7ee6bfdec789624624adfe84259c0d9bd3ff3820ef47515a2db40bda0a
SSDEEP 49152:IYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01Xozsr8zlLwJs:QySzPRwFRKIh
TLSH
T15C066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c552ef3bf6d9cd3436f0b3679c25cc11bbdc37c2bd612b8f287d6f60c031fbaa
MD5 406bf1b609eaf97027c2a542d40e3ec6
SHA1 271f9e34c1756682ec5385917f5bf636f1abd045
SHA512 49d254da2ce7b5d31f0d580040ede46306e56700927e644d9e0954f88a09ed7ff78c38203f2c0ab8732a7d5cce266996257c4d007146d94fabf63819ad3cf707
SSDEEP 24576:247Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYJ9Xozsr8zbhN6GwXOGIh4:247JUQj4irIhCnDHUPfF/FXozsr8zlLT
TLSH
T13865AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 319d948cff0921dc26359deaec8c712a1fde155afe497ddef71f63735742d6ed
MD5 353e49d41ed036ca0f167a52c382f840
SHA1 7aa3e382047433fa6cd0cd7b4a19c5e9f82ccc13
SHA512 9aaf3369b15a2a30b124b97e4ac7e97da397188a3e2d07737d8b1295d4fc8325ffd7661ef3ba21037f0a6ae5f57f827ecef6f84ab034c875c02c6fd1265fafaf
SSDEEP 12288:nQsfuksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Xi9Xozsr8zbhN6GwXOGIh4
TLSH
T18275F15AE29411D5D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A6A0AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c03090f3baadd95b3b0ca91b53ee7eb2d198ea9b19309bb4f08d5b462479d3c5
MD5 8fd05af8becc58dc314d1dcc9d4cc932
SHA1 514fee03b3e859c36f66fca96e30e1903e7e21b5
SHA512 a8431368ad7c2822846fd2c74d4353ff6ae407933120a8b16a08b96af8a922330e94b98d66351539f0f93399e6d018ef6c0c466affc79f759e29d68afd55ad75
SSDEEP 12288:31N11cQyU3f5hMu4FJsh3j6b5rnJ850MBaRMHs00:31j1tyUPMQK5N85vBaRMHr0
TLSH
T1FF351841766AC75FC6A940325E72D2CCAB707C05EE456F0373C8873FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 1fffeee499f3383f568f0ed97bb131e1f75d6c700c86da3da0cbf81d4e804a99
MD5 64080632e88a77fc422c87fd3b76b8df
SHA1 2c3b882ac088f6bb7457c3800d597a0879cb2a7a
SHA512 64bee561fe5f45357a4f492da86cc3e96e38557f7f2d3a0a06194c2c497a14334bf78bb75692a8ec0784cfe8827dcf6c72f2ea42a622e689d1851b25eab9781b
SSDEEP 12288:WNcaj9ovueUIkw9EuquBZcWDtWDapXBR8lnz4MvaGd2Ns3UTTU5cEpBnBK5fwLAY:WNcaeF9WK5YL0Hl+
TLSH
T1D375E881613B938FC1FB607203355B8DB7A4AC1677056F23B3C8493AD86AA15B5BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 edf3200ff51384f0ca26bd44c8980fbae21177e0ae7b1114c05d49fe90b06c1d
MD5 006f19325d1b53c85b3692e709144273
SHA1 70f769b7850f08722a375af64f9fb04fbb07a450
SHA512 4aab220f80a604cb2452b1e2e0cb374811712e3fd60e6fe5ad90e9a5d38056285f19a6e484adb929bcea22d4e0323fea385c596da34ef0c8282d6ba5f0dedd31
SSDEEP 12288:0d72ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ea9Xozsr8zbhN6GwXOGIh4
TLSH
T1AA6523B7F795A802FE7B5B30288556549A5BFD9E4F8107C332281186DC7A8E5BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c48a16a496c5837e3b549fe9c1770c3cdbf84c1276dad72017b4bfd9de5d6504
MD5 d6a71ee63e9670c70b5aa66c293a906c
SHA1 09134bdc2a41ba015426c085cc90f4fe1b7b30e3
SHA512 853c42b802a98c9dcdf3136dd9d3aafee60850feb3e4821bec6d8da9db5d888904bc0ba6a3e69e225e73718441f5ccfae9dd9a3708a814a5e13c9975fa374e13
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bY09Xozsr8zbhN6GwXOGIh4:Sgb4mBIBhGFrXozsr8zlLwJIh
TLSH
T1AA65AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 93e290bf33d77101d0070bf19c99889fd7897de7d167c5c3ba8e1ae20279321a
MD5 7f2cb12fb550a6ecd8c5b45cb98ddd1a
SHA1 ddb7ece16a671045897c5f85db323c9f3f0279d6
SHA512 e3b3c325e1f50bdbba822fb48c6424fca5b60e79082363c999a8d00f4735537addc33af91aff2d1619614bfdf3806232d77a0965ac9af1ba3b5ec0e4b3ad44a3
SSDEEP 24576:iG88u8FpJqH1czria7/m59Xozsr8zbhN6GwXOGIh4:57ZFPqV7a7/2Xozsr8zlLwJIh
TLSH
T1D6A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5060d3c0f721ae7e21371fd05fa6b481ccc0984d122fb03f602dad2f359395ad
MD5 8d827d250fb6f90f4673afb20a6154b5
SHA1 73fb1d57e76f7e17b5e641c43b2791a7271da6c0
SHA512 50fe9351778eb320206550e8014acc4f9e0f407af5991af31a0b5a8f5e361b10aa4864985652d9c50d823de9f40b611fa2564b5f886e03e6d28474ac2b24d932
SSDEEP 12288:gHvUrBFrEjwaQ3ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:gPUr+NQV9Xozsr8zbhN6GwXOGIh4
TLSH
T1CD85F26F72E918D5E677A13D89824709E772B866071293CF02A0817E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 05a26bfac152fa61f725e673a62da174ce4b066592c1c95374017a53c075fb43
MD5 665d3fbec5c4a6456ac282962927a291
SHA1 a68998fe710f4e2ed91ee19b09e0815cd0777de8
SHA512 5836752d36d5ee215afb915a73e27453dbc3aa187310dc74c6c072e775b9f51fe8d52b49c5d26bd7c6bcc283ea5faac587c268d5749615738b9547966465a680
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXXozsr8zlLwJIh:sG05lO43bMwFRKIh
TLSH
T18DD5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f543ba6d0447e1fd3160bb99806c576d90cd9bd263be7b67a7e9dd96dd4a322c
MD5 69cff61fa4ee4057eb3c16d90d392818
SHA1 aeebacdae56583cc3c12e009c0e0367416d1da36
SHA512 c8635d435b0bc027f2139966c65f9001964640e86a085bce179f26bec8fdb5b6f7af219b41378939ffbd6a6ff16557ce3650a5cd3eeb1f9c5f0b56ff6ac9eb71
SSDEEP 24576:qfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnv9Xozsr8zbhN6GwXOGIh4:ia5POZ39Jt2pasx2+mvXozsr8zlLwJIh
TLSH
T16965BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ea7415c1b33d6970c0d0da160f71703e536dd03e50dc16a7e80929e6f5d8179e
MD5 f6f4161c42511152955cde51e1d4c8ea
SHA1 a206a65a8df441f5f7213131e58384c702ebd60a
SHA512 0afd44c5c23481d49ec3b85aaff54c894973384f4e70798193fcf1faa8844e3fc8ba66750b5ea74c2f6685b5ccef4416bbee67b3de6ae31d37ba448907ca5024
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkB9Xozsr8zbhN6GwXOGIh4:zNc/zEOVHFWXozsr8zlLwJIh
TLSH
T1FC858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c4e209474652a540d8e3a726f552bc8175c1254144d8242ea0f7f26fda2d9a2f
MD5 a20bdea8dcbf26e28799f9ae4a99fdf5
SHA1 fb535f802ef004fb1171a4dbc86ec5bd6c464d6f
SHA512 6b44b5ad4350c92e84eaf6044c5e82de1f60ec027b592237b32cf0751c49e378eaee14d88f58f8fb90c39298f53d68ed5ffe60e5b6ee4c60709bbceaa18f1216
SSDEEP 24576:ZtkNvNnaFeYhJNtmZBmJ9Xozsr8zbhN6GwXOGIh4:ZtMwBtOmrXozsr8zlLwJIh
TLSH
T1D055AF6EBAB845E4D1FEC6B48D238512EA727861073253CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 8706cb4b9c2a82aec5bed8925c633cb8a54d97d3e6f809cf3be77bc27c7c3e6d
MD5 ae4c61a630981ef0159f4191d4237de2
SHA1 cdd8cfbb011e451a66107e0c7a45d176eba32de8
SHA512 bafa70bad376c0e306e3b1bc6616bfcde43f46f38c3bc4dc2f07f237645367bef7899e5b29aa2a0e518d48289dac37169c276c9991dd991e313d37f1ed90ea95
SSDEEP 24576:1D3FHshBIYQgAe9Xozsr8zbhN6GwXOGIh4:1DVHeBIAA8Xozsr8zlLwJIh
TLSH
T13095E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-233-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1540-60-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1540-67-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1540-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1556-101-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1556-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1556-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1556-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1556-332-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1556-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2108-140-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2108-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2108-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2108-138-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2108-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2240-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2240-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2240-83-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2240-23-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2240-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2668-44-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2668-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2668-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2668-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2668-58-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3496-84-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3496-90-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/3496-314-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3496-85-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/3556-79-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3556-74-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3556-284-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3556-71-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4448-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4448-32-0x0000000140000000-0x0000000140361000-memory.dmp

Download

memory/4448-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4448-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4448-119-0x0000000140000000-0x0000000140361000-memory.dmp

Download

memory/4456-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4456-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4456-155-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4456-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4592-113-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4592-107-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4592-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4592-318-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4592-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4592-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4812-28-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4812-2-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4812-8-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4812-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4812-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5096-317-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5096-120-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5096-127-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5096-121-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download