fca93ce8b4330ecc24880b81e2725fe2059010c860a2e1ee4bc99259bf31c4a4

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Size 12.3MB
Sample260802-thmecswdqc
SHA256 fca93ce8b4330ecc24880b81e2725fe2059010c860a2e1ee4bc99259bf31c4a4
MD5 fca30c0ff008b5501b4ab35cc94f8354
SHA1 6622e9b888c112c6cdbb2cde81156b9474990dc2
SHA512 fdce804f4b2b51012993e0d3e9554eaaa6ac5bf5a27bf340cf9c7c26a5f2dcc707f4944f22b4cb29c8f53652c5c3879478b62513bfcf16913bd3e68fb82f028b
SSDEEP 196608:zhr1I2WcqSjj7UlG8drCeqBvKCzcLgmnyRtU:zhr1tqSP7UlZdrWlDzcLTnw
TLSH
T197D65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4152	elevation_service.exe
1052	elevation_service.exe
2320	maintenanceservice.exe
2152	OSE.EXE
2572	PerceptionSimulationService.exe
1184	perfhost.exe
2728	ReFsDedupSvc.exe
4768	SensorDataService.exe
692	ssh-agent.exe
1668	AgentService.exe
2980	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fbf2c040e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004e5ded8f9822dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca7ccfcc9822dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027c2edcc9822dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000256e788b9822dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ede7f8b9822dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4668	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	4152	elevation_service.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1668	AgentService.exe
Token: 33	2980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2980	SearchIndexer.exe
Token: SeDebugPrivilege	4152	elevation_service.exe
Token: SeDebugPrivilege	1052	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4668	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4668	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 5836	4668	2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe	90
PID 2980 wrote to memory of 5776	2980	SearchIndexer.exe	101
PID 2980 wrote to memory of 3856	2980	SearchIndexer.exe	102
PID 2980 wrote to memory of 5024	2980	SearchIndexer.exe	103
PID 2980 wrote to memory of 3424	2980	SearchIndexer.exe	104
PID 2980 wrote to memory of 1224	2980	SearchIndexer.exe	106
PID 2980 wrote to memory of 3188	2980	SearchIndexer.exe	107
PID 2980 wrote to memory of 6116	2980	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_fca30c0ff008b5501b4ab35cc94f8354_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe" --type=collab-renderer --proc=4668
  2⤵
  PID:5836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2152

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:692

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1d26941d1d1af598a1fcb82d50186404e54a40331c8944047deab50e37661e69
MD5 251f8e4c11f47284a77ccba53c985911
SHA1 b3e0532cf144f7d40a401d7b8efb93fb42247752
SHA512 69a52e7f85cb123f17200434a1838c25e7cf64add741b083b538e24e17ac3ec5607ce65ae0d1e42513b967a2fd205795c684a0950bb41d78034899d969c6e324
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLmni/RztxawSaUI:u3q6HjBamni/RZx/SaUI
TLSH
T106D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a1106e5742ae31b13babe74c2c4b61136cd7f0390e8ba08cfc2e92bbe2c74edb
MD5 22055f14ba333450f78dd42a6a31a630
SHA1 f8b4d76efa6d9cb629ddc60ca804fe4d0be97479
SHA512 4d2b3695f514e565e0b1df7935fac579ef6adadc774369279f5234c0bd1d5ac4281e0fa6faa831e7856d60fcf286b25169d370260c0b8f3184df900e002a0a66
SSDEEP 24576:EXYfDtczApDi/nPaAi/Rztx6CUCNSeJbgI:jtcOmni/RztxawSaUI
TLSH
T13D05F129B7E408F9EC67827DC8A28516E6337C5647A0E7CB03A495251F337D85E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 94ac10baa6fab68e3eb1f831796675d50efd5b1760e99a65e8aed2b93655ee37
MD5 cd826b0cb3c3c13ab6dcea41bb668c63
SHA1 f605051ceee8130c94cbc57eb443f95c417dd328
SHA512 ebd61687bd6a0a12b68cefdd4b575d1ad5860a02a1e79afbfb599fb1f0f3de8eff150aa01e1614d461a80a5e8cd6acc5580f101e573a60ead923977809d354cd
SSDEEP 24576:w0Le5ji0hmxirMwDi/nPaAi/Rztx6CUCNSeJbgI:wPji0Acrmni/RztxawSaUI
TLSH
T19C35AE16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 62e534409c102e2e78e488ed305345edcd1c31a08f6fafdba04907c06075d8c7
MD5 86b8b47ae80af6c5022b07f45723d075
SHA1 3c53a1ea65d7d8ec45bc6a0020f645d15022a06b
SHA512 e1c907493eb7618e0894f39ca4568aeb197c979a060b50a4459d7a465233fdf68989fdb52355ddaf40706d481d4343546e10738c366e899f9c35f43c14d24ced
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyueDi/nPaAi/Rztx6CUCNSeJbgI:8/ezSC6vUzPvxHjyXmni/RztxawSaUI
TLSH
T135755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e640cdebcbc705f0a13a2f58377730e2dda02402f53748b8a66e595fe23b4b4
MD5 ddc2d25a35e877067a30c8689e2be929
SHA1 352042611fd1b09894d947fd9de6c4e733eb4b0b
SHA512 54a8dfc4d27ee7e54208fc9e48470f2215851b3a4f0a4a195238c666ec9b47c73ad0f529cf15de7eecca633a3b0c2ebb772cfbbad2f8a75b198f96ad104984f8
SSDEEP 24576:bVbqPb88hv/l+6dDi/nPaAi/Rztx6CUCNSeJbgI:bVO88hXl+cmni/RztxawSaUI
TLSH
T16A559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0ea7a1103c664c6c33b7f846f2e9eb28ff6c51fcf934730d37986d8a3a621acd
MD5 d96bf9947167facd6aeeaa0925a11da4
SHA1 4a17c6bbd52fd4c01fdc1751c1419ae59c23387e
SHA512 bc5164c696235e3f4272bd31860e14b2e2cb719398e871722853356843341c13a906c6d9c2c5a900f7118a9c85fb40e733002577bf021d4195d5da16989705b3
SSDEEP 12288:fRkDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:fRkDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T165C4235FDBBC48F7FE61DAFE881BA4EB002A5C774DA11A5F0E39B2054E30969E1C1950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 50164a305cb4b58164b02bb768f24029d8d71c30c7d8b6e1a9c2985631838cbd
MD5 04729e01d2691a676b67b6ea8d56731d
SHA1 9f4dcb71cb6d4a745050dfdb207cbe65e0143473
SHA512 98ae2f8f7e5bee097cc8c5bfa36854f3049b923f173eb8e6f9ed439ac9cf8d4fa3940a5a97c42cdaf12fe7875224f54c6a544b08fad0078b71c0d5077bd6ab48
SSDEEP 12288:UeBNUbTVO86UVDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:UJIUVDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T12D05CF3BEE38FCE2C67A8DB95A518640977278314F62A3CBD175820EDE235E05E75C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9b2b309693d0f4bec06c34295acd8f90aa50c4e62f39e1926a36d5e37b8df88a
MD5 fe642ce27c213ec769dac059bf7f7a44
SHA1 ff43a299b64e0f0f7e4ac6b309a4bea3e302fcfe
SHA512 a44f7099964eb1fb6d657394c479cb290fe38e9f25fd1b8a8e025e476fc8a41afe0c5aefd7be62260fcda281479b07655bb15fb34ba83e82f16ac34b03c25e84
SSDEEP 98304:uQvGAdlCEL8c/yRNw5Cumni/RZx/SaUI:/vyEYc/y3w8umnyRtU
TLSH
T164266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8696a3c7d887f7e5e6424787d587e9dc5a56449a4065fe4a31a83fc1c7a8903a
MD5 a83ec5bcc8e6a10a7d83cc20e0b11750
SHA1 f9f9122235858bd5541204e6c54ce3ad07f8083a
SHA512 33990c121d37da2b08c8d4ed40eb6d00faa49eca66629cf04dbb13a5d07cf4981b4b190248e7ed4e4252740a953557530f583cb409e13114b4bc586dc10bd27c
SSDEEP 24576:wdewsAj7Di/nPaAi/Rztx6CUCNSeJbgI:Alj7mni/RztxawSaUI
TLSH
T1D315E031FE74E436C6BB0DB61B36D716143DB9204F621AC3E3B89A8D59302D26376E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 75c37eb9bc28c1a0d992c4adbe997d47a2be72a748d5ed55cdf0e1c87bab67c4
MD5 a5e5560a8abf977c2d336d0ca0c010d0
SHA1 84c089fb76dd5598bdacc115fe4ee1bc24bc2c11
SHA512 779ee79670f6fa89423d2a32798b5e786c36803df9b618c5ab7202fc1049a95566a58e3c62a2b784e958fafed63e2bbd13d1b2d1238f2965b0d3f81f906d0504
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHDmnyRtU:VUEtQevvqc2W1cpV2EI32Knw
TLSH
T162474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ded6118d2d49e805d2803333cdb960247d751f775cbe3c76eb81b69bfdd9f1f6
MD5 a6ec4cf0652b5e34540a90017fdc38a7
SHA1 6a29acbce8806a54c6ccefb22d3d62e026138fdc
SHA512 75016649a52af4b8ae5ad8ee022c511cc6ea592c8362cc4c5c8c25d9ff02cf2e03e2fd1a133da636b1a3bde0e021540a14a874aa5f6b1be173e7339f414a59e2
SSDEEP 49152:vCbRquA/m2yL5zifFiV+XenmE3/zbmni/RztxawSaUI:ooqHVjnmqmni/RZx/SaUI
TLSH
T1C8D58D1976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d8d92af428e367c08413062de4f8597d5ace8f1d6e987fb32529deaa4ae103bb
MD5 c254308e068d168468eb8edc3289968a
SHA1 549c0a576e251eccd29f15cc433732a909e4a25a
SHA512 aa4914b217bb0c6c1ccc57020a278f45ab9c5685a0e150fcef200a7ffafa1b9c12ef3f3da9eb86331844409936632a203771e6c3a30c8dad30b8b12acfbc22c3
SSDEEP 24576:MAhGLJIFoiwtA5l7S53KDi/nPaAi/Rztx6CUCNSeJbgI:MAMyFoiq56mni/RztxawSaUI
TLSH
T1B635AD81EBF955D4F5B3AAB899B69171EA76BCA65E31C20F1160D10F0E33E40DD24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7617b52b94dbb2bd8ee350a43fcf8304d6b61219c85bb5d0c8af3b6a6042091f
MD5 6399dc62145fc14d7ce0f117b5d63a87
SHA1 d33d81cd030211bf222975617ddb369c4d1a628b
SHA512 3df7e8c532518d31ef33befef1390b7f1113ba162a39d479df60f2647a0dd8e6fa76302c193061ff435dc31bc2071a03203e01a4335d2348a400536917a43e2f
SSDEEP 12288:Smw5HEjsChNVBFgl0WDm+C+Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgI:LwuoOW3Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1A305F14A77A80CF9E9679639C557C136F7B2BC122A21DB1F0760C65B5F33321AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6315db14b382eae02cff551f8bb1a17d37c7579679ab53d2b453dcb75b2c761f
MD5 30c7dfa9adabc22f5fa4e8d9d419c12c
SHA1 6df12cb0a2764c0380f7b1c243ad848a250c7650
SHA512 58e735ba89bf33e7b7c9e4d0c6019f063d8fa60bc2393f66187e1acf51a15cea05bade890783c6d578fd0f9d54601c2dc948fe14389a60b32c93a79690545fb7
SSDEEP 12288:qBZ1IyLDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:kZuoDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1B4E4125E73F820FAE5A3967DC8A6958AD3327C631B7243CF0A2942451F32ED59E35720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bc0d22352291ec63c0cda215db2539ce71460bbc94d713d8d605fc902843c60e
MD5 2ae060492de9fda1216430e0e763b4f4
SHA1 675e16ab8a928147cec306311cb29691d1442f53
SHA512 ea2f0273958acf5601705ef340c5f5787b7886eba14c67ac91d7c383b9458b3bda207cf351975e1f2d4f962f2d7c10a65598a2bdd7c5164241470025ba0658f8
SSDEEP 98304:RQRQyi36YOcPQLvw2gAf+PN3hmni/RZx/SaUI:IQyiKayX+PNRmnyRtU
TLSH
T1E2666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0df95e402bfc58e0817e31bccae773e89c176e8603c253e936fcf5d5f388d6a7
MD5 a7377360e8f9c4876d195f6a2f111e41
SHA1 f4cb1a4e2d17544e992505cdf1b4e31d9391977f
SHA512 cc132749013ad49d453db44356613daf37b6eaa00bf0dc7aad653186a0cd7450d3babfcb1a86e5001afb9e69c6cecff9f9debfd4be0aa1316908c17c8d47c5bc
SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN3hmni/RZx/SaUI:dQyiKayX+PNRmnyRtU
TLSH
T185666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 35edcf417d13301749d9e5a6f833a511f2addd018f2a7a6d76d95698dc56be17
MD5 91ca9d769294407035201dba70197ed7
SHA1 94c4c45ac229b674a84b1b17a2ddbddea9cfe870
SHA512 71d12633a8fb76836910754de0fe778349870b908207494b1566fd54cbf998f4e2daf1f0a30b63c9ac63d002971ae50c085a210edec75946fe1008d66938afdc
SSDEEP 49152:X68Qg55nhheWu7PNU3/rmni/RztxawSaUI:BthWRc/rmni/RZx/SaUI
TLSH
T1C7B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 eab4c69a5782eac26c94eb3efdc148da489f19f7e5a13667042b347839c75675
MD5 8c729b7b6df936a64b56011dd31f377a
SHA1 fdf430c7ec8ad8b4a03b9fc8c9248a99feb3a4ba
SHA512 1492e1f7dddca533435e03b4957663643bac417f6052028bfa9ecab536ec382076102665cbf7d6adc415bfe94001de03169f93689720f35c6d8d23217af61490
SSDEEP 98304:Oy5112gYy5azzVvL69nLKnhZkmni/RZx/SaUI:/LIHmWhymnyRtU
TLSH
T16D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5ca670c203fcaaf8a41cc061d62abfb5a910f95538111c4cd699424668fe3b8e
MD5 f82336ff230e993f62f0302c3c1ba1ff
SHA1 e1bc28be20f63eb0d30c862367783f4169b48310
SHA512 2701852da329ff1abac515e900cda83455d87ba151d0c0f56317167e515ef9e3b4aa63b295385dc0bd8918b750f51786b3cac4f9526714a83cce235397583fd9
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmmni/RztxawSaUI:bu6JmVxd2dmmni/RZx/SaUI
TLSH
T133D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 975720f162b9e31384bcda0f1879dd51a5ef28c847a590e637f25851ea35d97e
MD5 fed0620a7f177580e3d89e89ebfc3c93
SHA1 d521b2739bc8ccbb18d9f4f9cce12179b87824f0
SHA512 f53fe60fc3567bfc422c205b263d7d17f9127b21ea339237c79f09ff8e02380af4ee131b126c5b54d9479077338c5ea54090c63060ec26966037c490bb794d5c
SSDEEP 49152:B1hpsNoJpF1A6UU44CwH7R4x1mni/RztxawSaUI:BmifPbRqmni/RZx/SaUI
TLSH
T100B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d4f8cbfaedcdc880ed448e85b1a1c6a94ab959ac814c08b9ece68f4d3e2a6212
MD5 05aca8f055b6aba809e900b379cdab58
SHA1 dd8446c15e217f14e874a1a5c3d09ad20b57d113
SHA512 a9e192e8fcf61e00b5d32b5f54f32361f973e29b23977c7b47dfd75b3bfa70a7a1beea23a26180112a530ce18d0ee4b739453977adadb95b38ba2e127e569c3a
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqomni/RztxawSaUI:+5dKTi61omni/RZx/SaUI
TLSH
T1A7C5BF03F2E940E8E0BED67887669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3ed1b96262767874ccb953bcc5ab553182685d01437eb0a9bcb072812f2df9c8
MD5 61a60567b1c1992a264d35214f9c92a3
SHA1 63da5d010d27cf4091201fa59184960afcfcfd92
SHA512 d99e5a1e0dd1050e843598ddfdff252cb69aaa55423d0c1b7301b3979efe2c2ec2bc3c4627ceb1fdc6d24d1523808db0f6bf5a159e210b883a6fc46da1341c52
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wpmni/RztxawSaUI:wX2iyph2mni/RZx/SaUI
TLSH
T17295BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3f6e0be3aaa5bedcbf17be2c5d02032f8bc7e058839013b1c48dde9680e0582d
MD5 62ad81966f981f02f5686766ee410933
SHA1 49798cb48f84c119b468d590409580dd99bd22e8
SHA512 88d58c908f21d0dd8af8ac6d084aaea37d7bd857537381cd3c2afd1aed3d5813aa3c9f1a4062ff3caaa7b0df284a7283f47dcf0ef7ba8c4f6a020685c05d80a2
SSDEEP 12288:kcDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:kcDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T131C4235FDABC49FBFD10DAFEC517A0EA001E6C675EA2169F0F2EA1015F30969E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 5669384dfcf5aac6cecff65bde517db5e79c067b419e7b9bb94b67169def9e7f
MD5 c8209d0f0fe668ea3dac7eb710f913e3
SHA1 04e1914994ac65fcedb4dd8014cec547e8c1e14a
SHA512 1e8683aa25c86acf160badd03c75ef5b18c1d4b71736a7cda492a550f964b9ff86fda9188e3c0d646e19303d1e3bf776e5e862573bec3836bcadcaf4895ba65d
SSDEEP 12288:g/Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:g/Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1BFC4235FDABC49FBED10D9FEC517A0EE002A6C675EA2169F0F2EA1015F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d447198d090511919ccdca69c5f10691086b52ddf3c0db37f2d06fe287a6b8e2
MD5 0c0f6bcbf7b7231fe4c0207fccaaad6b
SHA1 497d54db938b010ccefb18586544d5ae41087f94
SHA512 361dd5faca32f40307d8fe5cc3ae34088bd59171370d11865b349115e3bfb0ec47f401b6a3dc1f620b20eb558f9326d2d26258005c6a58cbf3c3998c1af8468a
SSDEEP 12288:qNDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:qNDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T116C4235FDABC49FBFD50D9FEC517A0EA002A6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 5846609b2825a92bd42291dd5c0c89cc543c501b837eb894150ae2174d457252
MD5 6498e5e74af15bbbe17fb5a9d3cde947
SHA1 bb4a777812be8d8f97ccb0da77af8d7d85204483
SHA512 33ba07e20cbba13da862dab6bf7e920de879e25aa60c40f97cea75f9c9f139336d76118afc63876b708221ff19a6524cc31408b1c54e8924f0163c69bd2fab65
SSDEEP 12288:1VqDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:aDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1C4D4231FEBBC44E6EC61D6BDC82690EA913A7C679F3217DF0F2551050F30AA8E5A1E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0ff88e60038a46c8947ba1657851791069f139808f58c0ee985785fdaa4b88bb
MD5 cb9d1cded35612862ffe5fa8435e966a
SHA1 bdef362b7b37eb50459775515295b39a53b3d4ee
SHA512 547e5112e76b86d1c40f8c745a8d4e316851650b0770fc6f85b051252f99ef9cb76e260da4b2485f70711938cd992a6e0002e350964adf4fd9fd995c52be958f
SSDEEP 12288:WSDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:WSDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1F4C4235FDABC49FBFD50D9FEC51790EA002A6C675EA2169F0F2EA1005F30D69E2C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 921b483a5d1fce1d309b6082b1c88c69bda0ed747be6e3c44684806365ae1a10
MD5 35d9440d7efdabb0cb81b87f2beebb3f
SHA1 71454cf04632e46555120146c7c2619094942ea6
SHA512 8fd5d3943efc349e92a931b7cc18cea896c4d381fcd33bea85192ed338dfe297621025c8a3bb59b0bc5a035616aeebdf601649f805a6793bac2d43b92dc2095c
SSDEEP 12288:NTDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:NTDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T14EC4235FDABC49FBED10D9FEC517A0EE001A6C675EA2169F0F2EA1015F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 98fbf665e8effd895ea825d52f115dd3a33d5225fe5236aa22f810f7113ab354
MD5 065b8b205e9205e833ce02bd26821168
SHA1 7679db34b1b9b56d5e94e9ee5d11fccfd6a5c84a
SHA512 be7d15fecd59746458169910f87840d5c2f05bc96a362b4d41cb4a11f33b6f081f18ad48538242a86001298d4ec95457d74fb96a02cb537ef521cab4ff1a753f
SSDEEP 12288:7nDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:7nDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T118C4235FDABC49FBED10D9FEC516A0EE001A6C7B5EA2169F0F2EA1015F30969E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a74757d881c717bf8a980c8efe7b3642a916f26b457641121b7165359d4c0360
MD5 b2eafedb0ddb36c6a0285ac539760aea
SHA1 940dfae2334d4f8d697ce5ecdc640f5e1f2fd116
SHA512 124285509eaa0d385bf3028c97a4df36cf7fcb9fa02f2b7f0ab605927f34cb5a0645ed3dffe5e092b07e223ef3fb96eaef8285e32550f82b14aac474250aebf3
SSDEEP 24576:hZMSzFVSOfDi/nPaAi/Rztx6CUCNSeJbgI:hZMSzfjmni/RztxawSaUI
TLSH
T17E050199B3A41CF9EC63817EC9168956D2B27C2A0B70C61F07B832165F333A15D2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d2b6c9e0e9486076fa1e4adb38742bcb90ffb8ae27b082f0cd941f1155aa4f11
MD5 d9691a8f5be54c1cf93f5a8d7be4ea6b
SHA1 06679c5fe06520d5726cd92ab070f3643c15d03e
SHA512 57adedeb505e4a3e38f6c027cc26611e5d9a7a6de9ebfd7cfb8a76b998827c81c1563499953c779e7558b6a9094a1578b2dec24d7182a1c56f3a201a3dc94460
SSDEEP 12288:S4Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:S4Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T10CC4235FDABC49FBFD50D9FEC51790EA002E6C6B5EA2169F0E2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 630a49f9c752efadc7c3eb6b8ddd16b6624d5d6c7e769f8d8ed5edde95f180e2
MD5 152314de5b34fd16a6dbf942a8a65f13
SHA1 3e454097020efad5f22e98a416a5a316ec9db915
SHA512 a3865a55b23a523a8506bd6474fb2e07cb34a4a63f47ffe41bc756c43b3d1ea6e3d76e50f52e27bba4c1adab07cc64a035c2c84e2ffc49664ea19912ccf18d28
SSDEEP 12288:E0Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:E0Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T198C4235FDABC49FBED10D9FEC51690EE002E6C6B5EA2169F0F2EA1015F30969E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e8fc9a3a764e5bef1588504761f745f5467d1057438be585b61e3e0c7afff8a9
MD5 f652711edeee60a31ff282450ee78d2b
SHA1 2bb682d50af44bc1f3653099ceb6f3d1be9a0192
SHA512 28c6332c75f94783064cd7b7f92fa85eac76c7acdde4468605e81458fc6736282d5da6154841c19e4b9e3dcd70b53380edb0a20103dc79c2dc2396fc7d0fbd31
SSDEEP 12288:CyPz5L8LDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:fzyLDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1AFF4021BB3B920F9D5369279C8521956F3367C360B308BAF076443761F336A09E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 12489ccd55f4d72be1598b0f44676855cfaf17c400524cc06feeb00c454ffc49
MD5 e53eea063c0af0e988b72f5d76b2f3ea
SHA1 e0544fa1bb9421dd134d086204f88418ebe9f9a6
SHA512 8a75054012fe3bc171c5f007f88df5eb6e602eaeb0202f70c43882f638531c3bc38775c3699c26f5b807d6e68f4d727c9416bfc8338718d2975b5227aecafff4
SSDEEP 12288:T4Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:T4Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1D6C4235FDABC49FBFD50D9FEC51790EA002E6C6B5EA2169F0E2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1ad9858d9cabdb2e5c27f38d3692fe7dc9e21abf91461d78815f1c467153febf
MD5 4ffb90340144586c5c9bb4bf3ca79bd7
SHA1 819d21ca8865bc647cd936c84ca647c68aaa2f93
SHA512 f0bdabd7d6626fd8ecf79a32fb71ef993ccf0834820d86798abf0ad31300357e2c2c5601834db7245b56d9dd68f62d887e617e34e8abe521dcf83c61de75447d
SSDEEP 12288:24Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:24Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1D0C4235FDABC49FBFD50D9FEC517A0EA001E6C6B5EA2169F0E2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 ffa9a80035b18f383e279a4899baf92ecd77f3bd77bf4b7169cd8d3ebd768a81
MD5 2e3a0de422430b6d52df2bcc14d2a4d0
SHA1 16bf9ea52cf6f8b2ac709a2a866f73f96f3c68da
SHA512 4d53b2f0c53c1e48435a32a2a59d035e83da5b5861d26da73b7943bcf8c1e15d6149c501a61c07b0489d3223a0b80da4a1f96922a74ad92f528bb922d02bf893
SSDEEP 12288:JyPz5L8LDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:ozyLDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T10BF4021BB3B930F9D5769279C8521956F3367C360B308BAF076443661F336A09E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9a587cce9fcb4a1460f95f6c8b80d77912620e77cbe389eef7ac4136a3e719c5
MD5 d3e94f7f5469e3d9da3d84609b3cb03e
SHA1 3000253b1298e4d88e123621b7870678cea1e667
SHA512 22a228f8d85fc6f3f6e8c439f210a1ade788d82ee6207227ac7222110be9fc55e4401379390c554b9e74e4df8dae69c647ed64cba85c743804e6f8f785c7e54e
SSDEEP 24576:PTHaLl3z0zD9Di/nPaAi/Rztx6CUCNSeJbgI:PT6Lljemni/RztxawSaUI
TLSH
T187050299B3A41CF9EC63817ECC168956D2B27C2A0B70C65F07B832165F333A15D2AF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 9714895730de8a03a741466dbe0e7bc46f66006beb96b19346a3f5010d7afc21
MD5 47a695a978f24f49c1a66af8c5e083a8
SHA1 5d325b4ccd29cd31d5fa7fdc7b9f46becfa282aa
SHA512 9b942cfda13d1f41eb0ad2c0ecd19ca60428ec49e2a084e7e05977280164003b81d07f4b6e24002628efbca60c25ff0d56a359204cc61c0a18676ea583418307
SSDEEP 24576:N37d9CHKy7GZBDi/nPaAi/Rztx6CUCNSeJbgI:t7d9CHKyajmni/RztxawSaUI
TLSH
T10B25CF90F3E814E8F0B7DA35C9765511DA767C5A1B31DA8F03A8261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 634e53560ff3bdfbeea300960c172e18f8ed4706270ba2f2b44e3c862554636d
MD5 27ec234473da3b44f5c64dc5f6613448
SHA1 3f3271e69b278c38592e079184b0c52fcf412f92
SHA512 a9cf0cf678c146fe9f80cfd497b921c2b9f36a194571ec4d576f791da969a9cc2a8e1e6302f50913fdba4a73e689e8f16094f44df7a42e7807b8af79a8202e95
SSDEEP 12288:QtDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:QtDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T119C4235FDABC49FBFD10D9FEC517A0EA402A5C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 d5341311cc4b46c8cb3341bcc741b154b2144e55adac29e81476b39234c62558
MD5 87d1c0f822a15e3e6dc2e3daaf875dc6
SHA1 6b1caeb95bfee751b249b583846f11cbce3b37a6
SHA512 382e2859a8abe15e58dd2725c94b594e8f1f58eb66a6d7e8780113469324c104821fe2bd704a3778fa8175e3fa06f1dec183e649713f4fd33e9e8f5224074722
SSDEEP 12288:4rDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:4rDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T151C4235FDABC49FBFD20DAFE851790EA001A6C675EA2169F0F2EA1015F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 45aa9419feecc4f5e4d9912903b169f0b43a9b9e9a6a1b0675c5b2cf03012275
MD5 9a3752d6a275188ea18aa4e033f19f10
SHA1 7c17feda97ba54d5b64a196e884970c1dece5120
SHA512 8448e80e339e2e309835babfdda61cdc4ea83f9e7da7cdc4e5e4c2686d4e2cb6c27d131aadfa2cdd799082a20cdf74484b85b3c422396a6a3e0a00feef146402
SSDEEP 12288:KGDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:KGDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T17CC4235FDABC49FBED50D9FEC51790EE002A6C6B5EA2169F0F2EA1005F30D69E1C1894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 d94c2c20191dfbe42bebae1b29b9950f9f25f6524ee5ece4796e3993b72339f0
MD5 c6b2d690f6eae392cd87068ab24261ae
SHA1 7df826ebbb4857e05e2f50ab2ca5dfaf2b7aeb17
SHA512 7953168c31ac5517502f73e0c15fe89dbc656ea04c97aca01191c96828666935a34543aa3d8a93dcc35b690ab9c01cab43acd7d3c5a6295effcca50c1ef36fe0
SSDEEP 12288:N4Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:N4Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T157C4235FDABC49FBED10D9FE851790EA002E6C6B5EA2169F0F2EA1005F30969E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d57ccce20a5c71d87609ced62c8424d7d8f7f1863eb03f35f5df6006894cbcb2
MD5 7a595f3fa065eb5f3fa6869aaff265f1
SHA1 f4b1af2c7ee12a9b17aa3d0e40455acb4d3e7d44
SHA512 9697bc7ba45dfc315acd6b125cf59da012b5d5c4c5d603e8e0ae723e3f9becdc949f7c32ed045c00981b42a4e1ccc1dc4e5439beb721096ac61e7f46dfbc34bd
SSDEEP 12288:TtDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:TtDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T162C4235FDABC49FBED10D9FEC517A0EA002E6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 6fb7ac14df52eb0fa5d7cfda8b99dbe3f28d56f2da93527848d4050641e5c89c
MD5 1579e0c61a4c78f43059a98ef37bb23e
SHA1 75518436a3b349bed356281af395f9b2d45eae25
SHA512 397f5ba3de15d79b2d7bcf5806c3c2153f4a0a543a92291d46cf3b528a24d3242dcdaecac498ad3f1dcbaa4a0ccf3098ac12e3dec3d92212cbcb8a183a8afceb
SSDEEP 12288:PgDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:PgDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T18FC4235FDABC49FBED10DAFEC91790EA002E6C675EA3169F0F2EA1015F30969E1C1854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 f869df84273a933f6b252f78a0d82504648abd24ee1e52ed4c0f3c5ca972bfad
MD5 866dee733c80b12d8b2644d0358b8759
SHA1 af3630ccd09e4bfb60db48eb560652653aa20fea
SHA512 5ef3cb9a44669206ad5e1b500325598e3960f7421cc6315b5159362db1d4562313e2efd6821d910a84561d16355f57aa10db97d35086345c6dc38d72d3a38870
SSDEEP 12288:3SDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:3SDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1CEC4235FDABC49FBFD10D9FEC51790EA002A6C6B5EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6b10acd98c84241b439b50567564dd65166a86698967837d40b774dfa345c3cb
MD5 3e61907485bcf08b975ab1055c6d0587
SHA1 e0916751d7ffaf79a0152f7cb8be8b06fd524e22
SHA512 c0acac5ae7a0b8fee01b8e94d45fbbee0d98d5a5b52f6fd5abe80d584ee8ce342d106e60f850184c554f3314f42ff3005c00a98c5f7d4dfe542cad4019ee9c5e
SSDEEP 24576:Afwvok9RX6wkyAIEDi/nPaAi/Rztx6CUCNSeJbgI:IMnYIEmni/RztxawSaUI
TLSH
T1A135DF29EBDC44E5E1B7923C89B7464AF2B178691B31C6CF025A536D0E33ED4AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7ce209e84aafb2b7392f41c34b407f5619a7f545a3354c1eb775d5df59dd91c6
MD5 f63be071edfc90f89ef55abc5e4b7251
SHA1 c709b05823b1ef420c0b471db1116f2998cc5f1a
SHA512 f400ad7e31999f9ad3eaf205f7bb9e1299e6939b3a946ae44b2847c94e48083a26705e400ef84b59772c7141cee92123f8b8e3921fd1f0f53d79972fb4864f8d
SSDEEP 49152:jYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Jmni/RztxawSW:nySzPBmni/RZx/SaUI
TLSH
T194066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3524024b5beb2da2b35cb0f9294a2ddc3de39b8bc0c289cf725e1f2ca796bc77
MD5 732fe2705dff4d764139865ac20a367d
SHA1 1ee4bd5a0a3fa2baea131b260008375d22d3a8e9
SHA512 b2ead8f48ca680e76b9c82a8454aaf44afc20e3aad6b28142c3e5c91d6d53861288c78e8ffe35f73d3c8c3a6486a201cafed0da575dbcabdfeccd63f7fc8667f
SSDEEP 24576:u47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYvDi/nPaAi/Rztx6CUCNSeJbgI:u47JUQj1irIhCnDHUPfF/Zmni/Rztxao
TLSH
T181659E1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 9ce0ca97979cf5c1947ceee6b593e58f2d3eecf952363404ea2af4ab15cdc0cf
MD5 b9107df2d775c8351f9a2c6c2f20871f
SHA1 7d7aef661a5fade56ed9a7352c1eff7764a4870b
SHA512 7734ada9e7eb31b2bcab01759d773dc1d857133def00ea9ad442d5c0d4eead3dd1fe09c29913e5f17af250a7bd4e2b5901c5dfed335ad33b10a855f347139bcc
SSDEEP 12288:KNsfoDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:DoDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T12EE4F11AD2A802E9D46EA279CB565681B3377C2687E1D3CB07D0F13E1F316949DE6B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 305dc15261c993409187678f9d0b8ce3268381156bb04c94d64511b2e1a517e5
MD5 42ad911a7493a04cb66e824a24c5e89a
SHA1 2095381b98f2c48acbf27d0b223b9aba41270ae1
SHA512 f1111a0a3cd601d48002c135e3403aee0e86896b52042abcd1472618b995b4d1b65197299ccc4ab54b6eed75c5f1c062fd8e2c1ed8ea40e80604843e193640fd
SSDEEP 12288:SGMd0U3ft3aD0wsfOJ/j/nhXmEfLOp0Roq4DYI5PXg:SGMCUPtaQwSObLD40RoNDYIZg
TLSH
T150452741762AD79BC6A940321E36D6CCA770BD01FE059F0773C8873F9476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e27eb970b17897afdd4faf74ab65f926b5b2b33369017f249b5ca340730c1aea
MD5 d20369154fb5af35c44d7f945f344608
SHA1 96321536bbfd921ce288504dca30ba6c87cb1512
SHA512 8cd2453a9dcfb5d26c7277011490e4d3f6208498a71679d3ef69a365bb171bfd22b960289d1e197af7ddfd7e198011b3262d4ce98a685b6b39375b6f3fd39b21
SSDEEP 12288:PwgyFCAhH98inemKaw1DmWYBMyi6ilHUj/kkYsI5qiYYsjdS0SaNRSoJp5t:PwxQidpefuA6GD1cH7fp
TLSH
T10C551A41A5A7F35FC8FE90374732868DAB746C02BB452B0673444A3C887767EB5E26D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9313e84a843b9278788318da259b198dfa2fb2f0248e7ffe2e515ad7911e1862
MD5 6261fed4d644dcc13849a7634d984675
SHA1 5e7702a1637df3658bd3ae37f34b44a4cd3042aa
SHA512 f225d9452b0fb02d45e5504228632b30ea4c7813ea64a3d5bf7f71eed6c77a218c473f8ff704e4fb851fc1b5cbe91f353281c6da90952efb0fa07ab05ef72331
SSDEEP 12288:Mz7QDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:6QDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T17AD4232FD7BC8DABFC709AFD841B90B9102E7C764F6155CB4E19A2055E30DD8EAE1A04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c493ba51c0e3af35fd2b98dde4c62e37fd79f31b712028c8daaec3ba8cbd146e
MD5 53cd08f8abd2b8ea5aac147a38c464eb
SHA1 7b1d8b0999f5e87424b64bc3bc0c1dfd90a18d8a
SHA512 afd49a6a074b9d2d3eb543cdd0debdae6668f0c313062f36d4e3edb69731c5afaa1c6b32064d2bc5ab751018e50ba8ea33394cc8f55f39a2f4dd1f200097c312
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYeDi/nPaAi/Rztx6CUCNSeJbgI:Ugb4mBIBhGFvmni/RztxawSaUI
TLSH
T16E659E1E22EC02F5E0F5E2B8CDAA4417D6B278161732D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 cc21c8ca2f4f84458b0504302a5b901b17632d5533a041bb883a305c325b8a23
MD5 017620ad01e3697577a8ddd798a820d9
SHA1 69fe0d896f0edd0bb5215b9436b20df0dadf0a43
SHA512 bd2d8a56247cb98c3a51c2856a4f844e9483d6bff4f303a38e6df714a61c00ff0aa4f25be91164c7785dc91c5129b4d6ffbfcaaeacd0fd428af229dd9c47df29
SSDEEP 24576:qG88u8FpJqH1bzria7/mfDi/nPaAi/Rztx6CUCNSeJbgI:R7ZFPqVea7/mmni/RztxawSaUI
TLSH
T1F235F165B7E401F1D477D138894646A3F672B8260364EBDF0BAC8B511F23AE54B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 30b2fa5cd5113e7095bc3ccce2c8757def8ab7a7d2ae883cf53923a5a8bca185
MD5 5d138a1c2e4893dc99d1acd490dbf4f7
SHA1 85793a0ffebecc3058508222d38bc7516ba38f43
SHA512 23d73425bde57f4f8b4b07057fa3827b5a001291102859ca6795a3031758f77540c5a6d958a1290a30e5b926e34340ea5975b7a1b7f545309fd94bfcae013eec
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTmni/RztxawSaUI:TG05lO43bsmni/RZx/SaUI
TLSH
T165D5BF6E62EC11F9D1BBD17CC986460BEBB23825033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8aed1411a05f60cb037db8c5048da6759d0e05b9ee9b0de9ce8a51aac757304e
MD5 fb621079b5a8b2d2e98650a00cc0f3b1
SHA1 d80876055c6171a67123e53b1e93887cc4ec9c98
SHA512 7c424cd6cd4fddbac02d674724d3d5337ecb96f8521b576e4bd8ac6ce5f4dfe88b4ad5fd22976667494b50457e488546e074ada85024545f5a4eafec6cef5fe8
SSDEEP 24576:ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnJDi/nPaAi/Rztx6CUCNSeJbgI:na5POZ3+Jt2pasx2+mrmni/RztxawSaP
TLSH
T1A865AF5EA6FC01D5D579D17DC583861AE5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c26b7db4cf45c0eb8e9cefc505f818bda8711c0f12b217c53888918362a15ed3
MD5 e8ed3b275dacd9fddc889c6a43bd752d
SHA1 f38ce9a49caf9385ced15cce00dd72f4e4be6474
SHA512 dbc65da0edd475f95489c1c4ceb2df5263beeadc220c01d002a43d2ae3a8b97e67f44b2329a5a21cbd2887285aa65cd2b248bd7650a83228faf702b0e522cd15
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkXDi/nPaAi/Rztx6CUCNSeJbgI:2Nc/zEOVHFGmni/RztxawSaUI
TLSH
T121858B2A23E901E4F5BBE1BE89779546FA71786517308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ccccd6eca892a2c92d9e4910f2f7f8cbc59c49d4a901f59a132aadf93a3ae978
MD5 432af4e86bd3bd4c24f9a29136a84bf2
SHA1 5f9960e82da715dd08666bc7224cd851fc41db6e
SHA512 1f951a5867c01a0d9a7f6617465c45e41e4407c2bcf83c4109a41d83b503f06d05069fdb4c92afb4ff395cde28e6ad2b4e3b5078ae31a85e461c678268aa3b3d
SSDEEP 24576:n8kNvNnaFeYhJNtmZBmSDi/nPaAi/Rztx6CUCNSeJbgI:n8MwBtOmSmni/RztxawSaUI
TLSH
T1CC55AF6EBAF846E4D1FAC6B5CD238516E6727861073253CB4390C13E0E279D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 ef19336886e257031a97b5bbe015f961dde852ea5dbd73ace0dbe929f40d4d88
MD5 d6dc475d68a28293658dd33154f33551
SHA1 e2c33489c7f7036429de9f6fce8c2f3169aec869
SHA512 cb4a7b13aa46c587b513597d8bb13d65716abc4bd0fcefcab2c44529b159b8dc7426b031622c08151364082a62b9220bde58c922ad71a7b3d04c6896fefaaae5
SSDEEP 24576:1PUr+NQjDi/nPaAi/Rztx6CUCNSeJbgI:1JQjmni/RztxawSaUI
TLSH
T1EA05E12F66EC1CE5E676E17D8542865DE7727862071292CF02A1817E4F33EE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 58dad4e7e64a30f059845ddecbd344f1fa15531501c145b6af7a28feef0e6c25
MD5 3b1aa7d78643a5d2f1b66dec64582f60
SHA1 6324e4b58de80e4783f02f141e34d9b855fef497
SHA512 4cb56e9534794ccb053c20a77d6e04d94995912f4e2af5373cd7fd85e887fa57b87ee56cf82870ce2056cabd4db6397620f758dda5a4ea3e405007b8b18c9ec2
SSDEEP 24576:DD3FHshBIYQgA8Di/nPaAi/Rztx6CUCNSeJbgI:DDVHeBIAA8mni/RztxawSaUI
TLSH
T10625E17EE7AC04E4E57AD1BCCA638906E67138A9073266CB0694C1B51F27EE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-124-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/692-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/692-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/692-327-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1052-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1052-178-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1052-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1052-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1184-91-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/1184-96-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/1184-90-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1184-319-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1668-139-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1668-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1668-145-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1668-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1668-147-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2152-279-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2152-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2152-73-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2152-67-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2320-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2320-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2320-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2320-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2320-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2572-86-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2572-301-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2572-78-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2572-80-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2728-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-331-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2728-107-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2728-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-101-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2980-155-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2980-161-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2980-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2980-154-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4152-26-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4152-137-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4668-10-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4668-75-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4668-46-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4668-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4668-6-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4768-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4768-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-119-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4768-113-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5836-45-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5836-20-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5836-28-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5836-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5836-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download