9637cdb6b2eccfee46b964842f29523d73dfad3ea26c9923cdef7958cf6d1ae8

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260803-vdx6qstdje
SHA256 9637cdb6b2eccfee46b964842f29523d73dfad3ea26c9923cdef7958cf6d1ae8
MD5 cd59b6bbc55f98b76e5807ee12d8d7df
SHA1 833a3971fa2b145408af6553d1546976fd908fce
SHA512 f2e9f6dd7f457c3f5223b5321d67387f4af570404e2249166a13fec9a032dedc145129335589ad066c8e7e26a5195177a66cc4bbc1e06e8443e4799ccf1c23f9
SSDEEP 49152:I+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755U2:l/PvOIjcXvvOOc5aD527BWG
TLSH
T12A165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3308	elevation_service.exe
2912	elevation_service.exe
4380	maintenanceservice.exe
3168	OSE.EXE
1972	PerceptionSimulationService.exe
4252	perfhost.exe
6136	ReFsDedupSvc.exe
4188	SensorDataService.exe
1812	ssh-agent.exe
3764	AgentService.exe
5216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\73954189e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096a9cb9a6823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d64d19b6823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009169329b6823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002338229b6823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe
2912	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4376	2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3308	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3764	AgentService.exe
Token: 33	5216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5216	SearchIndexer.exe
Token: SeBackupPrivilege	6136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6136	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3308	elevation_service.exe
Token: SeDebugPrivilege	2912	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5216 wrote to memory of 5816	5216	SearchIndexer.exe	103
PID 5216 wrote to memory of 5784	5216	SearchIndexer.exe	104
PID 5216 wrote to memory of 3292	5216	SearchIndexer.exe	105
PID 5216 wrote to memory of 5932	5216	SearchIndexer.exe	106
PID 5216 wrote to memory of 3320	5216	SearchIndexer.exe	110
PID 5216 wrote to memory of 3916	5216	SearchIndexer.exe	111
PID 5216 wrote to memory of 2004	5216	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_cd59b6bbc55f98b76e5807ee12d8d7df_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4380

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1972

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4188

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2ef0aadd9a511d9fa6f44fd117b1ff7f93ebc333657bf17917eaebd946e91aed
MD5 93fbfe4dd5cfdea1fa8a0f3223a454da
SHA1 5ff41d3bee89b5cd1453689b8e355789dec8c19b
SHA512 9a6d6b2fb24c7c65899a65819240f1dfe6d36e0060e01195b145ea1a37fffcf844441daa4f0590e6050ade192d4ea43faea988802322559b895715b5fbbe4da6
SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn+Dmg27RnWGj:t3q6sjB1D527BWG
TLSH
T169D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6f6d54cb576710d461d216dfdccab5e6fd4250221cb7677645c1871aeaa480b5
MD5 965411f15d491cdeeae89d992a55c405
SHA1 fe364dcc2af9156f772d7668dfba7e7eef42a862
SHA512 705e2a3874a74636b70a47080f543c8a74e9bb4230b162cf52e25d503b2a026deed51e5b3b13d9679c8aeb93dd17dc1cf3492d19b54409de4b46bab559ccc560
SSDEEP 24576:OXYfDtczAdsqjnhMgeiCl7G0nehbGZpbD:NtcgDmg27RnWGj
TLSH
T157650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8d3f3dab383303866bf7f557091535b414596b19b981b2bc293e967a5c0ee131
MD5 7a3f677411d3f6beb7ae6f5ca663b07a
SHA1 65103c853dd096e1760bee76fb1fba79649df219
SHA512 8bc6f5aee2f72810f105a9e7697ee9b6d7673c22f526d8594e6a089febade07c25206de23c5acb25661dcf55617327f82fb5966851ef4b8071c6784d49188db4
SSDEEP 24576:00Le5ji0hmxxrMrsqjnhMgeiCl7G0nehbGZpbD:0Pji0AjuDmg27RnWGj
TLSH
T1C7859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d4b45f0604d221954eebb2cdbdcba883519cac08ab62ab1edcaeedbcbbb31231
MD5 64c9deab890fe06f30e7e210130e7647
SHA1 ca46b0e0f56fcf0cdaead62a1f6065d09b3a805a
SHA512 390f261f564ea5eeef644e32ff05ebb31d24560c1b81b2299693ae1ce4ab4a7457c211ab37b40ff79e5b42132d3f008eb9814cabf8b9eabd39cd8564b893189f
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWn6q8wyulsqjnhMgeiCl7G0nehbGZpbD:m/ezSC6vUzPveHjyKDmg27RnWGj
TLSH
T126755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bc6c03bc4ffd243f075da85b392f864904557aba65a6aeb52bc4abbfc959cb92
MD5 37f518226dccf1ca1e5c8c2e1c91a437
SHA1 0cee0298cf8b3ce095cfeae36b54940993870ad8
SHA512 8cdac769361a53d21099cc238bd50a51ae15be425a37925964094a1141a76c05b20d53b7deb58443ab3d0030f82b6631b2861494a647010fd234f3d3007f37b3
SSDEEP 24576:rVbqPb88hv/l+Y4sqjnhMgeiCl7G0nehbGZpbD:rVO88hXl+BDmg27RnWGj
TLSH
T184559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 42d4f97e596ead9361aa9f6d98317507af0edcae29bc31fda1e1ec4711f7d473
MD5 eadbae07b885d5eea84b81e9ba58396b
SHA1 ba7df8abb601884d841599571adeb4a48b492e27
SHA512 4852c76d7b2c00fd6ccfe86b3a7e3447f399cf42e2434fa5ba59de8b4c873d81313dab8e5a2049b3eb37f2543ab123825e049beb67946edd24c0e3892ba0d617
SSDEEP 12288:BL/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BL/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C44523BE834C10CAEB7709B5C2E9F15EAC177E56982008536A637CFDE6B5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f931fc6758f2711fabb6a91d989278bfb0da4d9cb34b9a5e4e7b1c92a701cc2d
MD5 e924e127d227e3c7cf5b0b607ee9c2e7
SHA1 c98838ad00da6d8c556614615494a08ba0de3475
SHA512 572b11ef022419f973f7e5e47d867105429365a71a65a8585df32963237098109562d4564cdd7512ac8c1da34f09633500fabafbe5147cde03d88352b5ed8509
SSDEEP 12288:reBNUbTVO86UAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:rJIUAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16965CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ef65658bb1536cd713590935719ae2d3f94fe9ba7c7277544346b58e20afe8f0
MD5 efa4f84e9e4cf716c5fb36c4cc09deaa
SHA1 8cd070c31fc98ddfb6de2eee93636e732e8a7e3c
SHA512 e34858286d8509ba5d6c6337424480bda53245794bc131c8ae0fc199fea11e3dd1c418b3a7dc6bf58041e0ad80a37c5ab7c3c78fadf14b75a480ed5f7c9a35ee
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:3QvGAdlCEL8c/DRNw5CJD527BWG
TLSH
T1C6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f411bbd20f0261e6497a742c9f1da2719197e026eb3124dd7d71c0b2bcdeeb7c
MD5 99a5de7e1101dee216ad35c74ce580d7
SHA1 7b2cd30763ccebb2c45d8695cdf44c72200a221d
SHA512 f1ef4a1ea05321031a1f6518ca010c7122f57d5901eb641a58288acd9da10eac35622ab115282130aea7e093709b2fc23bcbea4d15622fc1f6e34adafcc32900
SSDEEP 12288:tAwSfxL/2Dc3RDLLmt0LDQewsAjKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:e0ewsAjKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17475E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 74b1b55aa04424b5874909b90213f688b6283b153b57bb082e919a8836676e04
MD5 267adcafc756b5b1e64a210e16d540fc
SHA1 a8dfc29f0dead0644a42144f371b2ec57c5e5505
SHA512 018f7e2e6969f6d85975579b829343e74d1e8081adc1fdbeb4dfb83ba2412005ab05519fb022e036e1bdabfd371efe320632b6484f1fa513e745152e5ea37a33
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGVQBWG:7UEtQevvqc2W1cpV2tI32ZB
TLSH
T180474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 09c09b2be07e5b68645dd8b0ad289d9f44a425fbdf80bd445a59bc94903d0f9b
MD5 26b4c94841bec656ce5effded14cac38
SHA1 c7df759928c94c0a9e55e0916b0669d7b1b65656
SHA512 e55d223d2b6ab1b6fbc0b2098a8c88264f1bb1e7f687850220d5ffe3ca27ce93a08fa1ddc205439e952b492ac57abfeb689607897404ec1130fe609eb614b3f8
SSDEEP 49152:KCbRquA/m2yL5zTfFiV+XenmE3/z+Dmg27RnWGj:/oquVjnm1D527BWG
TLSH
T1BED58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6f5e54a396e586cab04c9c2ce747b54172aa83383cbc45f21ef6b1e8b7466f12
MD5 720436d136d2a88ae6cef256a119ca0c
SHA1 6f20c96b8f95ff1ec32b664fada0419fad9bfb29
SHA512 5cf9133f0e858675891246a761f03b8aa660c90261e04a3a73b495fc6ec45954d5f9d894b3cc4f6315363f75b45144621935e14bfc393e0a2806a2c47eecdf70
SSDEEP 24576:MAhGL3IFoiwtA5l7S53BsqjnhMgeiCl7G0nehbGZpbD:MAMUFoiq5lDmg27RnWGj
TLSH
T1E4359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ed22d786827e8234b58e10ecfd98bc967b191bb4cc0c1eaa30704ac7fca71568
MD5 b6e9cfe2da2b9bdb5b665a57dee91db4
SHA1 fb8de3f0f6072917ec0b342b39c5de6836d4bf3d
SHA512 fd695f11ed348e1324d1d8667e4ec00033f02581fc0451f79366cd37ebe272a9c233732e1248f242975ad3608cc6c1a19b378b2f8c3138c47e79ceb1cc80a85e
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:vwu4OWmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C65F14A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F37250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6550c4c0e33852c775c1e2797ebb60688382a3a97fe04c9edae80531eeb35a63
MD5 bd7d1138433be6d77d7391b5c54864ae
SHA1 ecf420a3749bbc36cc2c83ab96557dc3a487e609
SHA512 08c461f11616140a15a8052aad5bd16a405857a722f857e017d48b23ce2d60c94c14619c53c258bf94fbb4af926bf36428de793f63a9420510e95f5ce2fe5f40
SSDEEP 12288:weZ1Iy6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RZuTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1075512AA239820FAE167417CC5E5D609E7337C62673003CF166656BA6F73AC44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6a9a32d5ba09fc6dc9a943b684028ee44362597b89138c06278d396d72ef6e18
MD5 b8e7809277fdda8ab60300e24333e041
SHA1 4073d1d8f960e72623a99a5d5c12f336a6498a73
SHA512 43684d53f6f630a39c4fb09b3533a447908c5f30da6c874030435b078518ce39cdc6add6e1ee60121f8bfe94af253da7e42c97093a62c36ee243e622923ca248
SSDEEP 98304:0QRQyi36YOcPbLvw2gAf+PN3oD527BWG:bQyiKa/X+PN4VQBWG
TLSH
T15E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 62587a558ca7d36fb7cdf40adb98b3516e86d29e81353c2c2b7b87b588f69db7
MD5 6eef1019d14688020b1d3fb8b76afe2f
SHA1 9f3732d033cc0859950570977e6eaa5a6429b99a
SHA512 a982ea3bc0fd21da40e8b22ea397668254b348b94628d87458b2aefdfd44c687a94f8cd6f40a6c4c014c729556339bb554d4d2856b15805897e3c67007e21289
SSDEEP 98304:KQRQyi36YOcPbLvw2gAf+PN3oD527BWG:hQyiKa/X+PN4VQBWG
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dfd0c3a5a713ac1f02ba0aca2877afa4fc7f26a6a99f7b48f241213c037e6c8b
MD5 29c88976f2fd857f2e2c067e869821bd
SHA1 3ca02d229bb548e36e90a9e9ebac6ed442263b29
SHA512 ef7f7b31126fd269ce53d1313f43575bcb5f9107bf055adab82563c4d02b566b4a70455c70529f2bd6a57a39dd5211c4e9f370e29b7d8c27f74e15cfcf2d1d72
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0jsqjnhMgeiCl7Ge:G68Qg55nhceWu7PNU3/uDmg27RnWGj
TLSH
T14FB55933B2F60099C44DE1769F4A973196D27C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 39e2d5c42dfc003b37428bf32cbbeb3f7f31cbd0666ebb322329739210f2291c
MD5 ee8d02f1d1706864106748080befe75e
SHA1 ec18c8faaff4a8f0f4ccdd119578ea470b2a5a6b
SHA512 12d3aa4f1fc41d604413d1eaf44b44a8761c641e1a82a3ef412da81909d6b1a725b976b8b0e368011cc979b7769dcd36c3071c0223536c0863b734f6352e5b72
SSDEEP 98304:Ly5112gYy5azzVvt69nLKnhZjD527BWG:mLIHEWhdVQBWG
TLSH
T1E2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9791a5bfa7807f6f747bd5f4ca921c53a7a0c5987deddcf7d32e0cccf96eebab
MD5 b1c3b7a73bb8e488b9b127098a6800dd
SHA1 542ece302b8d0e742b37ed5ccfa3f844dd5f8a9f
SHA512 3fa6e1685ed77441e21ea650627dd626ebcb5cff069d24e935e464ffc7edfefc11ef65892dee7e5501525bad383d9351ad71238c9650d4130e0ce769826991d3
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glxDmg27RnWGj:tu6Jmdxd2dxD527BWG
TLSH
T1EFD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 adcd64ee0bc31ecac9b6b7b35c68ae1d9dbaa5e154deade92c00ee7afedebddd
MD5 58a5b51afa5d4892f40524006d48e8cb
SHA1 88358d50c1cbd75551413e35395867f772576c07
SHA512 49e9514874d1b4fa18019e31d3832748a6e52de4995b8f18ae91a7ed60ec75af3444a87180cf4346f3af6ef9b32dc4ec2188bc5da3df80ac8e6e15f3c084041b
SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4xcDmg27RnWGj:zmifPWR1D527BWG
TLSH
T1A9B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6aead82a116c3e9b7650ac33b2a89005d1a1e2f661b96f6891dcd99bacbc8bf9
MD5 5c434b4b9aa96f7e00ea6c138c190053
SHA1 fc342e7c5822f5779c187d2a521dd5251a8ed84b
SHA512 f6e862d4d9b1c142ba2bf0534b4fb50d37f139f88e7a8720b760e1eac023262940728555588b88703fb020c0ae368c587d1cf58ee0c382aed6e495ec2ea6e82e
SSDEEP 49152:/SuZQIY0Be2KcRVtOnks6NMHqXDmg27RnWGj:F5dKii61XD527BWG
TLSH
T1BDC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0941e0a505b5a2814a55a32b9ab5c1896a42babfb0be89359b09441c75d73fc8
MD5 8ffd68ae8d4146d67ba4393b6021f0a1
SHA1 a2bbd3f18abf04818512b4b5b25961e1d4366adf
SHA512 4af29de99cc5b051aa2d67b54ce0fadaef03f1051460f57236b3abb872e1f71c494575691e8e1a6b564da824c2df25afefbdb6f4414074709393b2abea5ca864
SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5wQDmg27RnWGj:vX2imphxD527BWG
TLSH
T15895BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ac32e1e051347d302666e9fc069756d4ec6234bc0e36505d6acd23733f3e47aa
MD5 0a7f0ba53ef4d1db3a3bae9c268f7603
SHA1 8350e9f93192113153d86b8e6277e961b3fcfcfd
SHA512 607211ecc29b3af2fdbc8dec5eae1b5e90d0156e697e4db75f0df49dbaba11ad0dc1b1e64cb621cb06b1707ce0ee69742ad0f2004b125ccff7b0475fd90ee2c9
SSDEEP 12288:PHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE925C01CBE52649B5C3E5F14EEC073E67E92004937A5778BEFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8b76930b245cfb18deb7a463bad7d4194ecd91811508e906e6cefaf0be2afdf8
MD5 2aecb1355a195458afa90a789004a46d
SHA1 7f4bfba8c2603a74005a45a83518157a10900eaa
SHA512 e45a5d034976c5f276bfc5b0c91b612d4195efa16ab0b96df28032976cb8935b65303226b55b993399ed9769fde28d09b4ccc047121e97c23acd86bd64a06a54
SSDEEP 12288:/eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/esqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BE925C01CBE52649B5C3E5F14DEC073E67E92004937A9778BAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 03b3a326dbdc486616dc930eb583fcddc83fe102c38a3095e442878debbefb71
MD5 cb11519bd283e3cfb56b546c70cae4ea
SHA1 77a6a85445ecedfed021a75cf5bdf34680b7244c
SHA512 efc2c7deaaf5d276a929bfee7b2859586e1cefcdbcccce56c00dececc6bc2dfd37da86350c696b715591512e30463adcc717b3d6d917c2800bbb49884f3a8b20
SSDEEP 12288:+IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BE925C01CBE52649B5C3E5F14DEC073E57E9200493BA9778BDFBB18984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8f25489e4441870f21d81846495c5beaee5f404fd6458b18ddc6904d953e3837
MD5 3c029b972288139044fd5081f5dce3c7
SHA1 7425ea60db09d932aafb2d7d346412e76e4ddeb8
SHA512 734ba2bb43e315023e4edd6e4ee34ce9f2d41ee7382798f336e2ad718e918aed817cdd7e7feea8d3fa7732a0038e4a42d61c7648352aed83291e9fc840d3ce48
SSDEEP 12288:AVhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B45236E535C00C6E83785B4C2F5E11DE8237D96DB30059B6B5328FEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 168c9b7d3138a12e4e990842981518236e180fd4d179259d14275d4f7f81b582
MD5 7047240dc2a1bf85bb85a440b9fb3d57
SHA1 0a31a72f769ef1d7c060fd76caa43c4f58c749e0
SHA512 753bf21afedbafe923b750f6be32cff2571c3c08e137ff8adc5170fc84861c77650310b83846a4aa9ae8041bb2941992f2d04f6223e03e40d6099fd38365a32a
SSDEEP 12288:O5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F4523BE925C01CBE52648B5C3E5F15DEC073E67E92004937A9B78BDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 668881284fc8f61a8907b62466e17b55935116b86017223c59ff7a49dd9516ea
MD5 f1b3710aeec25b7d3aff0d359e8979ee
SHA1 97b7cc70685865aa8498fbaf0c7b906fb3ed76e8
SHA512 f8507fbb238bbf1108559e80f530cc4f9545066db49306b0a5c983d320fb928b2df67bf0a61718f752d50e034e6f953df5e38b58d2dc48effb3b14348bf8a03c
SSDEEP 12288:iyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BE925C01CBE52649B5C3E5F14DEC073E67E92004937A9778BAF7B14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d07723c00a81aa963719d9bf769027c31331f88ee88265867cf25d6703d0cd35
MD5 70ee8f77212d7baa97d21179649b52a0
SHA1 7539b56ff9802a01f222d828b2aea9920ce5c7ba
SHA512 96cb57c62574759e45f9658235e8586ebf17fc45f462f9d5a88482cb4b0985a2b66123b053bddbbea66ca480db41441ad8c61abcbf319e6ed1f469d63ebcc0bc
SSDEEP 12288:C2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:C2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1454523BE925C01CBE52649B5C3E5F15DAC073E6BE9200493BA57B8BEF7B14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f89112680419620ab8e856d27716565c3d8b1e72778fe876d84c8818f0dda6c1
MD5 0b5e3b00904f1cb99bfe9a4b316845fe
SHA1 1f11e4e9de6b2b3de603b6afe19179161b241b59
SHA512 b6ccd08d6bd559411b3c854c2842fd97b790a673509b4034716c13e50006f81a2d778837e62398153cec7d560cf96d618660c55d88a73520ed8044840cd9a004
SSDEEP 24576:5ZMRzFVSO+sqjnhMgeiCl7G0nehbGZpbD:5ZMRzfmDmg27RnWGj
TLSH
T1116501A9B39018F8EC67813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8a560fe31beb79241cd99198da7d87a0ffcd1cd7fa1742bca80aea63e7cc1e66
MD5 0be0c4df02cfdca63854e3ae9ef25e93
SHA1 ceedaa06feb2fee42a2c3929e501d9b039bf2b4c
SHA512 96ff4e265d90d96e81d146941bf43c426eaf784b678de58ba176463301ebfdd5179388940a8110f4bddf181747a9e4fd2f55872d7e223ad6628a22c3641b4a46
SSDEEP 12288:dDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BE925C01CBE52649B5C3E5F14DEC073E5BE9200493BA5B78BDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 42939bff584a7db061ab12290c2cc47e878895b115f395c63e0cdcf03d939d11
MD5 a15c5c47d0a823daa9c79872faf0e1ce
SHA1 e7271f42e892236553f040c4bb6a3a1d70e92b33
SHA512 52c1d4d77850db5f055115cb4b7b743d64df85710e6a2c552e7030f2b1dc6319329714ab2465cfdb78d42afb3b6594d00b1602a29762adb9a182fb20fb2417b7
SSDEEP 12288:1vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E74523BE925C01CBE52648B5C3E5F15DAC073E6BE9200493BA5B78BEF7B14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f39684fd13ba1093077bc36749ca497a66c8d598320d1aee1b8405ce0e8744aa
MD5 fc3faf79cc2608fc68aedbfe62e286a3
SHA1 30d8d064cd2cf6579422dbdedb366c8cf83e9ee8
SHA512 e31942117d6f8457ba9f293a0816ebc127f12d41b3cf3a58b8542b87313cff8e1de95a6626e901ce65a4ba39ec9983fc5ca31c5655ceb5974aedfb4842dcfbf3
SSDEEP 12288:UyPz5L86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Nzy6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF55025B73A530F9D1378138C5A29A06F7327C36472049AF17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e8be3d2fc0a64fc3fa23070e6c9c854a3c3e131941888f43576d23d9aefdae00
MD5 70fa006b1b7e41313e2112fbc8a3bfb7
SHA1 ff661a502a7a3656e754bbdb73f7a4dc41a2d957
SHA512 eafa39a8cc5c6418904816d6982607dd53e9ffd034aca754ec2fdd855b58a924479a03a939686ada9b911cb9fb1055e0217072acf4a3b2aedee5688ed31e1510
SSDEEP 12288:FDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE925C01CBE52648B5C3E5F15DEC073E5BE9200493BA9778BDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 79c6bb4dfc595be8c21d883fa6c8d2b903106e6a7b02ca5a13de5336c94311f5
MD5 dd205556315a2939523eb6c1437635ad
SHA1 ed1a21fc74f8410f7d34506555d41b5bb5806cf8
SHA512 c09c2f0559a5f6c70d9ca61622f93b79567422206021cc26d037a31ca11d81ca6b4d7f4a1b303c90bc1c8f0cf79662131dd1806eb5338dc945f27628ff7dcecd
SSDEEP 12288:ZDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BE925C01CBE52648B5C3E5F15DEC073E6BE9200493BA9778BDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 baa40a591ca2509d890848beb311395435c632288be0734ba278751aa78b3e33
MD5 e434125202a8341c085b2c005d4e7cfd
SHA1 7b0e2d1043800f375a8445cfd111a702c1af3555
SHA512 af9a9be2708d2c8ef2fdc72c91d95b264a98f879f868cdc8a8d31420a550738b3e594766f9b927c18efe43331f0891c526fa160dc68539379f0a426c33872210
SSDEEP 12288:lyPz5L86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:szy6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C55025B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2ce70d663fe5160edbfb9efc047a8532ccce55fa3225a659066c3a727459cb68
MD5 3f43c567671133387dfa04d211ce029c
SHA1 8b11d0b6d40ed7a0e6c5d838574c66b2d9c93f76
SHA512 18069593ef8ba580b5ab94105ec5473cbfc5b6cdc515586b74d513712866ef6cc24e4ba785f1428b7aee9a7b2c89774f2b91adc8bb1e828441c7c0cc64e9f305
SSDEEP 24576:MTDaLl3z0zDYsqjnhMgeiCl7G0nehbGZpbD:MTuLljZDmg27RnWGj
TLSH
T1DB6501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A5366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 85837eccfd6665b6092fe28eedc30d8f61ba13cc5e353f005c8ec50c9007bdeb
MD5 db59d235cf84d08b1c0dcba07ed4c3b7
SHA1 1bd50041bb8e5a5627628c94ddb06ca989f1cd65
SHA512 55b423a65dd21636c891533f3144dfe005742e849f8749777971acbc3be601bf1d4a1b707f9fe1b080c2b67a77c009160a41596246179c9d751800ae45bb7f40
SSDEEP 24576:13vd9CHKy7GZcsqjnhMgeiCl7G0nehbGZpbD:Vvd9CHKyamDmg27RnWGj
TLSH
T11A75CF90F3E810E8F0B79A35C9769511D9767C5A5B30DE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1c6a39c8860726ed2d2bc360a6dbaa04679d890deef217a9dcdfdce055b52334
MD5 9c62df9db0d0230c0648c599dc6f4cc4
SHA1 e89b976249acf98e7a17c58f22d8aaa74fef0901
SHA512 4ad33324feb8de9416b11ca81c9c72cb55cea802679a839e2a3530ca283719c9cceca3515e857230b46068cd14020204e7b7416311a268770f4f4584e2cec9f0
SSDEEP 12288:woXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BE925C01CBE52649B5C3E5F14DEC073E67E92004937A9778BDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 db18e148aa9edf1d809e0da1f46d5f82759d65172279f1fe258ba05fa6b44c21
MD5 ad90f75fc9341206664555f978787017
SHA1 f837b2243b284dc3332f68713e34f8b76759168c
SHA512 18a67f747e3b2d1a5afad24ed023f0fd0309587b541f0e45d8ceb78ec8c88f2b8be62a8adfc7f2fb9e7c2cc9ffdec062aae18b1a0f5d3a070126168852136586
SSDEEP 12288:0aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0asqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BE925C01CBE52648B5C3E5F14DAC073E67E92004937B9778BAFBB58584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cacaf513d2427eda0aa86a71425aed35d2f199aa18b40bee2fcc7c7f3f04ae54
MD5 4749084b383371def9551e7d6784e540
SHA1 5136c07004227b311da74758ef811e46bea994e9
SHA512 a8278195a619c0ff5acbc2919746a9a66750bf014cf975930d97ae682a6a1100d5c8987cc44bd5349676877f4a1aba9eb101d5c26145e1f7d5bdbede7ed3a9ac
SSDEEP 12288:T9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:T9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BE925C01CBE52648B5C3E5F15DEC073E5BE9200493BA9778BDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c1a1ba8ec7a8b753668dad4d2651af95ee05eaf353c1b453d53251c50beacbd2
MD5 4ceedd17951246de71fda6d77b4d4755
SHA1 a162f768df1c1e1ce95ceaade44f0b43590402a8
SHA512 9fbf465ea30841c643e0b5ce968832c7124bfb4dca4b955947aa40378c846dc4352314b916466fcf65461d4aabc1ec1d930be08e343faee1def370d70c2c1be0
SSDEEP 12288:aDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1694523BE925C01CBE52648B5C3E5F14DEC073E5BE9200493BA9B78BDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 621cff4dcb0530768fba09a70b1bcaa1b40055cfeee7906d800d01e926cbdd50
MD5 4ccc69948e17496b183c779500e4946c
SHA1 d460e005f0e978473277d5a0010f6282aa5c3fd1
SHA512 b23e45f0d1fe768c70bf9c31a2aedd2b6e6740e6f1c32af56221fde9c49862e973aad97d769df54ffa6989763cc38b303f2a0eb40cd81f97b2ab7799fc19c114
SSDEEP 12288:toXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE925C01CBE52649B5C3E5F14DEC073E67E9200493BA9B78BDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f082723a0f1585998523b372c96ce60218eea678a841ed46e064e52eef134c6a
MD5 c29447f737e1afe320a6f964a05bf20b
SHA1 78018a686ae6bff555ebfdd5526041339a617db2
SHA512 c8750e2a0e44d03dae70a96f084c31a3253190c5373611396773f65d6ba459d42bf6329a9a1cc76d882c569147974286608f3aaa0fcd2162e2d603d9f6ca09d1
SSDEEP 12288:57Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:57sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BE925C01CBE52648F5C3E5F15DAC073E67E9200493BA5778BEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 868e474cc9151c3230f75ad612eb91d7ef4c63b888f9a24f2b857ce64d3589ca
MD5 b4aedd0d18d0bd2c508f1615413263fd
SHA1 70980f1eca5e6c3fe893271f454a4d7a5477ceb6
SHA512 4b609d832c0ca2c2bf19c4b689dec4c601818d9a8de853f8757f5677e56a1ffb3f39aac1c3cbd957c88473a55e59068fbea0547f9cb0aae93f3130f14abc2359
SSDEEP 12288:p5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:p5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D4523BE925C01CBE52648B5C3E5F15DEC073E67E92004937A9778BEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4195980330f17b449317219f9301a2f992280052b39921dc7ef74e7e25f71b70
MD5 fe93eed241d8d0b28a343cbc86b00396
SHA1 8a96edbb1b094ad64888f04445d1d3770304f716
SHA512 c6e886478aae4abade10ec8a5c48634347736fd668ab1680f2654d0624336c1ba0fad60dc4ff33ed95d39f06da6a21be2091fbb3bb555284a14069e18fc132a7
SSDEEP 24576:YfwvUk9RX6wkyAIfsqjnhMgeiCl7G0nehbGZpbD:MMnYIDDmg27RnWGj
TLSH
T16B85DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9b69b07104887ecd3ce489d309567c3b86dc9623fdf43284226d641e04f8f3ee
MD5 995d247e6dd7d2c76d640c3832f9865b
SHA1 87e916254d852b4308752b976e64a39dd7de6447
SHA512 2c2e7101e520da479117f77cdaf45cf68c93a6dfbaf5cbde734cf15adf906a75fa0db5c9e5ef58d968403826899febd4d5603dfa8af56321ac8accf763cd6bf4
SSDEEP 49152:xYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wDmg27RnWGj:cySzPID527BWG
TLSH
T13C066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8252c0e76dbf363ea1a1768c05eba65eab7b19d841c81e2376f15bba4db1147d
MD5 a4f3b9dfec0b22ee4e2c071978e8a0c9
SHA1 a258011849f886f3254129affe893b02715059e9
SHA512 33c77e84ee3556089d455e23fbcdc910b4e63d03797990eb4b189bad84bd3c4776e42ae3361cc1c79029c3e9e07b49f5b79f0c8d387ae163034c177c6ed826b6
SSDEEP 24576:G47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYusqjnhMgeiCl7G0nehbGZpbD:G47JUQjTirIhCnDHUPfF/gDmg27RnWGj
TLSH
T15865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6bcb56187d5329111524a2b79e7f8ab648f86161e11d4b4c3806c8689e29f363
MD5 690a303b2bdeb1e6ca5cf781576a298f
SHA1 751db99c59fc3fc7c9c36fc9ec2e655871ebd1a3
SHA512 930123afbcf2e0f2fa800019b1e682eef7a5b86914c70e07b60dd88fbbde7bc814559ef647483dee75f58805d5b4a4205a50c07f60434b362a4429fa5c166138
SSDEEP 12288:ibsfTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D355015AD29802D8C06E6179C396D605F7233C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 855cba6a512917f42f3786001d8cf91192427b3cf4fc6043292d439c572328e6
MD5 b0f0741032a545398a9d961575a29ef3
SHA1 d91abfa98b984335b0a18f1b846b389485aa574e
SHA512 2eb9fdb3c98badb07d7abf3abbce4371e50a9253dc66e51ce7908402d569f3ad566af146b40483acb0bab9dcbd0c9d4e5d801980cfdf19527cf25cacc696334d
SSDEEP 12288:zyD+oU3fpxvXMj8vVjQlrcrGaYdJbjbMKV:zSbUPjfarkvYdtX1
TLSH
T145252850766AD75FC6A940321E33C1CCAB707D41FE05AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9b19fd1006a4a9d6d90dcae0b35874f8a2738e737ada9b741f8bba7af5881c07
MD5 03e60a0877f091bd1ac010c78b53ca01
SHA1 99b2bea1c68c30fa08b910f70786436556128fb1
SHA512 74fc7545e08297144bb1497e31b31e6714032340475a02aff772f6514a9ac63a086c1395be74f2c2b0b73ad158ad1dfdafce9372f236d432487919174a067a82
SSDEEP 6144:nMW9D9l6KzFjUdkiK6wNI1KFAkyvrPS26tMxm26tMxrjuT2ip23mTK8:lRUdkiK6YQ023M
TLSH
T12665D7815537A3CFC1FA6032072A9B4DAB64AC0673496F26B3C4453ED82AB2574F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 83129261a2231539c7bc8b1f2ac0f4b9146810c938bff0c4d80bcd622a3095a1
MD5 f72e74f8e8a7f3451f1e5070e3805126
SHA1 0a288a0b1286822094ffe4c038edd7a4035fb592
SHA512 5e23119bf8f98e3a4b97a0d6cfefa8eca4943ddcc16d9a2005ec2471635b58f7323bc213a562fceb20310ae06f71d44c3c46431dcbe615a8d5eb153d7f04fcc3
SSDEEP 12288:Q07LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13345237AD34C118AF93609B482EAE12D681B7E669F1044C3B95778FEF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 07f8dfba951a87c387bfade1f10575205b156a3eed285d8eb5a54f7d9fbd1360
MD5 a4b34661597c77691b4059a68b0cff44
SHA1 90ea8066fbfdb7bb7b228f01d363b0772190aadb
SHA512 59aa62e44cac19d7bd8115422a57213ac59879efec06cb4fb54d5d008f7948dbc7c82cae30ede3a741b1bdf6ad756331f4da14a0d25ded83a812b163240052d7
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYlsqjnhMgeiCl7G0nehbGZpbD:Zgb4mBIBhGFCDmg27RnWGj
TLSH
T1AB659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 0618a4d602e5fff7f19408063c15aebb298be1fb30b6fc2243d1baa67a9cc19a
MD5 45562117da41149795cef4da27d5874f
SHA1 080eaf1cc0472d01ad9dc8e949e87ea774eebee1
SHA512 abd063111af65c12e96045f71f21f52d8dd10f54869772a7cefb629c78091686de85d46307a327b28a637b41e22d956ec295b422ea0712d229d707c9522ad3be
SSDEEP 24576:9G88u8FpJqH1bzria7/m+sqjnhMgeiCl7G0nehbGZpbD:Q7ZFPqVea7/BDmg27RnWGj
TLSH
T1D585F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c777f1c61858b4964bf3a5adb17a080a3330c75b7e5f43ca2c57b6906a477089
MD5 5cdc7b001618bf6cf55351e4f3b3ae34
SHA1 a1dde1aab7f8f48c39b0a6001ff676ba5c0757ae
SHA512 a480394d6fcebf046d8e12005aee22c972444390de15375b98f74fe069e750b26f4319dc25aa12f2c79f1d6328eca4f8bb9cde62514c494ce3c336e8ff803a45
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2Dmg27RnWGj:YG05lO43bLD527BWG
TLSH
T131D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 aa395b3d28590147d4be884eef28f4b616756d1f87eedf46cae1d7ef6ab36aa1
MD5 121b3d88b72b862dc948c9c6b7b2f583
SHA1 34402825f403f0e767139454ea518af8e983655a
SHA512 e3d0cd8831c6c8a06b0343690511494988f0b76588fdbc77bdb4724af4e8438463038bf7ae6d269732e55ec76a9906e4a5a440686c3a1a949d0c9d0778b8c93d
SSDEEP 24576:lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnUsqjnhMgeiCl7G0nehbGZpbD:la5POZ3BJt2pasx2+muDmg27RnWGj
TLSH
T11965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e7a104fdd0438445d445ff41e7ff87afd77e6e742995f1a3f765470a92a55182
MD5 6360bb662685b0bfc38bf4a6b8553340
SHA1 bd674740dc01d340289cb95e3112d10cd8535943
SHA512 672c5859f3ba5f95ca06ffc179a4e3d1fc8046aa73725614daae30b13eff4b5d5915e49c64c1cbaeda750b759202cd25587ddf9f982f712ba38ce19fd3e89596
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkGsqjnhMgeiCl7G0nehbGZpbD:UNc/zEOVHFhDmg27RnWGj
TLSH
T14A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f7c4633d96571976653f8c3f31fc6c801bf76415ca405eba6c482f883f4704b8
MD5 1f28336dadead585e4e81017c1364b99
SHA1 e874bec63377210299f99bd57b5815757d2b5008
SHA512 83328b9e088ce7c5cb5ce7d52e6a9ab61202aab021c4323c67e5ee5dc2765638941911643575948c72927947c9788270b91cc1a3e3acda50868540cc32df574b
SSDEEP 24576:HTkNvNnaFeYhJNtmZBmpsqjnhMgeiCl7G0nehbGZpbD:HTMwBtOmtDmg27RnWGj
TLSH
T1A155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d26e17e02b29e39baf34684924f9d17f616ee835c53f52675a9d4e171e8ad1bc
MD5 767e526a80ece11d70ec242fffbff2bf
SHA1 2663e0e87f2eff964ed77c808d865c26d750532f
SHA512 d87a977d2ad393f7047be9e634ca0e86b8130d28e81a7a121f01cc5ebac00c8b8040618251ba45a25cec90aedf69b524b878fc434cb63dc9eb98a5001f5001af
SSDEEP 12288:cHvUrBFrEjwaQiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:cPUr+NQisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE65F12F62AC18E5E676A17DC582C70DF6727862071192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 829610692f3217dded312b6c845a040a68aac485e79dffae7f80a3a7cea4d20f
MD5 7f96ab378861928410ffcf5d3fbc893e
SHA1 b7f01dca8ad436b87a616fc359a638519b8b7d44
SHA512 2457b0290441e953967f113cd70d16a3b9e79bf47e4072e50a6413808cf49d7614a7966614090f9fa2a522dea20df46cab44ff6f8fe77bbd0d74c8bbcc2640f6
SSDEEP 24576:FD3FHshBIYQgAnsqjnhMgeiCl7G0nehbGZpbD:FDVHeBIAA7Dmg27RnWGj
TLSH
T13575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1812-116-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1812-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1972-276-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1972-77-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1972-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1972-71-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2912-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2912-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2912-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2912-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2912-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3168-59-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3168-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3168-257-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3168-65-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3308-15-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3308-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3308-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3308-23-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3764-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3764-129-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3764-131-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3764-123-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3764-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4188-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4188-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4188-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4188-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4188-309-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4188-98-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4252-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4252-291-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4376-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4376-51-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4376-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4376-8-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4376-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4380-43-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4380-54-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4380-49-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4380-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4380-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5216-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5216-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5216-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5216-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6136-325-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6136-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6136-85-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6136-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6136-91-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6136-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download