b7b8bcf458f2916196ed1a0f7afcaa92a85c425d2aa9801b6ccfa681333f107b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260804-dc3w6abh69
SHA256 b7b8bcf458f2916196ed1a0f7afcaa92a85c425d2aa9801b6ccfa681333f107b
MD5 5f2604322b3b17862848c05c9688fe19
SHA1 c43d7eb8c535f36f2ce6db20927bd296ec8e70f9
SHA512 450d93a4f2a1b91c1775f92cb3ff920fe707b527e1dd73da432527bb93ad10e9470578287c2526fe9e67d78094a40a1edeb99bd5bb6fd684290630405f2a7553
SSDEEP 49152:J+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755hH:U/PvOIjcXvvOOc5nbpi0gYz
TLSH
T182165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4104	elevation_service.exe
5092	elevation_service.exe
4348	maintenanceservice.exe
908	OSE.EXE
1472	PerceptionSimulationService.exe
5860	perfhost.exe
5800	ReFsDedupSvc.exe
2940	SensorDataService.exe
720	ssh-agent.exe
528	AgentService.exe
916	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\58b54fe8238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bdcb7879bc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000498ff878bc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1468bbcbc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c527dc78bc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edd783bcbc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe
5092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4960	2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4104	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	528	AgentService.exe
Token: SeBackupPrivilege	5800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5800	ReFsDedupSvc.exe
Token: 33	916	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	916	SearchIndexer.exe
Token: SeDebugPrivilege	4104	elevation_service.exe
Token: SeDebugPrivilege	5092	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2760	916	SearchIndexer.exe	103
PID 916 wrote to memory of 4284	916	SearchIndexer.exe	104
PID 916 wrote to memory of 4708	916	SearchIndexer.exe	105
PID 916 wrote to memory of 4352	916	SearchIndexer.exe	106
PID 916 wrote to memory of 2372	916	SearchIndexer.exe	108
PID 916 wrote to memory of 2548	916	SearchIndexer.exe	109
PID 916 wrote to memory of 5716	916	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5f2604322b3b17862848c05c9688fe19_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4348

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8ac1c535b9877431ce3891a6d6e8046fa34e947113337064249a3699218adcdd
MD5 486b93a5e99962fa6e488d499ed97904
SHA1 d6e947c3e3b741f3deaa2618362a9c2f6cc5c742
SHA512 8473e60a0dbb7f5816d92ec8cae41b6994e7d137b7514d37e786f6fd4897a6f58e1b35ecbafa32810f3aa22bf99f863551caad3ee37c68ba243b833ffcbd99b4
SSDEEP 49152:jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/8U7twh0gYUub:B3q6sjBwbpi0gYz
TLSH
T1D8D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 543049ec0f4721b0c98db7f4e054c687867f6c3a042ff647c6b86e57d3dda4a0
MD5 fccc5131b2c142d35506fcfd407e0d2d
SHA1 c5f076076e3c36ba9eafc9006132a3266dfad694
SHA512 1a063fab38c42d542b914bcb84e20338ff4fc65837ddb9c0fb179013c7cdded8353facddae13af1fda061e3033dea34b436af3ab96e5134065c21ebd40fb3594
SSDEEP 24576:6XYfDtczA88U7tTK3VnChd4Q4PQpUcrf0FGDQ:htc58U7twh0gYUub
TLSH
T1B405F128B3D108FAED674239C972C511EB327C554760EB9B03A4AA651F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e9b7139aabea67b6fd49ddfc8206b0ec81017ce46b6bda86099193f5682e4f40
MD5 dce572cbb591fefb88642874d8eda975
SHA1 2e794011113f67f961b38533eb00c6728b7c25a0
SHA512 1c0f80db5f1fe16af5115b1a600a1fb1ee5a64c0dd92cecd3db58cd19825064453e4b3a2c3f48d94b8845bd9af6fcfb1899d028f43c1f6a4b4257b2df4497e38
SSDEEP 24576:W0Le5ji0hmxxrMW8U7tTK3VnChd4Q4PQpUcrf0FGDQ:WPji0Aj38U7twh0gYUub
TLSH
T129359E15F6748335D073C0B9C5D2A69AEA7130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 50a672985b888af32808df66798a61b340a67b234260bc404750cf70208375e4
MD5 5556d11d1012c2feaaee0046d9dceb91
SHA1 55ed87f7a844eb323d7f50d27cb2abea481d91f6
SHA512 852c871e750a419c0e436d43b9325ef585550750634414cd79487f7cd456960ae34a20722097a3ca726edcbe7fdb384d43810fe007b3da9de345c8566ec246e1
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWn6q8wyuc8U7tTK3VnChd4Q4PQpUcrf0FGDQ:T/ezSC6vUzPveHjyz8U7twh0gYUub
TLSH
T101755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7bfb1b92df412d3ce09ff34a226ced00a10451e5c36e4668a2255122ef791724
MD5 1eb019f73ff02c427955936a58756108
SHA1 fa78bffca02dc707f73790d7b921b483f35b1ffa
SHA512 c2224a34d27c4972cf413f30ad17b9d73174edb5a1abf58d151372f86fcd8f3852900cf536fb9c84c41500e6863ddefb5682e4ba6f15ea1f3ed2ab57a09fea93
SSDEEP 24576:OVbqPb88hv/l+YB8U7tTK3VnChd4Q4PQpUcrf0FGDQ:OVO88hXl+k8U7twh0gYUub
TLSH
T144559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8ddcfcef5d164c4807060fae966f979ca57b9a79e51293c247092aefb8b23d38
MD5 e390e2cadca29d20a6874c5533e4edc9
SHA1 d73db1f143431652371483b7c096b65f28e794ed
SHA512 e151451a14f49e03d1ab1a920b2377ca3ed90712a6d8c102ca13b494a9d55235b7d77dce6e031798abb605d68c888586ed499378f4672cb704f10473edb665d7
SSDEEP 12288:ULQN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ULK8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T185C42320A3858807E3662B33F937E9A4EB115EB45D44CE251460BEE56E3FE5CC9C9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 cf78f57d334e0689a9c46767e505163be4f5fab77e12163cdb48bf2c82a018e1
MD5 b40719e7612682be0382d9ede1105f22
SHA1 28ca69dcf21df370a7ac3966705bcaec32a80dfa
SHA512 eadba2dc22733d52a124700169ad2644a72407ad2e6112c66e07c71de0589fa6c49ff4f5bdec91d96347c0dfc5d07b9b3d0d4cb2aac19118e335cb1166ddb56a
SSDEEP 24576:xJIU58U7tTK3VnChd4Q4PQpUcrf0FGDQ:xJIU58U7twh0gYUub
TLSH
T14605CF3BEE28FCD2C27A5D799A61C640E76278304F51A3CBD164830EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 feeda648ecdad39f1f0fa5bf3b44b0c2de7d9d8591b262e007a31aaf670eb38d
MD5 6d8c58f7f0a714be5520e536787302fd
SHA1 0b79840def4cae1f518abdea1a380caec6e5b0f5
SHA512 f1f69d39589f41c0802a527ea8f3bb3fec4aabb205321fc1544a8a4a60297328ab6b01b680fceba220e0ec12092e116868884ad80b63565bcbebd27a9d591d64
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THR:+QvGAdlCEL8c/DRNw5CMbpi0gYz
TLSH
T16F266C656BF880F5E1A7E134897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 107442738ecc8cf95cbb26a91ccc467ac5fde03c0ef2f7759151baeb0e13ebf3
MD5 998a2287d7831cc962c72d6c34f5f43a
SHA1 eb68810e4ea5b7b0ae8f15700bdfe1c32e9a594c
SHA512 4d349faa03acf34e290f53e68a25b760064d2278b1ba318992bd6749ec106a5551cb4e195cf3c3e30fc544f3b7f82a4642eb370686e1f4c2a1885f94ccbcbbca
SSDEEP 24576:g0ewsAjn8U7tTK3VnChd4Q4PQpUcrf0FGDQ:Fljn8U7twh0gYUub
TLSH
T1C415E030FA74E436C37B0DB22B36C716582C7A204F511AC3E3A89E9D5A346D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a1e0301371b111b2b5b0b1e7b6c2eae8e057b4ce901502090bc121a2c947466c
MD5 f4b435b7bcfb7d9ba3f72a5044603f21
SHA1 49bf3e046636b310973ece97a3d4d4ba572b28bc
SHA512 ad01695bfbaf48fef6277d7f6f59c58ed0aca1f7671983420a042f356a8acf2394776189a1700228d4c10d49b43f06c22e7275e075bc31be93e452126be7daba
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHUH:QUEtQevvqc2W1cpV2tI32o
TLSH
T1E2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 66c3b1954f2d7e62609c2f62860fa164a21d35192efabbffbdf3f9a122051fd5
MD5 94c53889e572b648b91974df05ec3271
SHA1 9228d7d375c0360436d5883094377f6e6a8840e6
SHA512 b0a0ba830ab6d07b1f606d25ef5581d791604f78e70330e5dc27a90b70bd9c4a859e7156b741d666dfceb34842b1a58fc493680a06e89aa635f9dc4e4f754545
SSDEEP 49152:DCbRquA/m2yL5zTfFiV+XenmE3/zH8U7twh0gYUub:8oquVjnmobpi0gYz
TLSH
T17CD58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0241425cdb3616b9547446510cc32def1bf022bae2d9e8cc9553bfadb403ce08
MD5 0954d121fe8b1c74435720fca9b94f5b
SHA1 baa597eebb41108e56c1fea20ef31152af172074
SHA512 ca3dd2c22e14db50e46ba014b075567330a6df9d1a1e647729a67b68c99c21ee4935ef7704cad5ed56b07b6e8dee71ae2dc2adb549adb04f1d1c2d925c712239
SSDEEP 24576:dAhGL3IFoiwtA5l7S53I8U7tTK3VnChd4Q4PQpUcrf0FGDQ:dAMUFoiq5Y8U7twh0gYUub
TLSH
T162359D80E7F955D4F5B3AA78A9769570EA76BCA65E30C20F2160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7023e31387baaa7de2e894b90a03d77a8e1dfe3416088508c79afaecac0deb54
MD5 0a5b7678e9fdd1a9bceb02a25df2fbae
SHA1 29cb99ab544abc64b66f8b406d1b0cd67f745b2c
SHA512 75c578d4e5a78490f957019f324dd610054068226033d25b6f6dd012bc256b1d5bec856dc70c2704e0ee3eb537bd97611a6fe6ff152d7664fa8365311c33a3c3
SSDEEP 24576:Iwu4OWT8U7tTK3VnChd4Q4PQpUcrf0FGDQ:IwvO08U7twh0gYUub
TLSH
T1E805F04573A40CFAEA675239C567C536F7B2BC112A20CB1F1760CA5B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 13618420c7544025197da63fc4a154908735f9dabb66450d74d49b75488baa37
MD5 42ed5eb6472fe0c8f8412f56e54eba39
SHA1 471388377b630f2327a1e24358b7aeaae96b21a9
SHA512 5677124d4768f0fd980fbe7bdd26b5aec25ef497f4886eccee311a5972b7845bb34d46f7cbba477bee61f692a348f3d7834b1b0bd340d1e38579fc236ffbed1e
SSDEEP 12288:QeZ1IyBN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:xZuu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T129E4125433D460BAE363133AD9B29A54E7327C62273483CF15206BA52F37ED58D79B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 70642fc1cbaa6169fb66b5f80f2bc6851b5f496758941dc7a8e124324e0180c6
MD5 7167e0ab33efe96d30ff2803ac3149b6
SHA1 0851f96c1b011943cb531d305647e7252aa926ee
SHA512 1f61510c8714cf600c96d84473cec77261b1076ed0ff3a03b6c3abaa4684e3252218bdb623e41fd601cee14b650d529932f5c88dd6254ff66e5b2c037337cdc3
SSDEEP 98304:NQRQyi36YOcPbLvw2gAf+PN3Fbpi0gYz:kQyiKa/X+PNCH
TLSH
T155666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5378af88d97b148c8a89a48654b8e60df8773cc05466bca195e30bb50159ca5e
MD5 c830d22f24302549655caa55ce1c2f51
SHA1 5fdd6863397fad090807da9fe7640f260e8a9302
SHA512 8a218908707670fed7b8ec124d41a9630f4c56227616aeac1fa9684c754f3b440f79ebf90434e33aa6f06a6031e79eac16c6c44fdc2a31279f49f9281c43644f
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3Fbpi0gYz:XQyiKa/X+PNCH
TLSH
T156666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 978604581311d82705c5265101fe65940684db109ce20acf135941bfecf8b3a7
MD5 ad6b8fd2d4f203116609cdda1f9283b7
SHA1 2f1120b2790a0ce943509c5471ebc1d6bef72959
SHA512 bf3150933f1785dcd70c2d2c158c0e9828bb279b09e41472c510a79ac9701374941c17e1c07873408c51a67e3f6ab790b47abe956bccb2e26766aebc8985695e
SSDEEP 49152:F68Qg55nhceWu7PNU3/38U7twh0gYUub:TthLRc/3bpi0gYz
TLSH
T19AB54933B2F200A9C44DE1769F4A973196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 19ee27868bb9e9d31fdad9498eb893fb2a809224990669588695033ab8fc3719
MD5 bdadcb1737c00e34d130ccc2277a6768
SHA1 0b5c63b662cfec0e2b640690f2901545a7560e02
SHA512 172dd440079e009341f860001addd2672b07ae37af354bcff6663a32ba786405e9cef32284accb8ebd32b4281c07522c78034eabb0eba86176c0234a25982bfa
SSDEEP 98304:sy5112gYy5azzVvt69nLKnhZKbpi0gYz:tLIHEWhlH
TLSH
T12F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8acc6c946d3b3b577ada364999d6b4ace200f0f3ba08d3ccb9f59c5a8e12916d
MD5 311b935a21b2b0d4d4ce5b1c748ea1e8
SHA1 feec8c6082162a17968cf750cbe454c5d1044ce3
SHA512 237e8608afcf047b98d2a4c15fdbcb772100ef6c4c438f8b4f6fbd5b4ab133d85a3dc6fc16b84a3eda277e8514251febbc07c2fed3de45d820c2a8848317cd99
SSDEEP 49152:RB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gls8U7twh0gYUub:Hu6Jmdxd2dsbpi0gYz
TLSH
T16AD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4817bc4a1830163a246301084b5b07a052f385997df045044c9d59595c6f03cf
MD5 a66c32b1587a4f2b1cff79f7cbb64887
SHA1 df3b055ad702be70481253680d2cf3b4e1ab112f
SHA512 e565fff2c21c3051f012b0ff670f1a91546ef13492ce060c0829c739e4674c1c62f1c213e716c57717a0a7ee64a9691238f5e9f4ece097ac3138117318ed81d9
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4xZ8U7twh0gYUub:XmifPWRobpi0gYz
TLSH
T181B5BE13F2D900E8D06ED17887569632EA62BC460B24B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 eda0b4af87c2e993531879c146d6146139bdb5577c4c606fa1e19558c2756f93
MD5 cc0e070fee47c54ee5fcd5ac9f291a58
SHA1 0863f3f1492a5b44dd8ac1be6e5ef58e43daf68f
SHA512 c24e723e6f5e536337ff3def924520530178ed06f72e32f3618ee50036c4f19520f510f78be760c4107b6363537c1a5f8d75bd1bc999ad6ebb7a128e193cf8af
SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHqu8U7twh0gYUub:k5dKii61ubpi0gYz
TLSH
T198C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 69a36283ec88587544dc63db6b63194813fc9b1df4211484fa42c1ea3b68928b
MD5 2218afbf016b34d7ce3b937b44a99679
SHA1 7030b26a5923cb807e001550aae550e59f23b5ed
SHA512 65325d8a8f42963b33ee688c51e3207923fd09c2a80949e1ec6bbb7bd27e075970264f040cb3c8c1073e307bfce7ff38ed837aecb1dd1e655724023ed2b907b0
SSDEEP 49152:ihtSn8EApI0fig3giDn0AP5wN8U7twh0gYUub:DX2imphUbpi0gYz
TLSH
T1B895BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 7f1166060306055434fe73b32edf3153b1a8334875b955a912dd0dfd333d1647
MD5 16611444135f84157d596e3263b30da0
SHA1 6314ce60f95d0d889ae390472ecaae45e42d2017
SHA512 680149ac266d94db8797c5b3153e52e03581b165dfb4ffa0a2dcee5e7d9bc3a6259fd46bacd50d24a5b053ff5117358bbb0300f9170812b7d5d14ac71baecad9
SSDEEP 12288:lIN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:li8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T12BC42310F786480BE3112733F537E9A4EB141EB5AE448A292550BEA17F7FE9C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7fa5b00f669d330cd153e7e8b691d65aaca2663c195e514fd61d6f39e309bf4a
MD5 12614fbd802abd79b10841048a17e417
SHA1 8681c4bb3e31abc8a58198e63962e6d670532a27
SHA512 26289f99a3e180b0f1ffeae0eeb46c253bbc39eeff95d511119a1da4782da55a6dca6f3577238bc068e5bd704f98ff3fa343dce5da58af8e40f320929816524f
SSDEEP 12288:1FN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:178U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T126C42320F7964C0BE3112733F537E5A4EB101EB5AE448A292550BEA17F7FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8272c0cb5769be629a5b83900e65bd949611f8ecb9f8ca6b376da2c4e56fa333
MD5 cd885afb1a42a034e5978d80e5082fe7
SHA1 6bf90e9f9872579ffc3f171b1c0f3a3c01843c03
SHA512 8e725114f11aa2fe8f59d928d825efccdd27323e61a5069839d0266f3fcd978e5a394ada813cee256fe23c3ff7bcc26a252c656625209bb11e4f02b24e0d4b67
SSDEEP 12288:X7N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:XR8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1CCC42310F7964C0BE3112733F537E5A4EB101EB5AE448A292950BEA17F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 18a9557cb0044585a3f13a1d757aaf57408794df7fe71f89900f618afd1e29c0
MD5 9eea1933f3a3c9ff57de80d430ce45c5
SHA1 832ce658694a0b861164a2f408e779c2814fb000
SHA512 e7fcad01f483350a0c2b865d7666e3129f34cd41149c94e5f07c8aaa70150a3abb55110544677c00b5d664cb7f3fc076de432b5cd1d668429377a6fb28ed6dac
SSDEEP 12288:OV2N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:H8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T19BD42310B3964487E2222737E933D5A4F7217DA4AB108B6F19107EA52F37F9C9DA8F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2f980acf59899cd8f9d17168cf8fc015f52e2b1155c3b237eedffe4effa93922
MD5 74cf2123fb6009b099da15db5b926af4
SHA1 56fd10337d78511aa89ec9f4427ad378ae4cf281
SHA512 fd4f64d525fb33944385a4460511dfd6b6776b47624576eec29eb4ab6b08bb299a63b1c68fb0082882aee1633894d23a58e285466db3cf0bc465242e290a9fb8
SSDEEP 12288:k+N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:kQ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1A2C42310F796480BE3112733F537E5A4EB141EB5AE448A292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 345e242c8e4d3272b43d456c707162528bd8972d8e0c35cb3d19013823cdadb7
MD5 d94cbf2d7dce9478ca9ea200a8a5b5a2
SHA1 a34a2bbb710b14d8ae5815fe6b67ba97c0334813
SHA512 e955ca7598defd653fc6fb4b3bca0f583f2abb8701973843496a9d9f83345cd93ef3ada55d4952fb557b86f1de3c99c16d66fae4a04cdfc57f657f780fba5774
SSDEEP 12288:rpN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:r/8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T13BC42310F796480BE3112733F937E5A4EB101EB5AE448A292550BEA17F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 fcfafd9a41d5cb1c0c686b4172be1f86d6120c3ce9fa6a9e49b7b52b85a4f273
MD5 7bf2cea194bd1feb4da89097759c86cd
SHA1 e90a933f4b33fec7a333c71cc02bc59f6d09b3c8
SHA512 a51f05fe3e35909194785809314ed9d1aff89481a159322ea81d4812f70b9e7afe16cb7efec7bfd7b70ec4120739fdc5a4743b6b512905aa5c5c0ab4a65d570f
SSDEEP 12288:kNN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:kj8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T107C42320F7964C0BE3111733F637E9A4EB141EB5AE448A292550BEA17F7FE5C89C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a66015d1e80dd61b86b79810e4eb9063fed99b3ec5676e4d454383e5e40556cf
MD5 9f077de71f67c8c2a8481cd56a125eda
SHA1 5333f25b21fafb086624578f91d9cd3c09ef7219
SHA512 9701da2e1df3fa8107c1b765e6ace0df285a5627dc68cbbe2b5be69d0206bf241dd2278b609af57dffab0de510817e9e15e12b96147433ba5c4dac16fb93f7eb
SSDEEP 24576:zZMRzFVSOb8U7tTK3VnChd4Q4PQpUcrf0FGDQ:zZMRzfv8U7twh0gYUub
TLSH
T153050294B3900CF9ED63423ECD269915D7B27C690B60C61F03A43A665F377A05C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 aea1c5ec16d9ae7421c8c38864678f2f554835ecef9410377a986333b1c38f79
MD5 b09bf1d1ef83eff665f590d10c03de77
SHA1 8d8f1770dbf84e623240c25324da891636e831dc
SHA512 caad8e074394917483eccca1f926b086aaf244e295f562ab447b8d65c7c671ba7607e6b9eda40aad23a2f84bd88f31ac68f4de8813d81656e8a68196eb0ede2c
SSDEEP 12288:a0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ae8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1D4C42314F796480BE3112733F637E9A4EB141EB5AE448A291550BEA07F3FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a7422bf6b3af61a3e49e92ca49b19b239c1d57cacab9610a85548d50e6eadfd3
MD5 9c12e0c8661835b8d5d6177ed8129ebd
SHA1 fece82840a6bfc391a277f69d012e81d90ccfd46
SHA512 f35fe84e47f7ef98fdf528eb402276a8deb30e6038c91741a385cefe0d434392bfa4a8f159ca3fc1a06e91d102b277e7908d59483152240614713954e5d1ea9d
SSDEEP 12288:KAN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:K68U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T177C42320F7964C0BE3112733F637E9A4EB141EB5AE448A252510BEA17F7FE5C89C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a92dc15c9454e7d8ecf13664143475197d4f21495c08ac42033f87a0ab77eea4
MD5 b8bdc3d97241702b8aaa09e4b1be962b
SHA1 67437ddbc67c4d49b36456daa8f077f242cb1821
SHA512 74166ae71efd45782e3a7eafba94df84453b693a11d578899a1c098ff366c6b1b811c3c73b32d3f2e310ad5e7d1b2222b72e390b8d153b6152c039b23d2545de
SSDEEP 12288:tyPz5L8BN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:EzyX8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T16FF4021773A120FAD2365235C8225A51F7317C324B108AAF17606BB62F37AD49E7EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4b8756684b149f70f5b95cd9b6ee58d8b3e25d11e87bcd6797141680124434df
MD5 09baeffaf94a69c10ad28ee2ee921e3a
SHA1 0c4d4d833ba8fd472756cfc4dae43722170a7069
SHA512 d8efaf39c339d85c480bf5c3bd70439d201a99ff17a26a768443d14ae2e72aa83fafe256be213dc30eb407ca8b92165e8b94d1d420bc8081df2b5c50e157c301
SSDEEP 12288:V0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Ve8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T170C42314F796480BE3112733F637E9A4EB141EB5AE448A252550BEA07F3FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b928d428bc472100a37abf23b4961c9eee308dc4cfecbcfa6d16e8ad60169a10
MD5 d0e00c18ec52ea0f3b81c7291bb252e8
SHA1 04ba00d88c5ba639a02bacedc74a89984263a178
SHA512 212ccbce9388ed134bf11142d4e45125588cb9b6b8691857bfdcecb3900198fa89507665139fc750dd2c3f4153f88e14ea9006bdd9bed3471a1a798aedff07e2
SSDEEP 12288:c0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:ce8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T141C42314F796480BE3112733F637E9A4EB141EB5AE448A252550BEA07F3FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 371ec2e87bd5a2d7a600b85698f0657f26af069820a3ceafc47856830300eb61
MD5 52543f92e37a0fb25323b0d59208372e
SHA1 eb2d828412240e4aefab622d78895e4ed93be878
SHA512 8629fce07cb25375a2cbf465b36630ec1999d2b9af9d5c04afb10720a47daaad7a84e12f2a79e57d9405de8a6ab6da0072e1528c2f16aed90ffb22b7409ff2b7
SSDEEP 12288:YyPz5L8BN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:5zyX8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T191F4021773A120FAD2365235C8225A51F7317C324B108AAF17606BB62F37AD49E7EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9b2061e193c9f9a86568cdeb37a0999011c81100623cf27ee9a33f741d4e2562
MD5 896f8986abc41ae684fab16fa97e29e9
SHA1 c7b75f9268a00db5ca6eb012d5f00a60fc0f88a7
SHA512 2312f2aaee3a332383822b5de03d1388bfec6c2f6ddaaab0965f807d7935513b411c7f9f3a0af620672feb6632fac19e8a36a9fb41f51a96ea3ee7a9e78e73e5
SSDEEP 24576:PTDaLl3z0zDh8U7tTK3VnChd4Q4PQpUcrf0FGDQ:PTuLljc8U7twh0gYUub
TLSH
T16A0502A4B3900CF9ED67423ECD268915D7B27C6A0B60C61F03A43A665F337A05C6DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b9cc68a3f7487769918864c2baec6b54d9feb4017ca603adea6411eab4e2a385
MD5 a9469726dc78bda6a3837422ab05f1a5
SHA1 307057e17aa1397a800bc84db82b9e1702183733
SHA512 1650122b4d182d56928d8e604784adff6fb5bd5ff1dc17312783a7ab520ac08c4f2ab8aee11e2904ecff03ba84faca6fff03aac6bdfd93cdca8948da431d10a1
SSDEEP 24576:Q3vd9CHKy7GZl8U7tTK3VnChd4Q4PQpUcrf0FGDQ:avd9CHKyav8U7twh0gYUub
TLSH
T15325CF90F3E414E9F1B79A35C9769511DA767CA91B20CE8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9dd7987ded3047bf9f6c6f1e36f4dc74f6f3af7400a4d4e430a9e271fafb0d30
MD5 9c502842bd641f6722404ac4cc42b79c
SHA1 e861423e786f63b138f781018299b4e2bd015de0
SHA512 f847c80e04387ae0893f202849c8413533d376b9c7c9ab796053a96c092aa87a76e6a0b52e07fa2f15944e91ae64c8e879857e4714b4074c663040c18941f3c3
SSDEEP 12288:qbN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:qx8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T102C42310F7964C0BE3112B33F537E5A4EB141EB5AE448A292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 14a90ea445fdadd8b49df621df405ff6f886962f52cb2ffce41338c2e798f023
MD5 d73700fe1c157b678583117eb93fd4c5
SHA1 c326ef4e5509fa2684dbb7023c1cb40b5e8ac797
SHA512 0ebbbdb44eecf69c4042f30d5d0df5bd46b40ce4477f525fa5217ac99434f254eb05b32c78135c697e7f22de070ca3c4720aeb7425da1f2494b97fad2805ab49
SSDEEP 12288:2hN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:238U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T149C42320B796481BE3112733F537EAA4EB101EB5AE448A252550BEA17F7FE5CC9C8D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 4772176040cd71aa724612fd9668b5c7421582f0c789b6eee9054b5b8beb75cf
MD5 37f138b4858ecc26eec4b0684ba54071
SHA1 81f904ba31abefb85620df659696c526544f78e6
SHA512 de9656122d535f202d38fc7ab306706ca3628dd1472b6adedc752600d037d3d837707e7916712da2e7dc18e516588eade97a1d7d23ee941b9cb072d207ce89f9
SSDEEP 12288:wiN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:wE8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1ADC42310F7964C0BE3112733F637E9A4EB141EB5AE448A252550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 85e0ff0611f5bdaf299590da0a865dbe325616246937ac0ee73c44fac46b4932
MD5 18339100b9f465f6ced236be511adba6
SHA1 05e9a05145866aad486930fbdd44288d709f8100
SHA512 d322ba7e6d6db2339083d2f601d601899b4a0c89114a98c5f61bc3cb9daa7132731dee9e79b28e837c5db40e85e08b4390d4d9eaa12a69757c98d37a2c7cc037
SSDEEP 12288:S0N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:Se8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1C4C42320F7964C0BE3112733F537E9A4EB141EB5AE448A252550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2e5fdde60ab71995c5a2bea9fb2674012d1a047ed2d25265cfc4ecd8bb991211
MD5 e00aed1afa005ae5a430daba4120c434
SHA1 8df52f3262307ccec8ff462d41f1f3d935a2ea00
SHA512 28dbfd4f705bf55a912803110ed06a5cf1b3c7ba00736383aa84343e6f51edf20062749e4457268525cb746ed727ea664171ac56e11ee7936230855388b89338
SSDEEP 12288:mbN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:mx8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T198C42310F7964C0BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89C9D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 ef2dc3487275da347d1268958c69b756255c0361282af4260c52f031a0d2b4db
MD5 cd4e0e7500d4ca07a57f0df758c40957
SHA1 3a250f6590dbc525c396c6e3981f4f9caae95eee
SHA512 ac8e0fd5e52b140ed35dcb6b3ead66080cbab3d0a1c49967268daa7c9e658dc0bc3a924be499bbb385d4d734f6f95d0360b587a97fb1b70d3f97330952510e08
SSDEEP 12288:/8N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:/m8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1F4C42310F7964C0BE3112733F637E9A4EB141EB5AE448A252550BEA17F3FE5C89C9D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 9d2c2aea097f53d02786b73854684893a26b11bbdf4cb8cc5de84a9fb67f0493
MD5 c00f4ef3f8f757e1001c0e34540335fa
SHA1 44c74657dfacf167090c076408aff6a332b2dce2
SHA512 0849ff20403d70e14e26ffebd49ccbeeecc36ac15571cb1e907dfa4698e4ae4d3701496129fa94ca3b80348367c87f36f5f8686bb7987d8478b8e8dfb54eee30
SSDEEP 12288:Y+N4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:YQ8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1E9C42310F796480BE3112733F537E9A4EB141EB5AE448A292550BEA07F7FE5C89CDD82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 3683aa8d2676ef20e7369b104eeea80b9c6e4484a8235152679cdef62684d0aa
MD5 f4f6bb2c00ca4ecea4c0c73a1ce2c578
SHA1 9717e68e8b3d56dec22210a823d55ba385fd3389
SHA512 6128e3ef0a7e5b4bc74407e8b3eec620b67d4e940983e94eb98ba73d33d5b05728a5a061faf8573a02b126ff68b7e1f3b2ecf08142a57fa9aa69615b3223038b
SSDEEP 24576:ifwvUk9RX6wkyAIq8U7tTK3VnChd4Q4PQpUcrf0FGDQ:yMnYIq8U7twh0gYUub
TLSH
T1A835DF29EBD844E6E177923CD9B3860AF6B178681B31C6CF025A53AD0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f4257f3f8239e9b0df12a6b185e19a659c9ebbd9aea3cdc4f201b49eb9caaa99
MD5 47445ed45f8708fe8a50e12c14cd714b
SHA1 3b53cbfd71897fe7b45b5d0f7738a706a916cec1
SHA512 a99f934d4996503673c28c28132f2fa1eb7a132f0248a3ce169ca7909e557074008c37100fe2332c5fb8355a09b8f811a0a57a465fbd76d9c9efedf149bc8f62
SSDEEP 49152:2YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0t8U7twh0gYUub:VySzPlbpi0gYz
TLSH
T1D4066C96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5e22e45bc2edbce4dfa6939b611ac2336dae22b86b3e910e5bd00e3fbdd48382
MD5 d045817296315b0a430445597f03d85e
SHA1 d4b0c514919fac92332ba767d1647e2290e7dae4
SHA512 86ed14a63618bb8632ce6a5ea466bb299a7fa6edc443f5074e2ecb8cc859b320c2a5de5a4bfa9b3e30c010566a1fdd0e00484590d757c344d2e13fcbdd6493c4
SSDEEP 24576:O47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYL8U7tTK3VnChd4Q4PQpUcrf0FGDQ:O47JUQjTirIhCnDHUPfF/d8U7twh0gY3
TLSH
T19D659D1DA3EC01E5E1BA923885158A5AEA71782D1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f7858cedb827f5c893b161e73298d7fd1c07274b278e892d1e8c0b3a8d769830
MD5 c632c01aab9861aa3fb559cea93e1650
SHA1 34f1b33bd7d79f0c8777c362a24ba2519722cd3f
SHA512 bf15a35e49c4b868ddb43c5e97c328de4169d2be37ab86e49198a798f2d3b73f206757d0baa73f5dd4b28f6c4f5ddf402658ca2a6567a098d34774a67a8669a2
SSDEEP 12288:TbsfEN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:mu8U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1C7E4F118E39401D9D16E2236DB269A40F7233C6597E0D3CB16D0F97E1F3AA949DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d27fd0be5f9e41255fcd1cd156b92b3e0742f594d6a21479c8e2f0a90ea58d20
MD5 78192ad2d36a237f485d2643e4576514
SHA1 731975c1b8a9c7a419594052ec74a64bb8da24bf
SHA512 1fbda44732ead7039fa2e65c9f674817ce44bef7f27b98296c717edcc05df393210b022c7136cac12b3f13f0d74d6c2b1be6a2b8bb66994ef750dd7014218045
SSDEEP 12288:UjoyUy516KmwYr9HkHpKI1hGjrq8ZQ7L+3:ULUNP9hkJKGhGjrqqQ7L+3
TLSH
T1C8453950B62AD75FC6A940325E33C2CCA7707D05EE056B0772C8973FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2031a483c7c9a667c05f44913f1f77b3191d3c46c228469dfab40e6e284df6c6
MD5 69be096ae09979a05eec9ab1b6d8bab6
SHA1 117c4d9dbbcd93558573ca898a652a4e867d9593
SHA512 e4fb6dae3e84534c03ac3da47e0c52691193bed1a5a6f0d8dbc3c6b3321ec8825372787b664abe42c741f3f2d8233704d17a844cc8aa9ea3358ed6be201c2b97
SSDEEP 6144:jT/g6r/xiTFopfBI1MQpQLIGzwmbnx7KDexHftLnR7KDexHo6eWaQtwlParTDtrh:A4/xiTFopfUObnxxlnRm64VarTlPTlf
TLSH
T12065F781A137E38FD1F76072472A9B4CA768EC07B7056F2673C8453AD86A715B4B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 651b73e24a3fcfe4474b11fb8deb53ff32e5c99ca6aea0c412791f7c3f6ade2a
MD5 de4f6f394ae8c7a8ea98fca624fbe95c
SHA1 0a69f61021794fe28acf8454c1e9a2490f52b3a2
SHA512 fcf06b4afddee2de01b551de3fb5b879314deb03ffb09ca3f1390dcf659b35cbf5099d75eb6070054fc19e4be4ee916b4ce030509863be898c9875430de41582
SSDEEP 12288:V07MN4h0qD47w4PAQFg3VlKQao2TZnTd1q0lTUplQpUcrCqtCFg9X40Q:+28U7tTK3VnChd4Q4PQpUcrf0FGDQ
TLSH
T1BCD42320A3958C0BE2362732E53BD574E7157E745F00C9A76400BEA56E3BED8CDE8E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 87d4cd99304fbe4adf6b8bd0b5539e55b295893ef8bb5fc6d5db7af32723f9e1
MD5 2fedf1e418468e8999766320b7e990d5
SHA1 0aa5cf0df5ec41d2908b5ef512d9431c239a3e7c
SHA512 bb05b3e8d060cd712357de8a586ce1be041818a7b76e78f1c4c8ed2284171ca160c87ee87741353ef5446760fe6a027687c49339ccf4ad855df3747a80ab7585
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYc8U7tTK3VnChd4Q4PQpUcrf0FGDQ:ngb4mBIBhGFL8U7twh0gYUub
TLSH
T12D65AE1E22E802F5E0F6E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e56fc8289f0b000f1d2b5146f4a1ec6ebab4a7d7868ea42929e3e6679d315075
MD5 757571723d2f0874f56bc6aa3b70bdf4
SHA1 6a1f1c3dfac74064d91043a8919d1ee2ef71a655
SHA512 afc19886b5bf9ef37202e43ddeaa38565bade0c5e4afc1d2f8c4280d539c860c11e20dcd7e638d41808a9c32c225a0f93e4de39abe5a5627e9da15e00a342822
SSDEEP 24576:IG88u8FpJqH1bzria7/mb8U7tTK3VnChd4Q4PQpUcrf0FGDQ:r7ZFPqVea7/k8U7twh0gYUub
TLSH
T1C635F165B7E101F1D4779138CA528663F6B2B8250364EBDF06A88B511F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b70ef9c6d6284a4face6aed5ba6b0229fed18f26d2391cd71532ad0f112ea429
MD5 c53abd3536df9f7153be13f66ace31aa
SHA1 32b88c68aab04c646ad46412e544a86d86c8a459
SHA512 e04bad3371c9ee49aa88d41cc8d5958ebf434412e8afae6a034b617b5a2b64ddaed10c73c72d4a65519d6492242a34479833431c06fd7719e9f9c849db0356f2
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/8U7twh0gYUub:8G05lO43bSbpi0gYz
TLSH
T172D5C06E62EC11F9D1BBD17CD9C6860BEBB23815032456CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ca003b3b15ec5c5fde1853a92b1fbf062fe26b92af42420c18f3b79584b2ccba
MD5 a3949e1bcd20602f900defae4eee5d2c
SHA1 af9ad615f25e2e8e4b23814338eaee1352c12615
SHA512 1131997bc3c249091dd6c6a67c81baf16060c89b85f12ff45f4901f55c27c063067cee64b4c5e1a6a5c46e436913320535ad5fdc270fcab28522a33a8c866dcc
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnt8U7tTK3VnChd4Q4PQpUcrf0FGDQ:ba5POZ3BJt2pasx2+m38U7twh0gYUub
TLSH
T10A65AF5DA7F801D5D1B9D17DC5838A1AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e4a0b36748612621b8a488ec94a7c55e3175b4a7092b545e274b5c274d3a9334
MD5 98dfac260139fc4cf4b091cc06b51f24
SHA1 2508dc3dc7748e070a7a39d2a3cacaf22cffe24a
SHA512 2ab3dd5602da4687d8bfbbd645791309891fc0dfbe99e6509301340a48f46dcccdc6f406f95d0717bcf538fd4511415678280adbee8e15197df8dcbc3db8c2ce
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7Fkz8U7tTK3VnChd4Q4PQpUcrf0FGDQ:8Nc/zEOVHFE8U7twh0gYUub
TLSH
T1F3858B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d51007d3c2c06a050604c5d8b93222ba31c59bf75b9503236731374af2889bb0
MD5 68dfb5a0603e515ecd690f40efd0e703
SHA1 c6c72fff5073ce163516f15a0a2f8efc51805af4
SHA512 957857fba6872e30a6aa2f6efacd5022f39745c1a956f280b5b30ec2c1cbb50a88ba7a3db8a1903dba56851e3f6df5187ac1ec002d7885815d74b6d328c1774a
SSDEEP 24576:KTkNvNnaFeYhJNtmZBm48U7tTK3VnChd4Q4PQpUcrf0FGDQ:KTMwBtOm48U7twh0gYUub
TLSH
T14655AF2EB7F846E4D1FAC675CD238512EA727861073293CB5290C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 cb0f6c2b2172e69a4d8fed9aee9fb182a7dfa511d128825a0e364d4fc004a8aa
MD5 03dfacd26c52e6a98e2ae77816370f1a
SHA1 9b8931c191007418a2f2dcb83691f3453ebd57c3
SHA512 c0df775a53aaa2e388ba63978a5ba958eac1b4f8f7695f91eaa9b70a0dc8bf55f57a5f1de68b5c561dddec0766566db819d199c29b1621e2305d4e31abb30bf1
SSDEEP 24576:vPUr+NQv8U7tTK3VnChd4Q4PQpUcrf0FGDQ:vJQv8U7twh0gYUub
TLSH
T15005E12E62E91CE5E676A13DC9528719F771B8620701D2CF02A0917E5F37EE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 20b3b01609462298a70e83a243b88d8191589486fca8de22de8baf2cbc30b60f
MD5 3c6e7ab8330dfee2f7c2657da8ec90f6
SHA1 00b10373273a83b99ed62856eb25abc7b5a47788
SHA512 041cadec3ffcb7e250ae359745711f2feea4026cc0189f40e2bdd87bfbab15d30928730cf2f7d9ba87b98dfd5f6492fd912c56b6683b2148eb1382a35f06abc8
SSDEEP 24576:uD3FHshBIYQgAC8U7tTK3VnChd4Q4PQpUcrf0FGDQ:uDVHeBIAAC8U7twh0gYUub
TLSH
T15425E13DE79C04E5E57BD27CDA638A06E77138A903215ADB029091B61F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-123-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/528-132-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/528-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/528-129-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/528-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/720-309-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/720-110-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/720-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/720-108-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/908-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/908-290-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/908-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/908-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/916-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/916-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/916-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/916-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1472-305-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1472-70-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1472-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1472-76-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2940-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2940-310-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2940-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2940-103-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2940-97-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2940-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4104-23-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4104-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4104-16-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4104-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4104-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4348-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4348-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4348-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4348-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4348-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4348-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4960-0-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4960-1-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/4960-118-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4960-7-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/4960-8-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5092-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5092-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5092-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5092-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5800-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5800-90-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5800-84-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5800-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5800-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5800-325-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5860-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5860-306-0x0000000000400000-0x0000000000497000-memory.dmp

Download