da49cdd2640977282ffe5a4a5c69131cd0461fedf2d069abd13b062d4e212858

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260804-gsjd8sxvbw
SHA256 da49cdd2640977282ffe5a4a5c69131cd0461fedf2d069abd13b062d4e212858
MD5 a15d33528caf1a8f5e64fb9e641f273e
SHA1 940aea0b203aff33425e15fabf58f20666be29a2
SHA512 1a9b189fa05b8ab75d27ee57613519b64d514d6a70dfaff8f28dc1dd3b58666601e68b95a9cf4157dbfa0abf3905621e6805c9bac754b3b25cc650b1c372453c
SSDEEP 49152:MtY4be4yHQp0+6N/zdzQiHsTTOtjDvdpiryXkp8oL+bzxGMzv0gFIDRRAubt5M:MVa/rVtjppUf
TLSH
T19EE57C5F52AD00E8D1AAE17C86468A0AE271F816C731A6CF16A4475A1F7B7F34F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4164	elevation_service.exe
4180	elevation_service.exe
3952	maintenanceservice.exe
2420	OSE.EXE
2336	PerceptionSimulationService.exe
3964	perfhost.exe
5668	ReFsDedupSvc.exe
4452	SensorDataService.exe
3308	ssh-agent.exe
3908	AgentService.exe
4916	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\52eb7ecee62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be7b6918d723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016963f17d723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004625ee59d723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000755ba416d723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075b49165d723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3124	2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4164	elevation_service.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3908	AgentService.exe
Token: 33	4916	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4916	SearchIndexer.exe
Token: SeDebugPrivilege	4164	elevation_service.exe
Token: SeDebugPrivilege	4180	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 5588	4916	SearchIndexer.exe	102
PID 4916 wrote to memory of 4920	4916	SearchIndexer.exe	103
PID 4916 wrote to memory of 1708	4916	SearchIndexer.exe	104
PID 4916 wrote to memory of 4780	4916	SearchIndexer.exe	105
PID 4916 wrote to memory of 5112	4916	SearchIndexer.exe	107
PID 4916 wrote to memory of 1428	4916	SearchIndexer.exe	108
PID 4916 wrote to memory of 3640	4916	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a15d33528caf1a8f5e64fb9e641f273e_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3952

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2420

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3964

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5668

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1512 1516 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1520 1536 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1520 1536 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1512 1516 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3330d20f69fada9fc238697571243e029a918729bbe268ccb39b464b7a34f243
MD5 751023041b98fb993342d7bc916e2d59
SHA1 d4344ab668d422dac97c748f0eff4675186fc92c
SHA512 3378c3a2339cf2d5833bb15433e362acd51724645e94fb73774b9f2a97c2777e5c17529d3779fa3cabab1a962c3cc1915521efd1baee57cb42267d356195303c
SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnagFIDRRAubt5M:03q6sjB4Uf
TLSH
T177D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 11157dcdb95a95678210314ec42789b937d6db9ddae438490291f1c7224a5dc3
MD5 c019c6d9243e02732334348012baace9
SHA1 fd5f19ddb2839734b0f07048e3f361b6db197e2f
SHA512 072a69e488ed9a349675f014de35b8fbfd2cbe21991f5f32cb2cd80c32b7267678ecfea9348d4dbfc4c83fdccfda1de0316e2ae4e21d605fb689b52c945eb322
SSDEEP 24576:KXYfDtczARVg9N9JMlDlfjRiVuVsWt5MJMs:Rtc8gFIDRRAubt5M
TLSH
T1D085F12873D508F9EC678279C9B28502DB33785547A0E78B03F489665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 318bfb814f0d84ab8f7817d9b2600d4f923b451a4e2d1a923e68487fcf32e60f
MD5 1b3362527b1f53a7fcd6d809846d304f
SHA1 7e9904c1fd89e5418e1cd558eb7d49f339cf37a9
SHA512 0e34ede0c7b2724e8dedca3cb20225f98a8cb291845cf77a4c7af894f17f241bac8fd76d9100867bfae1a1307ee7e234f591f3118446c01736f72602519ee0d1
SSDEEP 24576:N0Le5ji0hmx7rM8Vg9N9JMlDlfjRiVuVsWt5MJMs:NPji0A5PgFIDRRAubt5M
TLSH
T10F959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0c8c6f02f3b0f4240179515e2d5968475c336862f88311a8b11d1a9538ed995d
MD5 94328ca01c77adf0fe674d04088fcff5
SHA1 eae640b908eaa2b2840ea6f0f869a69d8d7e532a
SHA512 64739494397103ce7e91e07384fd441312ba3c21e75a1861774dfd7e8a6b0bd892014821d591b5f9b158208395e0dbd8b6b1c198b2e5a1481a5c888e50e213fa
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWn6q8wyuqVg9N9JMlDlfjRiVuVsWt5MJMs:k/ezSC6vUzPveHjyLgFIDRRAubt5M
TLSH
T127755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f4232f1348f6622d257f5f392c1a35388a068acdcc63b96a06b7c6e01caec597
MD5 fd3468dfa868f2fcf094a0c029c492ab
SHA1 813412d48e4e946a6d35afff4c40085fee9768f7
SHA512 49dced0e14b38e0ceaa6e6b91ae6e37de2219526bc8d54f1e2d7764ba6e9c2628e81acd608089e0ae32a2539ea0673e430099b733d904d86ddc74d019acca083
SSDEEP 24576:+VbqPb88hv/l+YPVg9N9JMlDlfjRiVuVsWt5MJMs:+VO88hXl+OgFIDRRAubt5M
TLSH
T159559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 cd177057a03050d3d8454ab3ed3775cf44cc6b9ab70128c97478ed24a02b7265
MD5 a66b9672d6ebc6943bc777d8170faf75
SHA1 a9e9f6d9fc5af01f474ec078e8688652f5e4b599
SHA512 93f0a6bbd3f3f62f26bb2c3dc750ee87273fbdebbea4a4f4197ded954b086a673fc1c6cd2f445e8624b95f5b7e3b82e6d14eb2fa88471b025820954c1148b7f7
SSDEEP 12288:L9sV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:L9QVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1AE6523AA7645A5F6C65B82B1CA73538ACF236E5835C58547C2B019D1C9FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ddff4ec6634f0a4b03d64b524db90b7d8936b71a215d2287b7373e9a109ed867
MD5 a8e6ab8ebc6b243a62a5f04894614365
SHA1 966a70ca833bbf2de4fe37f2ca0f6ae201011417
SHA512 330d3dea199979ef8c7ddcdb744e69d01c7712d71d369aee0a394b3509b58cf8651022b4566615bcdfe90859066e2234814f75b7024934184165d6b0823fd25a
SSDEEP 12288:TeBNUbTVO86U1V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:TJIU3Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19085CF3BAE28FCE2C27E8DB99A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7cd0a0fb87ac0d3ded885b1168fa7c514aeb74a0b60fb6a5eb4b7518e96849de
MD5 5e3e032bfa6635b87aea9a3bf9aaa7c3
SHA1 150a5f96f88a08cfd486b7bb793dc413bc9ce1f3
SHA512 028c0e7f6ed62596bca282832fbae7922a809f4ef2c68e75eca9caab0f693e6b3fc24ef86ae240c5fc0f52b608e341f5e2239bd98c59de06d23eadcd5a799d8a
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THC:BQvGAdlCEL8c/DRNw5CnUf
TLSH
T1DD267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 172c2b6f0eb17fe711fada96020e79f5ad0ce36e09e8fc2c6002d2b7a1ca6dbb
MD5 322f2e1ace974932448a390f03b6096c
SHA1 27d1335bcc0b56cc1619a8bbe8f45d8043af44cd
SHA512 e9ce55767616d7f146f57132ac7dd2d013108ea54cc8e0cc5f89838f2382471c18b6328aeb18f5d4039290e659bb04d65b47664f51b65ef18b7293a4a48d189f
SSDEEP 24576:PSewsAjFVg9N9JMlDlfjRiVuVsWt5MJMs:KljfgFIDRRAubt5M
TLSH
T18485E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f98da0d506aae34ea76c04fd01cb9bef4fc3fda5de74df6727e7d2f070683277
MD5 57a5c722f638ef96d83bdde98286ab1f
SHA1 f52c7557e0ea05d82cd059e54eac64aa3f593d37
SHA512 2229eee2750233c532a10dcffa1566c416ffea978be538604c2549e5be3649ed552d51ef6bc9a0a79be31fa9e8fbdf86c0c0a170988d155a664266c1c21a504c
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHwUf:nUEtQevvqc2W1cpV2tI32wUf
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4db5f7da01cb115309b9486eafacd12f99709f44c3a6d01361a4360a9fe56b14
MD5 4d3e3d65f3ec8ca775787705515ef007
SHA1 377a38bb817905cf78f8884d384921c0f28671a2
SHA512 a4dd81f0e65f6d26c53996d464509f348d9b879f29af90902216174fad3b5ed64af8d48dfd7f416ca21a166041bcc84677c05a62e78b1e7fbe1d4eae20ea3cd8
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/z/gFIDRRAubt5M:CoqtVjnmLUf
TLSH
T19AD58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 922992428e910cb3f9989c71cd81ac8b6ef42679ea31bd9e26e4f91a3c972f09
MD5 9bd897641fce36b5c94f81f5a96d44f0
SHA1 3900bfe0f14edf1ea1dbe02861d0188ecc1d7203
SHA512 a326c738be40b0a68aa82da34cbf8db93ad936fbd6d782a8869aa3784c95ea349fd8415cbab34b380edea7979510a46cd8c457372e234f252917db98181fc54f
SSDEEP 24576:7AhGL3IFoiwtA5l7S53mVg9N9JMlDlfjRiVuVsWt5MJMs:7AMUFoiq5SgFIDRRAubt5M
TLSH
T10A35AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 00069b34504efe6ac27dc5057625ef05a0ee7d85e8a9dc0648fe4176851a39c5
MD5 187809ce8aef21121dca094f46950bab
SHA1 624f71e7c7c31643cb7f55b4366e4812812370df
SHA512 8584e31949f0175fb241c2a7dea3e48d65918c8f3fab9f4d5fcd1eca08494a350d47524ff309c43375a0a1ceafc8be5197eab1fc5145c7ec3b18202856251eee
SSDEEP 24576:8wuWOWhVg9N9JMlDlfjRiVuVsWt5MJMs:8wZO+gFIDRRAubt5M
TLSH
T14E85F14A32A40CF9E9678239C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8774b1b7a016773f3c6d37db390274c49c4d536c087ae34655dcda344356d6ed
MD5 7569a36488baa4e05cd51d8fcb94e4e2
SHA1 17f6cb7048974a8ff854c0c9a3fb78722f3b5262
SHA512 838beb1e61cb1baab8b2abebc0a41d6ee31562247dd13c93186adb2d98f109d190e926b11011c80a678c61e142ac349db8312c1fa5d4ad86a99ecd667f9bfdf3
SSDEEP 12288:q0Z1IyXV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:NZukVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EF75129A33D420FAD1A78278C9F24345CB72785633B683CF427006A65FB66D25D3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 28cd512a05f984cb18dbfb65b25fa585a55883b9ee9a3486602e527346141611
MD5 4dbce2b1c78bd59a81ab18d6a1d939a2
SHA1 75761bf639cb2a2acc3ed9530cd553cbb84add74
SHA512 7da4f5f5f6d3ea9f867edd990d557a653211a142108e1c4649d407bf0a7030db0b92b1fea6f2729335223d1598c53cea8398560e623506644dbb44a955acd33c
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:aQRQyi36YOcPbLvw2gAf+PN3WUf
TLSH
T1DA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b8efa2478a7b5688d995882b0e5652f26c9241a85a9e804bc11ceb525f8690d2
MD5 334170b3b45bafdb3b8e664c7b389dce
SHA1 4ba8be7c7c24f3d01d72c00f687be4774f16fb8f
SHA512 ff5b66b39f14a2d4ffce5ea03460f135e3a8309f4143c90a81f8696b783cf9e31da7abbbdbf98fbb485344cd3cb403e5296c477c7d290ecb2516887d01d0f6be
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:4QRQyi36YOcPbLvw2gAf+PN3WUf
TLSH
T1A9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 21a3026b08b5861beeb322a6dd21f703902ee16acbe7b25505e864a2012c3c45
MD5 ced0b167cc64598e60cb3289328657d3
SHA1 b41ea2fa57d8920e9d520363c375a2a02d294361
SHA512 8a9cc3ca44c87438fbf21c4e4e86f4ebf0df8fefee6bd6cced74108e428d0dd6f9d1f90c59916d8783b461eaf035210196b9a5f34da6a1d6932420e4644f2862
SSDEEP 49152:M68Qg55nhceWu7PNU3/PgFIDRRAubt5M:GthLRc/IUf
TLSH
T157B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3dcc16036befba059117cadbd386962fad5430d7020e1c6b5da1245714542551
MD5 bad9b8945412c2b720968abe3b873867
SHA1 0c37812c79bb10015eea200bc1b92560c4dd7657
SHA512 ee12b964b02ed6e49457afb770b5b1959f15fde9645a7e7e162f93f0103ba5fb5d9f2cd494ebd22ab97ad20237d3ce0879899fc1806c364e9cd958905a367305
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99E:Wy5112gYy5azzVvt69nLKnhZNUf
TLSH
T173167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8ec9616de99f18afd88b4fe37539bd6bd9e0328a7a917d80f9737f663a0e11a1
MD5 a52e199fe0240281433f47f8687cde54
SHA1 4e639c8d451089f6096a8875c982b3a32aafd99d
SHA512 d10a72a0bae5f2c96a131bf62dce88d55f06ce20f195bc4cb46aee2b55ecefacefbcce37ff86c63298f0c0332172f50cb7e34c8e8f5f22a73b69563164768c5e
SSDEEP 49152:mB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLgFIDRRAubt5M:Uu6Jmdxd2d8Uf
TLSH
T157D5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eb11955f9832ce08bce102d14c5b010520b8cb77bc99d2a9d73a68f125561d65
MD5 b501ca50c36cc4366cbcd605c46afa6a
SHA1 bd8769d8579500f06c95e9edd81a0dacc4ddaf3d
SHA512 a4ac222c2927d979c2b0efa4ff130ef19afcc4ea518c7d92d0f3a626391eb7d2d3d1afe47047b740ea57f843145e4472c8b26f88fb4fe285fb416d2127745f60
SSDEEP 49152:V1hpsNoJpF1A63U44CwH7R4xFgFIDRRAubt5M:VmifPWRLUf
TLSH
T1D9B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b01aff6f9681750dc7a64ba07be693f0ed4c842a4c6f0dc3bed58103df79dff8
MD5 a409033ade30787c3ab957d37a518b47
SHA1 fa041c71208f05babb8c2bab0327f71832e1666a
SHA512 5e8165195c30b0ed18debfc56a31acfce13975ceffc9d254ac80f42753ccc1ae93d728ef9c10432721cc0cf8c5c98cacee969809e9e3be475b9c635aacf4d204
SSDEEP 49152:VSuZQIY0Be2KcRVtOnks6NMHqkgFIDRRAubt5M:75dKii61ZUf
TLSH
T1FAC5BE13F2E940E8E0BED674C7669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 61da6723f6942d066569e7580b1ce651f37a186bcf14719d6a7c8a27046b1f01
MD5 e7fa7c7bd2962d9326c36827637edaa0
SHA1 8b6a0d96b63d80d850aadd22175ec679105ea490
SHA512 abb0461a5855b31599ec8fd5a55be8f874c0e63fc515b9ea31999f49277eb2bf801ce0a955a4a75e5ac9e78b50b6170ed74c695c35244f97a5981468b2d63ab1
SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wJgFIDRRAubt5M:4X2imphfUf
TLSH
T19195BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9464cfb459d334f9bec4ecdb70a272ea54653c68784d63a24618d5d81d063559
MD5 381a8d181637ee592df719bd7f7901ed
SHA1 8fa1915cdded6cce9f1e968f31301a93872f5f99
SHA512 1f4c4451709b0e995c8e57b0e97c2f87e3809a3e6b0cc014bcc5f8e244c0528774bec3368013dcde9a5e12fe078d34b760728aaf0c2b7eb38bd0a924ce77de30
SSDEEP 12288:aEV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:a4Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1596523AE758695F7C507C2B1CA735389CF262B5E76C68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 2010d64787a795c5fda49ea5840f36160e6651dd43cfee7eab8212a77e503d0f
MD5 ae945edcc34f9f30584b0c7648725990
SHA1 750ed6d5f0e1f88b135346433e990e140e632309
SHA512 33df23c5f1205d6e6cb353aaee976cf38342d4af556a2bd3586003933f5d1dcfd9f74f36129158e0814920c7806450109964d0518726d219b59f8e57c7688aff
SSDEEP 12288:bTV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:bZVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T10D6523AA758655F7C10BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c6a94d355c0e52fb8bbf06df88d6b440ccb9ea65a2632e4c3b48cb4f695c2a0d
MD5 a3a6291793ec4149b7026f21588d8414
SHA1 96d977d6018bdeff27bbb7124d220280b39c8a29
SHA512 8534d75f3c5a24ac7b7450cba0bce03ab54c1b092a59f0fac722f3eabb45fd6f18b661fe309ec2395220f11c596b29717b3102c4e86407578d88e2c95ef4e77b
SSDEEP 12288:BNV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:B/Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1156523AE758695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A1AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 3a5fba67d717056f73ab6017f41f3ca100171dae49a1179409e2e5775fdcdd73
MD5 744c67c32deed4db0dbd6fcdd2d36187
SHA1 f0020887d18564b2ee54393ae570dd68aceacb74
SHA512 8cc78580b67fdb552cef721e4f5484b01f46a51f02cb56f777d6c64157513a7174aa0d24b50fdc0d154676ba0920014b316220f1a69b4bd03d496cd2572cfa54
SSDEEP 12288:8VWV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:bVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1FD65236A369651F7C457C2B1C9734345CB727E5973A2828FD27009964EF42A1AC2AFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d0694a23570542ee9ae65581d84fd59baa914b7cc6e38664e1328eaceee6ab90
MD5 f240b356ae9be5733d106e26c68fadef
SHA1 f3b280c5f06920c9fd7a283181332dfae5d1d139
SHA512 82f37da0ba62b075bc90ee53ef557cbcae3b6e9b43c81ac67d6528f31a8dce517b3ce98071fd6ad1459bb6c22c167d5c480651b73af9dab7fb9d15006d714be4
SSDEEP 12288:m+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:m+Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EB6523AE758695F7C50BC2B1CA735389CF262B5E76D68147D2B004919AF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 28b2c17efd8f3bad2d21166b865b1fc8dc176253d38c3ed2b75b146109e8fb65
MD5 69c025526b0f451f185f32cf7dda427d
SHA1 cd26290f5b815f32f90c96903291b6502842c7b5
SHA512 a5b1ed1ae3de2f45bae9a0513dad114351206cb68ef9d66110d9f57690a60180bff26618a024ea202486982c5bd92d6c7af5592a1a716ee1e3293b17e9601cd3
SSDEEP 12288:u/V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:uNVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1FA6523AA758655F7C51BC2B1CA735389CF222B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 2f9badb6736c3cb0ff8dfea0fc15ab539459e87b2d1696ca78f4081b5417de44
MD5 d9f23bb5e62c86c460b991c98138aae2
SHA1 fd5e2766f2731a3f4f0477fa1fbfdf98a1c90a6e
SHA512 1e365a6b2f818aa0ea06a51b35b1e16a10ad2cbd13950d1ea3752de131df6c0439b493f33321f672913e540d0a566ac5ba4d4dd032c572eb32a753387fd0da18
SSDEEP 12288:07V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:0RVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EE6523AE758655F7C11BC2B1CA725389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 5b9198eb7699d05388ddac368b9d4db0670b71b00bb6e9c6a3162a545ce1bf5e
MD5 87ec61a5c137bc7785fb407919c732a1
SHA1 d71937a78c3538a8f3e54da6ed82d597ca259124
SHA512 815877c90d430070b617539811880e3037e20c234f83a6d4b9b9e666fda41bec034c806f6b2085106491ee37ccf7dca8e490c0b42e7956dc2e2955e91720454d
SSDEEP 24576:5ZMrzFVSO5Vg9N9JMlDlfjRiVuVsWt5MJMs:5ZMrzf3gFIDRRAubt5M
TLSH
T1498501A9739018F9DC67823EC9628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 05ec7dd863a4c8c0800bbd862c4d8755882ba1003edd984f854774b5d689ffbb
MD5 0cc477968c065d2f368c0439c9940735
SHA1 cbfe1c2896163b4f71befd9957ed412acf07b4d1
SHA512 5e4885d7c60d7634f84090a0a01ad5715b9b4f27a9692580a4cbf5fb89fef8a649eeedd2afd3b1f064403ed9958f7c990db7a877f0e6b1bbafb183252c50875f
SSDEEP 12288:84V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:80Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1106523AE758655F7C51BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e75922768acc592221e9bdbce62a4a76ce2e41d4906041fb1a4e19833ee21a51
MD5 82f5216b7d603fe5e676c919625f2feb
SHA1 677b807209392c26a127d0a6fb2c75a6c9d322a9
SHA512 cc6f86c909deb42a32c2d7c9a377c3b5c8d805e0d92783a94a433629e87eecef7cf1b53c0739423eaede22f785faaf8137dc1403b67866eff09f1c34dc480888
SSDEEP 12288:FcV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:FgVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EB6523AE758655F7C51BC2B1CA735389CF262B5E72C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 614d0c3b54cb7074f9c44bb65c9dc9d6df044cbd6754ae68ea51554fb6c3738e
MD5 abdde32af7c09e69470cef87cc56dd7c
SHA1 2d457c3fd1cefe371e574b80ee8adac1328a9100
SHA512 047c2d9eeeaa8b8272e5eed2072f938c67c28ee9a53144672813596d196e48a024930eab5e3f74dc9638bcb3ad9f7d1d76f041ae930547a4d5b394fb7224f292
SSDEEP 12288:uyPz5L8XV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:zzyVVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16B75125B73A130F9C1378275C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 d7e388f8218fe83a96a0eedcae9b73937c4dfc0ffaaac7836dfab702ab6a7874
MD5 ca2d8d0d77216b6f9ec46c813e968e54
SHA1 c061acb23930475bbadd1fe4f4a76d97da76395e
SHA512 d16f685c0ad3a4e6d855d5c7d7a4b034aa005ac9fdde3f45e6055c6c67332a2f0206b6aff42549fe58f6400fffb0b710cef222c59c25458325081b16e20384f5
SSDEEP 12288:O4V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:O0Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EF6523AE758655F7C51BC2B1CA735389CF262B5E72C68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ccaea14e5e528d400fcefd98550b0fb13e194cfb7dd8c854ba1c6ace0d1fe858
MD5 df8cfa882804671ab50ad241e2498f8d
SHA1 613369f02d99a85134f37c5f1fb5914122fbe5a9
SHA512 673a0f0fe5e3fc374c2d49ab41f858ca1d7b0602ced87ed3d0d8fff43e6c3e6204e57d4d05793348cac7cff3eea0e778bd497a9ed7443df071d5760a50a9ec89
SSDEEP 12288:z4V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:z0Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1906523AE754655F7C51BC2B1CA735389CF262B5E76C68147D2B00891DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 879127ff33edea78bf922aef53dc839afd01b5a19491feb1a76cc75b6e4c52bd
MD5 eacd3e81f47b68ef1f622d4c2687a53b
SHA1 96c1988afb69714ad00cb5dd39210eac944992df
SHA512 0e8b9fdee17e50c04a0d0b6b616a00722a3afac685ba4571433016a2c40c3b777f4ebe42cb7d1a14f9a29f72e49a49aa808cfc576a03ca132150da9a81223f62
SSDEEP 12288:vyPz5L8XV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:CzyVVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19975125B73A130F9C1378275C9621A02E772783617608A9F53B006B65F772E19D3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d6fc11962544621aec667ce6cada5025d701121598463a51b9472c53522ee99a
MD5 9d5dc0b505dc9e0de99197bdfe4316a0
SHA1 711e3ee96a2c51dfca9797248cfe3e52ec74f4fb
SHA512 a78fd27775127170fd26ee03385385646665ef803a2f4225385db7c4ab1f1429eae14f58306b8d61b1965512a287288cfacfd2af150fc6b955a4d0f932c32031
SSDEEP 24576:JTxaLl3z0zDvVg9N9JMlDlfjRiVuVsWt5MJMs:JTsLlj2gFIDRRAubt5M
TLSH
T1B58501A9B35018F9DC67823ACD628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 54f8674256515312de1e023456245ae9a20702ea9a7248b9a1d7537cf233c9c0
MD5 2308507866de026b9f1593d1e493ef4b
SHA1 1ecfe1528d8c3babf876fbafb0c064871852c84f
SHA512 16fee9365234c7e93ee36e57c4a06a57be30ef8e26d4252e406404a4ad71e3f9dd53d5216c3552c40819eab13e160eb20dc3ba68df01d6ab614fd00305a7579a
SSDEEP 24576:Y3Zd9CHKy7GZjVg9N9JMlDlfjRiVuVsWt5MJMs:iZd9CHKya3gFIDRRAubt5M
TLSH
T16A95CF90F3E414E9F0B7DA35C9725602CA767C9A1B71DA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 dfe6b8a623a467800316ff13aae5c145c22827803541f532efc62c141b6e6c75
MD5 b7eb28de2b11bc6b003ab179133b8183
SHA1 90dda88a5bd5436afa4a71b6236ab87150cfa3e2
SHA512 fa16c44916578fd934966f7a4a4b6389bc0ca8aaec7b924440f065599993ce9d646a0993b9be9592b49cfcef76ad7c9c655a037f4b7ac8c16d159ae40bfd0517
SSDEEP 12288:PtV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:PfVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A76523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f1f385d6ec7f40cb6ffe590fbda09f15fcd9383ace89f9ff74edf1d50151df56
MD5 0d05c3e353bffc77f60028d313ea5037
SHA1 a6b75e26260e3ee9760a8763949e3e7eb5cbbf31
SHA512 66f59300ce4f1d403434a2eec3b43c00bdb6d7640a1f1d787d7f4cab5edf6d8345fa607f95c1ad3652967256b3455184f30fb0fe74053401204ecffda4e3fd8b
SSDEEP 12288:w3V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:w1Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1596523AD758655F7C11BC2B1CA734389CF262B5E76D68147D2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 086f1fae6ea2264880019d617602009f50d5201bc08adc7b5e423ea430a2f6d9
MD5 9f2a61300053de7693a17a3fde1d9e91
SHA1 cb3182e3cedce06004f61d4764527acec88cf8e2
SHA512 0a8bf91f7a1af78046f5eef48cd90272114b20159a187dd05b05ae9040f4664f72d0488d73dfc1085a8a5433ccf931933914bdd423ed8df4a222c3d30ae57d24
SSDEEP 12288:/6V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:/CVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1956523AE754655F7C51BC2B1CA735389CF262B5E72C68147D2B00991DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 d9e4ced09a328ac7c16506ce8b3cca0e8b44b6d6df04c5d03f39d0368e8ee75c
MD5 0db0dcce978cad3857cad46c48b4034a
SHA1 cc7a277da0a303fe8a33fa9c9afa89a10ccc97a0
SHA512 b4f2b76b3a446bc2d7a796d948346faf30c9d418121e7880950ee736e3f7453357c9345c7bbc4c9854e8a96d16f057285a5ff766913ac1ca8e92b46c88ddafea
SSDEEP 12288:I4V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:I0Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D36523AE754655F7C51BC2B1CA735389CF262B5E76C68147D2B00891DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 85eeb11c05c5d14b2dca6a6572786dd45821b978b0df37d72ccea4a996348ca0
MD5 5357cf5654918e5be9f82e9ed0a7bb1b
SHA1 6110bec02e6caeb05814c2ac06977274c0c3be98
SHA512 7916d984e4318ab4ceaffbf5d5f225755fd28d75b00e4a423374f8f4734a37e6b569392e6bafe3833333845d271e93b294f4be0beaed9216f78a7818967e4620
SSDEEP 12288:HtV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:HfVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1046523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 245e8c36d9fa6461c951a1177ddccc430160e16862b0fdb07ef14ce23141f5af
MD5 1f29a4244bf44f25a4cf1a13ce1ca9f0
SHA1 da21910da5dd877d4ef29171e4b1a37a23c32395
SHA512 c96fdeec50378ce1d5292a8dff864a25dfb1001b2a8b1aa47c38aa18d43c7a3cc73555698494d5a0d430e300bbafb095d7d6d9ab497f9bbdf97262966b796941
SSDEEP 12288:GAV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:GsVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11F6523AE758655F7C50BC2B1CA735385CF262B5E72C68147D2B00991DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 72a616f6c9d97966a3568c43acdfc35d6ac4204a2cf3dc940e5c5a634127e143
MD5 db682fb31c1b1acae2d3e345f4063890
SHA1 5d766e70b7467b33ff325f08fa0e177d7a45ab34
SHA512 a3e4bd2efd3434d79fdb7427ad3234ce2431cd62f88519c2e0883c2cd3367dc90e16e9617c5e9d1606614b68a48151f41cab45a92bfc5fc9f7fea2fd0ab5afa2
SSDEEP 12288:I+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:I+Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1FD6523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 e4588156b55436b3bfce7d569ee82456c36920962dfc1fb00908a6a49a11dd6b
MD5 9fee388c327cb850ac5b8675da36449b
SHA1 80135de9b0bb473848775f9d20c4e0afebb28cdc
SHA512 d1c18ec10fd68033ec40aeb01a55ef69a038f17b71cf53dce7859ba63c303ca01c0ca54e43cd6867a96036b170b6e46d73e9fe880ba6b70decd96599462a827b
SSDEEP 24576:kfwv2k9RX6wkyAIwVg9N9JMlDlfjRiVuVsWt5MJMs:SMnYIggFIDRRAubt5M
TLSH
T16A95DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7e324cf846a4978cc5a80b9c313bcbe4230a4c96ed3f0449ccdb93778e2ed6d4
MD5 ba41a6d9a6136fafc6a3371fdbdbbdb8
SHA1 21d6b0755b0d61cf815e6deba780270d7f355bfd
SHA512 a710713ed4a224fb31179025f5c1dfa6fa8362ad0c0a1c1eccb33840e07e25ce9184dc86f07b61d3d6d0593192ce65798845bb7252d6c2abdbaffba65e4e83a2
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pgFIDRRAubt5M:tySzP2Uf
TLSH
T197066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6f6da74e72dd651e343f07f45854b5facf588963111064902a2a8ebbf136e8e8
MD5 a42342e7be7c04bdaa7ac0f05d151c83
SHA1 4ba6eda0ba7b915c4c51470b897758f5ecf292b0
SHA512 070dfb7aaf875c230641bcd4cc8c9f38ee8db56b6244f8f2fece924cfeee23c7dc1c98c9876fa43d2d51e7abccd895e4c3346553e5bfaaa0331bdcfa7092003f
SSDEEP 24576:X47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYJVg9N9JMlDlfjRiVuVsWt5MJMs:X47JUQjTirIhCnDHUPfF/5gFIDRRAubE
TLSH
T1F865AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 12c87dc300eb140ec86a4a5a80c74dc14a588d41b24210be7bfac1ba3106434e
MD5 3114cdb56ad25f359491ff8911a79abf
SHA1 c903272a35c18ecc7334c695211ff0cef54ef0b4
SHA512 e9f6a355ed39c431797ffe84429fcf99c1e8c0a55711ea3d9bc2068330f29c7671fd23f83d468b724cc47686a25aa6ba0dd709da60b12478bda98a978c721b1d
SSDEEP 12288:cVsfIV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:FkVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12875F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 448KB
SHA256 46f42abf045df401b7a8d33d141f9d07f660170158a8447b06631c2f668746e5
MD5 ce8b7a36e31acff627ca970a88ec4475
SHA1 c488884c5f3b4c760a443f9706becb764d12baf9
SHA512 a1a1c08c4fc34598e3f1f4720cd654526c18cbdfccba119d3c5cc5e8048d35cbe775a35705e67d77af536fa2b3c5b9810529e98553f67b816f828afb54892396
SSDEEP 6144:XnsBC2naElMVpPfjvxmtMx6wwwU3frkpv:X4Qd/U3fy
TLSH
T105A4F621B326E71AC2B645312F47C1CDEA70BA41FD0ACA1771CE173FC5BA6848BB5652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 512KB
SHA256 256937b1c33ab847200cbdcc2e80e8b9c5568e2c14a02c981e4ea28d0a20bf7c
MD5 ff3b97d828450c884a0c0facf78f6b7f
SHA1 5dbf1303dcebf5f67670ce06295f0a038f7e3e99
SHA512 ab2f16c47bb29f16184ca9fcc3483f8e09eee6a418ee728f6e2d2365c95b65c260e92f33ecfe77a5d5e920c662e7455d502986d778fc7676e6ff8cd1b6b06d9f
SSDEEP 3072:I+eykytyH9Ab9EWO/0ppfEpffBFor6VPE2TCh77npjAbrZA7Lr:I+e/qpEWO/0ppfEpffBFom8ECL
TLSH
T186B4F740A4F7E74FCDBE6437077686CCB7644C07B7492B1573408A2C586BA7EBAE1292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 3ff884ef7fbf34c2445f349ce0a657d8353b1f9800614487a233bc432b6cd22e
MD5 2e708841c553b41a198bf9eafab4eb4b
SHA1 6fe55bdc08126fc8bacdbeaa5585002ba0629aab
SHA512 7cb65b984ba59260215d65495976ceee0728c9ede8278da1243b7c1e321428cfabe863154f5f469968a063c3cb65be9dea090bc4d81397f098799917ed6d5702
SSDEEP 12288:f+7QV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:6cVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17565237A768999E7D46B92B0C97383058B2B7B693B8181C7E17005D199F81D1AC3BFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3a11a4aa58f43319de6554eb5403f3e1a1ab810cfb6b718e5005f52f117b103d
MD5 bc3ddf529abb0b133402258d47e65235
SHA1 b1756be5470b3993e2e14c9ea0af0850f641eb9f
SHA512 80099d7df646dff571515b0239abe4effa06528a44003cc9a5d11c3eee6aca4de96ad9e78508a98573577285213dc4c690043483cc85858a08e4092910d3001c
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYqVg9N9JMlDlfjRiVuVsWt5MJMs:7gb4mBIBhGFTgFIDRRAubt5M
TLSH
T16365AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7b0d9566e52f858dc9dbd0d32cec75623cabed76506d6ac3daef94005e7203af
MD5 cc47740ec80e3ae7960f90e95445fb88
SHA1 2bba15e4fbe54dfd03a241518a4509f29e24c4e1
SHA512 054b2eca1a6701baccdd3ee28d821c71644559743ed000130c093c9e668ae9e200000a77074c9252ef173e9d75a366de58dae1a5762e231b076324d452066fc9
SSDEEP 24576:NG88u8FpJqH19zria7/m5Vg9N9JMlDlfjRiVuVsWt5MJMs:A7ZFPqVka7/OgFIDRRAubt5M
TLSH
T12295F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 1c4d7414c55916169786f29172007f103bc19d3355e09cb69c9c55d8f93f2d83
MD5 9724739ff0dd334ed9493cf39380fd95
SHA1 eadec7772b2920075bf0eceabad7403cd2719ff2
SHA512 ec12282ab99af046ad1356ce56b7bd80bd979ca24c23438ea0d2368a27058414c7af989b3e9a96fc678d6059011b2737f04fbc658555548d1f1ae7a53696189e
SSDEEP 24576:yPUr+NQdVg9N9JMlDlfjRiVuVsWt5MJMs:yJQ3gFIDRRAubt5M
TLSH
T16485F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9a940cb5796966d9aad73e02b2bd5cb31286a45d825bf615b33aafce30c82bed
MD5 89b81b76e14526b5279bc2109edfd347
SHA1 ebc86fa71f6d2bb71a1dd3e320cef4f04161bb2f
SHA512 2fdf38856671420991129264f3a8cfcf6312735506456d4105003490d39770d9e1151810a811a6604c52e1151de19810aea16b1bb5b3e70ac065185478d9fad7
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjngFIDRRAubt5M:JG05lO43bFUf
TLSH
T1ECD5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e086a3f6578c04dd4fa8d27ccae52697bec21b7adb72cd8850dc07e5fdc9eeb9
MD5 5cc58884979fdee6b885483b7480ce41
SHA1 c727f441d9829b1ab46406d7877d432bfb6dc8d0
SHA512 2575a58ffa200cb40bbd74398e327226d2fe4059a815493c23489c9b8fd38b86b03d8e6cef3fc31b537b99cfb95715c20570701253d303b46ddba967134899ed
SSDEEP 24576:Dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7Vg9N9JMlDlfjRiVuVsWt5MJMs:7a5POZ3BJt2pasx2+mPgFIDRRAubt5M
TLSH
T1B365BF5EA6FC01D5D579D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fbe3abd39505408ddc3c32407bc57f51f02a840f9943b744a22b64e90aa8a87d
MD5 16d5122a603a17493cc199d5c7c3a6bb
SHA1 42b8f5b3f54215f705a22dd916a3f6d4ff1ae8cf
SHA512 5dfa16a35051311342aaa53241cfbef47c95e04880751be8ef5e1b0e5e365ee95ed97bbbab1bac6aeab6a9378e781a896ffac6988b0df01f80608d5179b24de5
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkBVg9N9JMlDlfjRiVuVsWt5MJMs:QNc/zEOVHFugFIDRRAubt5M
TLSH
T195858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6635599ce39fc97bf429221ef65d6018b04d9f71373cbda0c615277879ea78ba
MD5 f365d2bab54633102e69022877ee618c
SHA1 06d2a340c12c212f0bd382e1934b73128c8ec454
SHA512 24ecea07d9c4ca903ef3c9c45c76d1d7928dbf92b2169ec892410ba50e77d23f59b60c1f9029a34810b4d7724e6277bca41059c95f4c4eceaaca43ea7bf16e00
SSDEEP 24576:TTkNvNnaFeYhJNtmZBm9Vg9N9JMlDlfjRiVuVsWt5MJMs:TTMwBtOmXgFIDRRAubt5M
TLSH
T16855AF6EB6B846E4D1FEC6B4CD238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 b272da173daad73e13d208e26d124eb3db0c89f10ce1f958978f9e6cc84df3b0
MD5 c8a621afa895feb5f6bde52ffd34771b
SHA1 3e674116bd4f780ae3029fda11a6c45663230ebd
SHA512 195b7d4b05ec1b0b28a6cf97b6492bfeeb00cff8f407bc54b8261bbb581ad64e7b443cc077ccf3b628003684fea61216823c6a43f7f7a6fa3876ebc6d49cb65f
SSDEEP 24576:9D3FHshBIYQgAYVg9N9JMlDlfjRiVuVsWt5MJMs:9DVHeBIAAogFIDRRAubt5M
TLSH
T17E95E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2336-300-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2336-71-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2336-79-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2336-73-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2420-285-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2420-57-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2420-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2420-55-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3124-41-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/3124-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3124-6-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/3124-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3124-0-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3308-318-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3308-118-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3308-126-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3908-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3908-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3908-132-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3908-138-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3908-142-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3952-44-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3952-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3952-67-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3952-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3952-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3952-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3964-85-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/3964-315-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3964-89-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/3964-83-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4164-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4164-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4164-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4164-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4164-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4180-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4180-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4180-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4180-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4452-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4452-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4452-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4452-319-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4452-113-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4452-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4916-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4916-155-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4916-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4916-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5668-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5668-101-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5668-334-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5668-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5668-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download