7ca96563ce65824627b7b0aaa2c87ffaee83fa225fb8bae73f9a8c13b80d972c

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe
Size 7.5MB
Sample260804-hjj5vaef38
SHA256 7ca96563ce65824627b7b0aaa2c87ffaee83fa225fb8bae73f9a8c13b80d972c
MD5 767c38c3564d5386c65d69aebb52b2ff
SHA1 ae824c1e88c953013216e7781a47730761799ff5
SHA512 3a0ec8710ffc5f90a021db41472647b248ede0ad1260c3e1ccd995cf5c56e89f013f621ad747a91292bb2a966df5220a72ac2827ad1e29d9d3176cf11c05be90
SSDEEP 49152:qHDk7feFN7TGF5Aiy1aiAAHUSOf3Ew9X/CxtKyCGiApXr1VLqjLra7RXwPNVNsyB:XKT4AFUFPu0IGsdHf8cC0sdUf
TLSH
T1C2866C1F63A940EDC0BAD078D50B5B42E2757866433196DB13904AAF6FAB7F18E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3956	elevation_service.exe
2844	elevation_service.exe
1056	maintenanceservice.exe
4264	OSE.EXE
2512	PerceptionSimulationService.exe
248	perfhost.exe
928	ReFsDedupSvc.exe
2996	SensorDataService.exe
5560	ssh-agent.exe
3408	AgentService.exe
1772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\17408337b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae46b114dd23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ea85ba13dd23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7822651dd23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098b8d612dd23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000882b4216dd23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
3956	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe
2844	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1652	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3956	elevation_service.exe
Token: SeBackupPrivilege	928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	928	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3408	AgentService.exe
Token: 33	1772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1772	SearchIndexer.exe
Token: SeDebugPrivilege	3956	elevation_service.exe
Token: SeDebugPrivilege	2844	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1652	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 5152	1652	2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe	89
PID 1772 wrote to memory of 3004	1772	SearchIndexer.exe	101
PID 1772 wrote to memory of 4952	1772	SearchIndexer.exe	102
PID 1772 wrote to memory of 2328	1772	SearchIndexer.exe	103
PID 1772 wrote to memory of 5320	1772	SearchIndexer.exe	104
PID 1772 wrote to memory of 3168	1772	SearchIndexer.exe	108
PID 1772 wrote to memory of 5912	1772	SearchIndexer.exe	109
PID 1772 wrote to memory of 2324	1772	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_767c38c3564d5386c65d69aebb52b2ff_akira_cobalt-strike_coinminer_icedid_njrat_satacom_stealc_vidar.exe" --type=collab-renderer --proc=1652
  2⤵
  PID:5152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5560

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 78b01ced843a53fb639f9875d809d956aca23877c3c126fb6a91ac57b989e12d
MD5 cd18adfb896a409ea981b69b306086f1
SHA1 5f5f4f1921026d555b2dccff4b3bc06a837c0f1e
SHA512 cc6815b69b797c8b6ae88b5d9ee522f608d22e345067e2d80796a40de36a8a54f8dd3c1b99fbf177ddf3f2df2d21eda6abf7d8d5a8db41fc639c1ced276cdc63
SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnTgFIDRRAubt5M:k3q6sjBDUf
TLSH
T10DD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 57150725830e26a984653a10d18784c07e4cc0c363b4eb96d325f7917e34995d
MD5 0f3816e180cedb41e240694d3d74368a
SHA1 35485b5bb82990869d813e366465ac37fb6c82eb
SHA512 1ee50a304e8ac8f637a7ffe191960e315cc2b0f46b5a890d7860b07dacfb8bdff0e57861dc8f7be958925adb3caae1e923aa8e75cf1f40b70753323ae19c6b68
SSDEEP 24576:DXYfDtczACVg9N9JMlDlfjRiVuVsWt5MJMs:Gtc9gFIDRRAubt5M
TLSH
T1EA85F12873D509F9EC678279C9B28502DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 5e3c80d5aec4918bb5de217f8416655863711328f18509fcf842b518231e6f09
MD5 d61502e24dfa7519091d50f253c61b28
SHA1 d6e4bcf97a47c47657681e3731e2bc1885105312
SHA512 c9352f8287f4eb034a025b02cbb5cdbad5763ad70d8ae3592b7709c8543b10f8742535a22ce1d183af3577e9c7bccfa3a90657a7b59ab1e1e8ba7a4769f83312
SSDEEP 24576:s0Le5ji0hmx7rMhVg9N9JMlDlfjRiVuVsWt5MJMs:sPji0A5sgFIDRRAubt5M
TLSH
T18D959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5d63608046880bbd2c19d9c68337f0e9262a99ba230bbbda39b911f228d25805
MD5 4e517046463965821788821bac670bed
SHA1 65cf6a8eb51f3666aa5943e58b43e643ddd2a0df
SHA512 7dfe086d31f3a5a3d992eb5099123418b8132b0a5edda676f42239a3f3a33683972eaec31a97ecd9006b969be9b502c88ae5f13a0b4c23cf4b1252f706c32f13
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyufVg9N9JMlDlfjRiVuVsWt5MJMs:v/ezSC6vUzPveHjywgFIDRRAubt5M
TLSH
T10C755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7aa2f42b5410f77d86e083b466d4e9a41e358f3755f460cc9332bdbcdc44b5b7
MD5 d07bc285347eabb1745b889179ad32a8
SHA1 eb8b86945587e06b97ddf6b142dfd4ae38416912
SHA512 00e340c34a901473a4fd307e9da50cc577dd30071f4af8f09147b60453b4a98d39267571c8d3f1c98be27a728f8327bd90d12d913fa80d6eeea140b588097743
SSDEEP 24576:HVbqPb88hv/l+YOVg9N9JMlDlfjRiVuVsWt5MJMs:HVO88hXl+1gFIDRRAubt5M
TLSH
T14A559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 a7c4e2bcf54656729dde8e5d40a4fdaada3a604c6ff595aa4180950bf937e7c1
MD5 12e5d1fea23fc29dc37236e1de772d8c
SHA1 a86ecf32505e6f0a2e40e08664ec2c592e7bcb7d
SHA512 2110ef4764e985268fb2011b52cc2ae69789363dc508a1c2c75bf4b47b7c062bba20e548e38b2a881040ce622da2cf9840c074fd3baf70d77d4907e97ff6cc5a
SSDEEP 12288:B9/V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:B9NVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16D6523AA7645A5F6C65B82B1CA73538ACF236E5831D58547C2B019D1C9FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 81c7746b5068a25724508f6d408e8b7fe51e9109f24f642b88c6188927125826
MD5 8e8624b7035ec2bfe8b629490d8a230e
SHA1 1720f6bc442cc9abe808360ea46e7ece2637c4f9
SHA512 a95ff699cb0579d640ab43350fb33ada62449b589594604ed5a0708126c5ac6a897430f0ee3b0259b67bbb6f3bf303e978142d0cf9176a7e3c564ee6a3bbd592
SSDEEP 12288:1eBNUbTVO86U2V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:1JIUmVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T10C85CF7BAE28FCE2C27E8DB89A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7368a9650f49674a173557616fee5d9cf451bb0d627fb0ea8a533e1b6a071be8
MD5 3a5e37f9a7f5399bf70aed896a084e78
SHA1 d05e5b197cfa92e735d7ead66ce97db352f48330
SHA512 78fde68731baa77ef4ea7595b62b5cd27c10a2669a9aca50d72f43dbb29080bc824b00dccea1706aad6f970121961121b4846351e5ae2714f35d02dc32c9b28c
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:7QvGAdlCEL8c/DRNw5C6Uf
TLSH
T129267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 60c5bce7953f3a491a5d14987bb6baf2ec3f716bca55b6daf759b6c8e30319e3
MD5 7a77534ace3c3f71624d58c16fa840ab
SHA1 da68ea5b620011618992e67094384fd3f1b83ab1
SHA512 3172de49bf924ecfcc1a725c0e80d4134e05496525457708b9b86eb20f497a1f864bf8270f5d8daa8939bef1ef4802bc3f28fbac957d519d9c03726ececabbd2
SSDEEP 24576:eSewsAjcVg9N9JMlDlfjRiVuVsWt5MJMs:9lj8gFIDRRAubt5M
TLSH
T15585E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 df86c5ced75c2533ff31bd8a6739c875f8e499d1e53f5df80411d56aca9b210b
MD5 49402d17e0c106513dba8af9e51a06ca
SHA1 4aa29a27c295976419b6bc8adddf792de4f41d43
SHA512 c8f46f1c1e5238a153d22cb6f91295fa325e5c8482dd36923e0483085ba313541077f750d3f423383d1e440fb1e520be78263af8f8723b5f1e4a858917960a18
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHZUf:qUEtQevvqc2W1cpV2tI32ZUf
TLSH
T15D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c6927e9bb5af77e735421814580a5b6c931b226b6f7df8c48e595ce6abe48dd2
MD5 36c613952aca49ca48eab260ea39541f
SHA1 4d5ec532459cdc88d55e96a2774b24952635d708
SHA512 1cb4b244a42f0576f3337282dec9d767887d17b7598a783312c76cd84cf7db0f58e9832c0c83680ed850b63977afecf70b8f5c74acca12d7dbd71a524f99262d
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/zcgFIDRRAubt5M:CoqtVjnmmUf
TLSH
T1BDD58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 89bc6f4b0c95956c60cef8d4d733ed6d20775bdef338ba3355eab05dbe021ecb
MD5 34d889a1ae0eb2d641e481bed90e1690
SHA1 984b4a63ab7f3be231aad554e5f7d1283e6005d5
SHA512 41da10be7b991b2a258a602d8f97fcec41ff916c1b16c00c257ec8a9329a9c0dd2449d4fc5bd0fee78a686b6bf554fb7551317a5efbad6a18cbcc85b840c21ac
SSDEEP 24576:FAhGL3IFoiwtA5l7S53TVg9N9JMlDlfjRiVuVsWt5MJMs:FAMUFoiq5xgFIDRRAubt5M
TLSH
T16E35AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 bc62710f565949da0500f4392c456177113023f8a033d64894e2b853f2ceeb06
MD5 cdc407747a75c6b7c910cdd9e1fd96fc
SHA1 4d60517c9f4985e979178c772719d199975bf186
SHA512 409b5b30e4d38ebbc9a266594250c8f7ba82e9568aa45aeb5d06400408df235ba62755dacfe59da31bc9171fdd5e325dcd39dc34a175dca0e997846611720608
SSDEEP 24576:0wuWOWgVg9N9JMlDlfjRiVuVsWt5MJMs:0wZOlgFIDRRAubt5M
TLSH
T1B085F14A32A40CF9E9678239C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b1648d3380ebdd9087802d9e971b77093b49d691bf32495578c613b43d9928f8
MD5 424729ad83b798a4438f894753ca6b54
SHA1 3dc186364f44666b13a1e49e52a02380615ff499
SHA512 1dfadb0c587f0afcd8c081c7e7e8b026b8e884a25a2fd732d603de3729a475599742c23607b3a0089700ba22021cd782d5a0dd2d43f9ab1027408455713221df
SSDEEP 12288:b0Z1IyAV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:gZuZVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1617512AA32D420FAD1678278C9F24345CB72785633B243CF427006A65FB66D25D3EB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 850578e52623366496dfdb2a1f4f28bf0792ebdc549b74e16b8de90a048d2c03
MD5 0dc1e97f82f7164195ed31998c274def
SHA1 1e008c1f0f01de11f7d33fab5ccde0703e7b4900
SHA512 b92244a8c8058be67331bdcf7034f893c61891d4441321c219e1370b794d429c382081875f65f4911ba8481de48a866ac20eaf24a7975be4e5713c974e386631
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U1:nQRQyi36YOcPbLvw2gAf+PN3nUf
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fc6e3ebb0f01faa895ea1272f2206eb53834ad5fd0483ddb0e0b887cb5deabda
MD5 22bf23e33c08aee1809d8416954238a8
SHA1 4c828824c34142cc3a8e3eb06fe68d55e9daca83
SHA512 3e31532fabb34e54de1b95ebc1d179bfce438200e1f8eecbe4dc63e5fe9a576ad0ba10f223c7d2d399609a8a53f85e25680d5b52b2ad09368961fd83169ce6a6
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U1:/QRQyi36YOcPbLvw2gAf+PN3nUf
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d4daac548416476dfb76f04c8481c9f5aea1e6c52e40526706df94f34c81373a
MD5 9590eb62fd662e9681550347b22705b7
SHA1 27c8b78f85ccc8ee2e488a44943c60a32cc89191
SHA512 afa6ee917feeb05f849d8a90f528da2e300fe957ff28e2cc184240101a75224f37444604d45e7d0e94efe153c491b5fb44df0ffd8331a37ca1bc762f1746e4e4
SSDEEP 49152:p68Qg55nhceWu7PNU3/sgFIDRRAubt5M:3thLRc/hUf
TLSH
T175B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6c2f75b35846cf7041252f5a723abd97d45a97582cb13f1c5daca6c087bbf25c
MD5 c7596be6ac39b60ae2cb5c76b2f3eda1
SHA1 ea8c84da5f27d11abdbc7b493202177b7eadd1d7
SHA512 69475c86d556d001eb68d40777261bc4860839f21e5968b1dbb081789359dac15f8eb554994caedbba1034f7048becd28611c0e597d639eda8c1372a73882847
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk997:uy5112gYy5azzVvt69nLKnhZgUf
TLSH
T1D4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f3b049e565509e4b157f812244e49ab02a54236be303890172f501ad17efdaf3
MD5 3eaab4c2f47869bd7d72e648e069090c
SHA1 d12c5922a619e7676229c31b7a414c53fcc24d25
SHA512 0cd65d3daff4e7b1cc26ca86920f6f978a187d3959c720f7b25fdea4197608923d95efe8ae409670510980c0c8556e47ac72947b0a0aecf048549d6b19d74d31
SSDEEP 49152:6B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl9gFIDRRAubt5M:ou6Jmdxd2daUf
TLSH
T16FD5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a1a23ef6285f3407e68d636316770eecb26a9de4d57774d5f654da4f6004d97b
MD5 ddc2cbb6e99065d6798196c581259b43
SHA1 31575f2a5ba50536288728bec645838c360c10e3
SHA512 4e237bc1a12687c14e212c20468119658330ad0e390cd7919620388d09b2068502bccafbd457e40eae76570c491b5e54728cf1bfc7aa97cee864e9e4589b238c
SSDEEP 49152:o1hpsNoJpF1A63U44CwH7R4xCgFIDRRAubt5M:omifPWRmUf
TLSH
T191B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ebbeea466d3ad097f303403770ca2f545ae5dcbd6c0017138f50f87e4da36b7a
MD5 e41e5d8418aaffb6fe82dcaa43870663
SHA1 b6051bf29b0a4c9db88ca40795431f61100e34e6
SHA512 271922dbe8194c532baec940117619471546e36ac1001153d143b91217ab99230d34b523f77f12ca6b7a0679f55f3829a452be436df72b1c2581aef2f30a84bf
SSDEEP 49152:kSuZQIY0Be2KcRVtOnks6NMHqjgFIDRRAubt5M:25dKii61UUf
TLSH
T10BC5BE13F2E940E8E0BED674C7669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d1123a15a1fd17185fac20b4c5a3dde9ab9e9283bef9984b7273ee0b08f9cf13
MD5 5601384882e8c900dea9e9748ae8feed
SHA1 77c9388a77c099d21e042cfe4ae47d18fe4dac16
SHA512 b0d67b7c2978ec4d433341f3f89091b616487efeea3252ac53fff9c9cdf672f6574c8e17d8441ec5f44e8176e8bc097818f1bc2fdbfb7599082a3f2874a1d0ee
SSDEEP 49152:yhtSn8EApI0fig3giDn0AP5wugFIDRRAubt5M:zX2imphCUf
TLSH
T1A995BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 e7e144fbe8b1dac634d26b99541bc03e56cf5f40f1a42e3bf826e5b77f276a4d
MD5 8e312a3f71ef283115c2c16aa3bf99a4
SHA1 7dcbdb27d481f60a71cba94fb3df036057101267
SHA512 c7b061cca47b419b60cdb4a28ff3eaa222f40c941defcd96aac668bba97a9c241e18894060e8eeff2437c19e0fe82a4d5f85f34f00b49dddc052f63194a463cd
SSDEEP 12288:bHV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:blVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1716523AE758695F7C50BC2B1CA735389CF262B5E72D64147D2B00591DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 014a025d657e9988137bf4c3f5b5dc716519d1ea41f0fe8a4ec96cbfa79cbcd1
MD5 e0cb702101edbddbc0cd99ee906e3832
SHA1 bdecee83403819aedd20c91c9909eeb5fe58bae9
SHA512 8ccc4390908d0bc84df7895f90cfb7c211eb3dcdc1bc24bce71a7496f0dfa802df554399580738462ff991a022739a2bd98e0e9dcda13ecc7c0fcef5c70bf6ef
SSDEEP 12288:mUV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:moVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16A6523AA758655F7C10BC2B1CA735389CF226B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f8a37c8a3b1e489d7eb91e8515b1ceb5e129a304fae5deb79192a725c7cc1716
MD5 19f73c3ad4364bf03987348c79f98fa6
SHA1 a4d92107c92b3a8c6ebc14139f0d44652b7e31f2
SHA512 906473f46c2b28f51eb43c37aa1f1630a5c9611e5e28660ed76cdcf0bd8777fa18ed000004f1efba219d0bb4df0754cd8fb8476ebb73d48411264d842f5c9ca8
SSDEEP 12288:3+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:3+Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1216523AD758695F7C50BC2B1CA735389CF226B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 804127efe0db9c2e6b7806284108aee391019ab56f691182b04554c9d7084a41
MD5 435022fb256d4ed573fcc2e65f4390ae
SHA1 902beda65b4d43d741faf9d74b707e5c4470eed4
SHA512 8fff2e118efd8a6b0f78f0e85ac2090a3f848302700e17524ca43f47fc4e7d64c81c18c7a6b101f9186ba9cb9f5bb8b40e01d433e4a99732a678347ee13c7c8c
SSDEEP 12288:uVJV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:cVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18D65236A369651F7C457C2B1C9734345CB727E5973A2828FD27009968EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 269be86ab5b39b11d9cffe224168c7ce551fc18b29d1a42e6472ac25c0eaa203
MD5 0273549ce8bca3ce9c7d5b2a023ed191
SHA1 3ba54c74fbec247ae5ee14f327bb0322b928dbc5
SHA512 d4d0a60b92d5f475fd545cd8ef1ecb83aec04e9f0923d29e3e57f76d2910869982d3840be00731956cf01888c2d53be35fc009459f24294de8a905acde6f88a5
SSDEEP 12288:ghV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:gbVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18B6523A9758695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 7d878b5a3005c469e92396da8ec98e916712841be796e4e54eeddc13eca9880d
MD5 6ad49effdc99feb43a07a52cb1a21deb
SHA1 b22053ae87af1b05d4539e9c80498ec1367967cc
SHA512 1f9fc30752cf5f7b3e1a43d7094a9446c7cecdaaaec9086590e254ec5389ce6b004063efe0441c29d80af4ba6ca73e3566d0a4b5e245c82bc505cbad34bd8b3b
SSDEEP 12288:t4V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:t0Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1CD6523AA758655F7C11BC2B1CA735389CF226B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 c4e910be61190dc461f9857f0de27cf2a6a75c3f35e0958a53050e6c2f048c56
MD5 f738a09331ccfac3b700dfa15fbace4f
SHA1 3a70ae35513e54cdba9900ea7439579d1b72242c
SHA512 3c50dd634766e20e49916d93fa3ec9a8b3aa7653dc940a42ae1e8fcdad6d899dee1f10796d3446680b90548299a954edcd3468b1f1d3bd6de345c81b9875101d
SSDEEP 12288:osV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:oQVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1BF6523AE758659F7C11BC2B1CA725389CF222B5E76D68147D2B00491DAF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4e193e0b30124c727dc67d840b14c8bb20e6314330d7e05a9f0ed55caea75904
MD5 e2f0e0770732e5d03dfa87a1d19d0632
SHA1 e889a47fbc5b328ea16206b0bfd5431dd286aed8
SHA512 ceb2d017a58355f68b9f7b97fa2026cff97f4c5268f9434bc90eaf76c0897bcbdab91385ec2df14b06c8e5c50acb63acd6fd9c72b34fbd971f7f4a1031400302
SSDEEP 24576:2ZMrzFVSOIVg9N9JMlDlfjRiVuVsWt5MJMs:2ZMrzfEgFIDRRAubt5M
TLSH
T1228501A9739018F9DC67823EC9228906C7B27C5A17A0C61F03B436675F773A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d33c86a328752e4007fde80866ae6800d25f1f60ab31f212d6af95f9754d1ec9
MD5 9905bb371fce9abbaf2f064797645c64
SHA1 d09d2499092f6e4759c4c158d702a91f9833417f
SHA512 ba3004743094b54b2970a8e16c8deb405045ee472917101060ebd7fbeea5b0b49c40513deb18337d16e3361f0412fe811df5105cbb9a6c77f52dcc286b73f7f0
SSDEEP 12288:EDV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:EpVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E26523AE754659F7C50B82B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 b51202dd3e043a31a6218b5d14bf871ced3f44fb51087d25813bbba26578f1b6
MD5 9bd945a6433455d85445d092ed893b73
SHA1 649de6b35f9d7750d43f0d23ba896347676114dc
SHA512 e4ccb7d701386be2c7891048203f09184354404361350e88a8f2419a738a5f8ea2687bae5565ff6c2c459b1e44a4803a613211f0fd594a0474c0d51ef0e419c7
SSDEEP 12288:LvV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:LdVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T13A6523AE754655F7C10B82B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c43af76e9fd175153a3a46c3660728f8cf3b52071deecf17af1620b401e7011a
MD5 e43a1eb02606d42217eae421f0e8486b
SHA1 75a3ed41ceadb5a9a476f7741c7dd8e52dd3c1bc
SHA512 456b65f74a064fa5442864e55f0839de528c5ceeea8ecb40ea1634a690ca9424d55de1afaf019f4dfdd148fbba3f80e38e3b0780ac5facc66b1e098f74ed5d07
SSDEEP 12288:+yPz5L8AV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:jzysVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T10975125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a0e6aa1dd4b685a0667d62d1794f27737e414c45fe6a2ee8b3939ff3b56aef0d
MD5 af22cde6ecda222e1ef0af90f0d55866
SHA1 904fc39e7e26ca218b08e5674b611180a8b580ea
SHA512 55fc339a14339f923367f5c7e56010495bc803055962eb94bb235934cd53efe2f2594370dc3539c4188e1d313e3b043f5e9a21ab97a51da78db95722a8a06fd2
SSDEEP 12288:hDV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:hpVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1806523AE758655F7C50B82B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 5df345afaeb7cc6885baf40383c0cd82bea5d07b1f122939ce75c9dda6bfdf2c
MD5 51617a24a40e9088ad033dbd1c63f4d9
SHA1 a5c3a47482814019a27dff222a8d5872532d48ae
SHA512 d140439313b8326a89bf18d2821bba982ea8b9430e785d5a68eabd73eec577657c68c455d176ac1305f7cb6e1f00e513ab7fa1a816d45b9be9822169b468994b
SSDEEP 12288:FDV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:FpVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1476523AE758655F7C50B82B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 2360974c64d3abeff2f557a550e2d06351808f4b55697b2ff5518f0758231b48
MD5 298f850d98ad8845b85deac18b873969
SHA1 a1abc3e3823e999744b42eceb4c9f2a333f8057b
SHA512 36838ca2f0147542cddd4feab3f4e55f9fd8c227bb02d0c002da3891e3e7e46d6b9e77a463d10ae309aa2b0778bbf78940c7cc17e076b6f5579b316a88ea46b4
SSDEEP 12288:LyPz5L8AV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:mzysVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19975125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f199623a8651e6100cf3bc65cf43a8511d7397d514500b438c18ada77d9a3c42
MD5 8ec6223697619cf36a678f7e0a4c5dbc
SHA1 a0bee73d9dbdd73432a4a87135e1d89cbbe3993e
SHA512 4c28753c15ef6df4fbbf873acf3f145d812de64f00b98622f9f02f9566455c2905d71417737ac3bbc52bb680a0c51a3149ae02185ce601a68d67b43ea0641a61
SSDEEP 24576:KTxaLl3z0zDuVg9N9JMlDlfjRiVuVsWt5MJMs:KTsLljNgFIDRRAubt5M
TLSH
T1DF8501A9B39018F9DC67823ACD624906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 53236bc142537d9f692beae2a65e35a2cc36b7dca38b2f741daaf5e95f5d8dcb
MD5 0c8ff7bec178ae379ceab1bf9523b26f
SHA1 88065e43491dc9b2fde5e743531340d3f0024fd7
SHA512 d0a28943498c4778442b45b115db5240392ed4dd26317e6b8dc06ecb248ffb8aad79435899bb6c3428283d1ad8dedbd71eb7f6143bb4be9450878a3cd0d4c979
SSDEEP 24576:R3Zd9CHKy7GZaVg9N9JMlDlfjRiVuVsWt5MJMs:BZd9CHKyaEgFIDRRAubt5M
TLSH
T14895CF90F3E414E9F0B7DA35C9725602DA767C9A1B71CA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4edaa25da2626cba6ab4d95907ea62ae593f22ac71a4efd80c3775f05b8535f6
MD5 5d3c0eadb299ed1b3af1e3091cc898f6
SHA1 a7f87d7a1a391b1b1b04ef773b12744c6e606dcb
SHA512 67b6ad73c21cc822a0f55e7fcc83674c158e3ef45244f572bf4f4f3094b2dbffda2513ec48cefa466359540ac7bf212a741bea77ca23723362b1f176e87ca54d
SSDEEP 12288:heV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:heVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DE6523AD758695F7C50BC2B1CA735389CF222A5E76D68147D2B00491DAF81A1A81FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f5a178ec84072228ff5e454db88bd4b3dd19003cff28998475376f7ad5d2ae86
MD5 e676a87d9370cc22b6b392788e6e8811
SHA1 8b389b8b6b6377340d88f6023808d0a57552fea4
SHA512 7ac20d9e73c2ab3db253cc9edfb5c33a8ecb7c431a5cb97d4dd8853e275e863bacdd4f675e1dcee97cdfbf28b69f7ceac5e2fb8352c9c42af56b3a12e16d274f
SSDEEP 12288:ggV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:gMVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1086523AD759659F7C51BC2B1CA735385CF222B5E72D68147D2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 526503d35e48f997c669e19709dde204370bb109d45d439d8e50cf95c196b301
MD5 aea3ed82daca79a923b4f34b04c2aa2c
SHA1 4f4ba8a96523e8b2d371a5189185f83d2409d523
SHA512 69e72d757e5d8dbef5893a655377aec3d7b5046a0e805652bf3b343f9f8a398c52236766eedaf09d731f86df5295cce8f7be0a11d72e8d8f797c131142f69599
SSDEEP 12288:vFV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:vnVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1646523AE754659F7C50BC2B1CA735389CF222B5E72D68147D2B00591DEF81A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 e0a4fb85d00c21629ec5076af073993011d53eae1b8c90c398f885452aa66ad5
MD5 63596f4fb4bf1a68f8f72f63026b89f4
SHA1 3ed0b7a123b4394c3c1808a7e1ec76ba58edc89f
SHA512 40f337a38ecddbe23c909001e015e45e74c85de2ed4e263c09147e995022522ac6290bef70136551e08423c4ca5d009aa7d80d754debeca0559aa2f1063a94aa
SSDEEP 12288:HDV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:HpVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1FB6523AE754659F7C50BC2B1CA735389CF266B5E72D68147D2B00491DAF81A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 2c0da8a48c29b97c53416ef0060a87e321c37c175172d130df0ce32bbf80ee89
MD5 e55d1daeb4527b00c1315fc4319f263d
SHA1 97f4b3f20b45d790e15969edcaed8d57b5e53019
SHA512 7a84dcd9cba3a2d52e4f61ed0f896d0ee2056bdf1fce1e18abeda1350307ef5a040d08d9ef23ea76977930f9b28b202410d5d78126c8eb5d471854b58c5838e7
SSDEEP 12288:veV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:veVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1986523AE754695F7C50BC2B1CA735389CF222A5E76D68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 6600ee15d84f8162dc7f0fa556853813a27d865adc3091dd5dd8a24fff173fbd
MD5 b34aa53bf40b708d7adb98847f8b7d7d
SHA1 52c125863cc686d936461565344e0cd38b4021f1
SHA512 7d61179e8830b43b15b1f676e2ad1ef9b190743e75e8f1c56204015fe6ddd25914437ed4f3df5390414da76f90ba7a8bda39846271f4b3c6fec495f85b8258ab
SSDEEP 12288:37V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:3RVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18E6523AE758659F7C10BC2B1CA735385CF266B5E72D68147D2B00591DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 26c0976bde0979b08d5d244b5536a0ddd565c5d0ac56804202d55b0cc860a47b
MD5 a4961bb9a1fd2008f19d067dc5c17aa4
SHA1 fb6dbff7f2330f0a970ac79aafec52e14ed10e57
SHA512 47c4d9dd7a96ecb2ca2e99fcb24724475523301a44e5701da1347f81093ad9c4679bcda6ef53a1fad63cf3f876756602adc920fe33842c915ffe764537feba50
SSDEEP 12288:EhV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:EbVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T10F6523A9754695F7C50BC2B1CA735389CF222B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 0a840bf12eb1446047b9236f963c20676a4e7f35f62775a72af2cbb942c7ed79
MD5 c9b77552847efbb4beeeaead5fb13f70
SHA1 a3a5e30fa2035bc8d17ebf55941904a42f095a54
SHA512 be970b776b533aed7e41a5b62bf77662fe259cf438c33fe5c446b7d10d24b330f417240f6030b81c9b528cb16d86795ce49737258dc76c1cb031264ac4d0e95c
SSDEEP 24576:afwv2k9RX6wkyAItVg9N9JMlDlfjRiVuVsWt5MJMs:4MnYIHgFIDRRAubt5M
TLSH
T15895D029EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f13946048a704cd7b9ce00a8a8a641b02366bd359990c399c3586a0f8f1d07a4
MD5 e4a0c8c351c031cd8784b13b78fec8bf
SHA1 629ccc648e7411a178a47095a37a23e6bb7b276a
SHA512 afc446f3a2d6cb2495de4a5c697a399250c10fc653f5cdd9164632bf542a8f6d1ca2cad50590ef550fd2b1eb11dc06bf6ae4860e4ea8639b8306b89e8ccd770a
SSDEEP 49152:9YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OgFIDRRAubt5M:QySzPHUf
TLSH
T127066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b7370c2d0b5063e233e14dd5e37306144c56b4f02223fd5f63e48bfd6c73027a
MD5 e329d50c066cb5df9b7c9d48fa9b2586
SHA1 6ba1dc0226dc0c2b273805a4186400671d548c19
SHA512 68f6220c3bf5105d1c140c242a2a0a9cdb5308769310b532ba2d0c61409dd8834eec0dddcf5ea827f8cfdf25bc18c14c0a3442e7f5de15af7d904ee3d254aa25
SSDEEP 24576:N47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYYVg9N9JMlDlfjRiVuVsWt5MJMs:N47JUQjTirIhCnDHUPfF/egFIDRRAubE
TLSH
T19465AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 45e1ebee9f82d4ab4ba1421280fc66d3a2cd3754d60cfb16dc77d5476c0bee2a
MD5 ea0ef09cf967732b4d695563fe622fd7
SHA1 7f9516f84e58e90d2e00acd12d57d0034daf014c
SHA512 369a30a77b50f751644c53a5964c894b1f456342f5bce3905315f51f74e6a38bf8f60344a7f02fb49422d1d6067c1d95d3de41cacf9f3df269a20b318d6ae1cf
SSDEEP 12288:VVsfTV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:eZVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T13E75F159E29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 38babd2bbebfb160582099ac0687ff8d6c9d14b67728b73f760d6ad86723c96a
MD5 45d9280e4de7e755191eb2a62a74ad83
SHA1 a212f93677b1aae3f1475c0ffaa4f3913446395e
SHA512 75cb68d9661a23a70f474de03e604a621f627a092e7420124b8777a3dfc7cc0337a2680d50a5ea371d60583e0b4700b0f7314d542c3bb8022c564e00d7d741f9
SSDEEP 12288:HqLwEEKnU3fWBuFMBRo5GWcdaH5yTAFlH3MBjbvN+Sv:HqL9EAUPWBuWB8wQZaAFp3MBvvNJ
TLSH
T1C9250700766AD75FC6A940325E33D1CCA7707D41EE45AB0772C88B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 bbdee77e0c254feae22efaea7cc9c57c74776a390cb4ad299099cc878b69abbc
MD5 870ca5c241a3982544958149c38fc316
SHA1 a3fe67d641ad190b3dcb29c2efc5b544a14ca32c
SHA512 3bb50d287ecc4d9f401a40feea0248890d026d6be8a47b286adc7a1e220f9da291c1a7c8bd76030f770b7bc5aa41329d68cfbc3f96dcc67ad0d428d2f52dddc9
SSDEEP 12288:5BVJKFmw/e1LNSxQkbXzhu2Gm90sYrbdwqUafRvliOPX67iQ:5BVJxwkwxQkbXzh/79owqUafvpPXJQ
TLSH
T13B65F881A537E38FC5FA5032072A9B4CA7B4EC17B7055F2273C9053AD82A765B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c590a6c72aa7e794c1e141b049ec6f641ad54eeb20d948e45a11414049dd430f
MD5 12179efa210644c1a8377074d5dd633f
SHA1 69b9caa8404913b0e0633f33d94086bbc942d8be
SHA512 15818c51fc763d768df12dfbd43602c7c4f96ff7a6581b277e8c2f72ec6a819c9529776eb5748d14a9490fe878664a4399d8c5629f8601193d4b4204e5bff9ea
SSDEEP 12288:J+7LV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:MBVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18365237A768999E7D46B92B0C97383058B2B7B693BC181C7E17005D199F81D1AC3BF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c86075fe31da9af62c4b034d488e1de3b6ec37fb2711be3999cef1ad1dd9a668
MD5 bc4424ef240871a3eef38f6880be9729
SHA1 bcba82d8ed6724af8fa9406f0cb39f6fe3a07578
SHA512 9444a5a56112b3e8fdc729c3d3b81dad7fc746522d10bc5d5dcb430109b3d87c72dc00cae9225bb92f9269a62098fcc4042bcec8c8cc348c9fccd9a7bd036167
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYfVg9N9JMlDlfjRiVuVsWt5MJMs:Qgb4mBIBhGFogFIDRRAubt5M
TLSH
T11A65AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 c4cbc5a61f28f8f6499f393ba7b584ebeb4aade3c209af000477132b3540774c
MD5 8c645a1d830b1bc2bca258fd39cf3328
SHA1 06a50a0663fb91d19bd69823d808b01bc41e8a85
SHA512 4ff996b7f622fb21dd9ebabcab6a43658c6b9f75a080c1f06242337f713a99562db6fd42c7bff937614e5fc8a374685f297fcaf1a78665727c930d5b88c4537d
SSDEEP 24576:JG88u8FpJqH19zria7/mIVg9N9JMlDlfjRiVuVsWt5MJMs:c7ZFPqVka7/1gFIDRRAubt5M
TLSH
T15D95F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3f5b9917ff372e9520d52cea1bad93ce953b49a73fe957f66dbd84bb4dd68219
MD5 4011c6774f05debdfc522b96189715dd
SHA1 4fa3acb45c40e72db9f8ab07a2e82b142d9ca7b5
SHA512 3a4a622e1c95f5b4b59cb58b9c135e215e3e9e08678cdfc4709da49fa21c41bb4a2aeec5e55d5ba09a122707c620d0ca5f46be45cfa952a6506cb46ffb436cf9
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0gFIDRRAubt5M:nG05lO43bIUf
TLSH
T176D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1df379c838dd821c3a803d2c020f6ada2afcd4e2fac81bb6db7c80564c892215
MD5 4ce550aec1d2c02d68f457ca6bee0349
SHA1 528843825dea9097b04988672186846b77d4f3a6
SHA512 8c6e3db91a7e99803ec5cda3bbdb6741560159b7478fb617fd206d24a359979678e5830dd4bcc4b2422c761cf993395a12dc260d739e278b4d66d2a479cad271
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidniVg9N9JMlDlfjRiVuVsWt5MJMs:3a5POZ3BJt2pasx2+msgFIDRRAubt5M
TLSH
T13165BF5EA6FC01D5D579D17DC583460AE5B2342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 eea19f3dd6fd2756ab4540415941c91bab5e98d8fce853a99248727e8b3d7c16
MD5 fb53eae9cb8d0383a3e3b8a398cecc3d
SHA1 e75cd0df7bb2b861c03151d2d7c62cbd8fee18b3
SHA512 07ea477b4ffbf555a44eb35c0c90881fcdcf23a340d560afe3d287bb064aa708a7d849efcfe50718c1fb969edc30cadcb4d19b0e05a7059d2c96e8c34e6fe170
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkAVg9N9JMlDlfjRiVuVsWt5MJMs:RNc/zEOVHFVgFIDRRAubt5M
TLSH
T10C858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c06c20f9647faf1361f7a1c453fb800049d14119acdb56e1e5779a5b895bdae2
MD5 519421b5c26d95a1dbfc60e1a3ac2599
SHA1 b22a4a6e69e9b4ce45799b5ec57cb84af6621c17
SHA512 fd941a18367917ad815d737b0fbbd1d37fb1e03e7826c8f34600424133391e87c0eff3cb410bf2e83428fb324c54bdf23f84f57d8b20bb172f3eba648c27c97b
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmDVg9N9JMlDlfjRiVuVsWt5MJMs:9TMwBtOmxgFIDRRAubt5M
TLSH
T10B55AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f72ffe4168eda9eefde89b1b3f8b4d649007c178e374ffbed685a881c2322e06
MD5 aa685a779dc12cb488cc33b271a655f0
SHA1 60264ef2095108d6d5e5731085d3dc05afe4818d
SHA512 45349c728d6ac88a7f113295f1a5a70797535a572bd12e77e7b13e5479f2562f415ad9419a3d14001dca1e9f297beb9d0bab11df7334fe7d8ce2d521b6e7dc96
SSDEEP 24576:WPUr+NQEVg9N9JMlDlfjRiVuVsWt5MJMs:WJQEgFIDRRAubt5M
TLSH
T1A585F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 63fb012b50163a2934f5b53512a8de23d5e5d91d6eca1633978b49e628f6d3be
MD5 f9ebf8617656faeca79e10acb0b5714b
SHA1 915211f4158b9e9d4b142b920f3004b5fc0a1b79
SHA512 73c507b2c6f4bfa03b31a012a710d4df4b89eb8e6118da97304a1ab91d5a5b8711c28159527ac8a1c47fac604137f1fd21b326f7f8dcc772fecaea31850005b0
SSDEEP 24576:ND3FHshBIYQgAFVg9N9JMlDlfjRiVuVsWt5MJMs:NDVHeBIAAfgFIDRRAubt5M
TLSH
T14A95E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-322-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/248-92-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/248-91-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/248-97-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/928-102-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/928-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/928-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/928-108-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/928-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/928-342-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1056-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1056-76-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1056-53-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1056-60-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1056-72-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1652-39-0x0000000140000000-0x000000014078A000-memory.dmp

Download

memory/1652-0-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1652-36-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1652-8-0x0000000140000000-0x000000014078A000-memory.dmp

Download

memory/1652-6-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1772-155-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1772-329-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-162-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2512-87-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2512-317-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2512-79-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2512-81-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2844-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2844-229-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2844-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2844-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2996-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2996-325-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2996-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2996-120-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2996-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3408-140-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3408-148-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3408-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3408-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3408-146-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3956-138-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3956-27-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/3956-33-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/3956-25-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4264-66-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4264-65-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4264-74-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4264-306-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5152-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5152-20-0x0000000140000000-0x000000014078A000-memory.dmp

Download

memory/5152-12-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5152-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5152-26-0x0000000140000000-0x000000014078A000-memory.dmp

Download

memory/5560-125-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5560-128-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5560-134-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5560-328-0x0000000140000000-0x000000014021E000-memory.dmp

Download