d4b3f0a1b121194eca23e007dc0f46c39cfb70366c22dd8d9d7eca680e2edb68

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260804-x6f42aff99
SHA256 d4b3f0a1b121194eca23e007dc0f46c39cfb70366c22dd8d9d7eca680e2edb68
MD5 868d2c634a59b551bbbf7aad480b23dd
SHA1 f63bbd4be1bed914dbfa39d64d88f156008e9c12
SHA512 d7434ede18a221da24c19285770f46d947b99229aa083bfeee54e95f259071e28e7610d5857ccdfcfd3699846def61818af921c45f5f7cafb1e1248f64b5484c
SSDEEP 49152:/+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755dw:W/PvOIjcXvvOOc55PiLsICFq
TLSH
T1ED165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3928	elevation_service.exe
5676	elevation_service.exe
5004	maintenanceservice.exe
876	OSE.EXE
4684	PerceptionSimulationService.exe
292	perfhost.exe
4140	ReFsDedupSvc.exe
1332	SensorDataService.exe
4252	ssh-agent.exe
3152	AgentService.exe
4200	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2c4a1ee9b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df8565ab4724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049a9de6c4724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000304bc6ab4724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096a6d16b4724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000332e4c6b4724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3112	2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3928	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3152	AgentService.exe
Token: 33	4200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4140	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3928	elevation_service.exe
Token: SeDebugPrivilege	5676	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 6068	4200	SearchIndexer.exe	103
PID 4200 wrote to memory of 2904	4200	SearchIndexer.exe	104
PID 4200 wrote to memory of 1124	4200	SearchIndexer.exe	105
PID 4200 wrote to memory of 4988	4200	SearchIndexer.exe	106
PID 4200 wrote to memory of 2368	4200	SearchIndexer.exe	108
PID 4200 wrote to memory of 1496	4200	SearchIndexer.exe	109
PID 4200 wrote to memory of 5948	4200	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_868d2c634a59b551bbbf7aad480b23dd_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:876

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:292

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1332

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 534f68be825685ec8c547e1be9818baa7d0dd363e2016b3cfbc6345496b312c3
MD5 1673fec18aa54f81114494aea3794c56
SHA1 2e10f16c27704498c16c8f3e79f75a4c3b101765
SHA512 c4f6fc3081fe00e895d8407c03ae8d48342ee834ce8d7f202bf6bea13be274a245b4029c9559a9050fb8f2f8682e9e2d2474e9c9b3191245a3929ac1bd57da37
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn8VUY5iLe34LCFq:x3q6sjB7PiLsICFq
TLSH
T12DD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 bb9ab5a1292b033dd36f17f4fa3647b9fd57ec17c07cece067bed4911fc4aaa6
MD5 1aeecb0b7c7b95cbca65442526d835dd
SHA1 593c91dbf4dfac0888011e8717ff1ab7549c2b3a
SHA512 a85ca42c91448434683ebe39a0fd882f2390529f726b34581f4dce9d7137ac83e1d5fe016c43b92075068dd844b726119248ccd230af3f92a2c13c1f5eb9221d
SSDEEP 24576:PXYfDtczABw9P3EK+q5Ng4qew+z47yGCFq:6tcVVUY5iLe34LCFq
TLSH
T1AA85F12877E00DF9ED67813CC9E28511E673BC954764E79B03A49A290F332D89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 dc25a9400f3b5c7efd8cfd2f1e05f4a916c31fc1e73a10f2ca2ed209226e2bd1
MD5 a5cc3c17cdf42def10316b99769fde08
SHA1 8211c995c42724d9221c49e9e76cbe4f35009eab
SHA512 8706cf60820892af9648be6c8c9dc22311686de22f9f686ecea5b19cee95a46ddf1fa8597bcace8e9c225eb34b2cd06a36fc123640d72b794170ad3b041d5cb4
SSDEEP 24576:40Le5ji0hmxbrMgw9P3EK+q5Ng4qew+z47yGCFq:4Pji0AZ8VUY5iLe34LCFq
TLSH
T17895AE26F6B48771D073C0B9C5D2A69AE971308257308ACB4286D77C3F676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3910bd4a46074a140161cea27593b52c7efb6792ada634757ebcf1005a1a0d0e
MD5 953a1d1e1a1be187947acff63004761c
SHA1 35f87a5e59286a6b43a81fcd2207667c3ce88bfe
SHA512 91cfc529f36ab6a5becf5089628f3e3df32c90649d81d572294e82e10d781a60720c6a625d28ab7724c53a0ad085cfe274b577c134cb887c92470ff25a10cb4c
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWn6q8wyuGw9P3EK+q5Ng4qew+z47yGCFq:b/ezSC6vUzPveHjygVUY5iLe34LCFq
TLSH
T119755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6db2bff5d1c2bbe0dd68a2c3b1bd7258a139e190225fe9e0b326130ade2e1c69
MD5 29d318895b076729960be5d3be7419d2
SHA1 416369ce017f61a4327c394376a4864fa866bc7f
SHA512 411df3c2891073912e0ebe7e1009110f387cc4cf35645b3beef462362f23c92e373c1e58fd6e8a2cf19b63259bd8a93c30414f5bd6102cf18a3c2fa6e778d0c3
SSDEEP 24576:6VbqPb88hv/l+Y1w9P3EK+q5Ng4qew+z47yGCFq:6VO88hXl+NVUY5iLe34LCFq
TLSH
T107559E66F5B48331D073C0BAC4D2AA9AEE3234415B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c8bc8ca9dd1a20d31d4a469886a3ac7aaabb2505c820c3299b4a70ab5d0e6361
MD5 176f7d1594e4649884857ac149fe606b
SHA1 50920584b49058d5854b58e14321636648d269de
SHA512 362f6a0315678f07f76273dcaad597611d5ae7b1c996cc4d7e72ddbcf83c5ec400638f1478dacb848f1ffb125bf2eaf0e1bfce5bc259167c6d372c3fec9a1069
SSDEEP 12288:OCB0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:OCEw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T10365232D79D0BDF3FF5BA53825EF61A191B1FEB09094D61E9912B64C0D3E0E1E82C129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 2058761804fe9ed85a8901e23b3582f3441f1fb0a7931e00fad0970f262edb70
MD5 d7c18d85161414484307841ac55fafac
SHA1 a5e7068f29a1249ab051b6b58d8251a3472711a3
SHA512 c54a888a2c76fbb562f6d4b68a0e86da25f2d036139ff2c8e60fadcd94bac09ac6f1d3db88aa7cf9142a26a827cf1a9cd444aa2c935c1cabd9de62b96b01e073
SSDEEP 12288:beBNUbTVO86U80Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:bJIUtw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T16F85CF3BEE68FCE2C27E9D7856918240D772B8704B61A3CBD165C30E8E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7d5bb69b99b0cbae318f48dff68f1151523abed4b7c5745e87dbe4bf1096fbcc
MD5 7f476516ca36c4087b0cfcf43d33e640
SHA1 64ae78aadf08e752a6ba5a8c02a9ee2394f19c18
SHA512 d6185ea8fb539eaf425a42930139f0a50cce3a31483ccaef6d53b83fd10cf2ae26a8bce56dbeb6335d5a97e675162fb1a3b4cd7f6bf490ed2e525b8484001bf8
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THN:ZQvGAdlCEL8c/DRNw5CPPiLsICFq
TLSH
T111267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 495dfc8d62b17b2b485dbe4c824c2ff2ffcfa4d899b4af1fb3510386a06fdfaa
MD5 238293ad7c67c0f1d1957251a6fe8d06
SHA1 5002dd6b9e2787ef4fc2b5f5de208de42da198f1
SHA512 9bdcede8ce8d3fb8e10884ae77f55c09753fb27fd864d2747be0d4db96a9c09dd53a77c4f3f249a464130a1cb2747b85b5d3c09eff5d6893f1191a7b00fd5e26
SSDEEP 24576:iiewsAjrw9P3EK+q5Ng4qew+z47yGCFq:5ljsVUY5iLe34LCFq
TLSH
T1C485E031FEB4E432C7BF0DB61B76C716147CBA204B511AC3E3A89A8D49341D2677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 16f2faa57eff690aa251a3711b25932fa2d37ac4624230009898821df786294c
MD5 66f6869845ad652fdcef1c502f3ef071
SHA1 8f76637a9c6780becab855666896b8a7dc08a41c
SHA512 b53a4de314b35ac601e633d4498376c5a87cc7011c6c1ff00f1486bac9469918fbdadc3790ee2ee2350927ba26c501270b7c77b17bac6c6c4f7ecde169e34d37
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH+fa:uUEtQevvqc2W1cpV2tI32+fa
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ca78e1c71b7985776c7bc60cfb6d0db3c59ad42f0b5df55f91c83fdbaaf177e2
MD5 494450b2b39dd74c86b0574f9e2a90b4
SHA1 05fb92e8bd74cd9544528a9a1fcfc754a50a38f3
SHA512 45e29780e0c16eeb178ea42a0ba4f2eef98324dd29dcf7fdf4ede4750ff42189323f618ff25adba719ec346ed7f20530dc967ecaf1d065652b17b233c3451770
SSDEEP 49152:vCbRquA/m2yL5zTfFiV+XenmE3/zMVUY5iLe34LCFq:ooquVjnmLPiLsICFq
TLSH
T1C2D58E1976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 affb95d6b05aadb80ccaadba723f67797e794ca522758abac59003284b38479e
MD5 238d8c986fc523e6cb26e3dfc2934587
SHA1 a076a732681ca7bb9ff2a04409fd25c543e9fc9e
SHA512 43b6893fcd0eee8101b88049078733f2ecdd6d092c1a03f86d2b135cfe9d94311acfbe335d3d46b8152d5921182071f8816c65a94d6ba548648cf64bb905d4ac
SSDEEP 24576:ZAhGL3IFoiwtA5l7S53yw9P3EK+q5Ng4qew+z47yGCFq:ZAMUFoiq5pVUY5iLe34LCFq
TLSH
T17C359D81E7F955D4F5B3AA7899B69171EA72BCA65E31C20F2150D20F0E33A90DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 45f79c54845a5add6fbb37c324de391ae2ebd612c7d5353c94cfb61516d40724
MD5 d2f0d6c5de3fb96bdf15656dc1ada7fb
SHA1 6d0f9b1c3e0fa84cc54d57d104f9eccd9933f44a
SHA512 fcb90c74a545e49a238dd95c86d5d2dc70730694e62d027d1fafa01b0c656180c6db623a7f8c87d4ff9c9401af65f33164e9c3a9d7b4d9a3290e2e4fe64de9dd
SSDEEP 12288:Smw5HEjsChNiBFgl0WDm+CH0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCd:LwuvOWXw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T13C75F14A76E41CF9EA678238859BC132F7F2BC112A25D71F1760C64B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 ba89a289b6e83c9bd027282170f19ef3c4824b373fac6321186c575ccbd622d0
MD5 865f781f5fe8fc40b8f8c11ebbb097ba
SHA1 8634a3846df819d0df1548864ff938bdaaa7188b
SHA512 169083e903a8996e83bdfea512a570eb1a3e96cc9c80129acdddbb6071899c6ccfd19d5381627ee2750ebbe827faa28a0444fd389686afcf5b379c67bc58129e
SSDEEP 12288:5XZ1Iym0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:VZuYw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T1CC65126D32E079FAE697923C99EA4241D3B2F8A2637583CF162152490F379D29D3C731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b7326dfeb425cc77e47434c40446fad6a676da844872476a3608708681377bfe
MD5 679e6574dc6b065f341ef3c0168ae9f8
SHA1 d9df0f7c098537261ed4e2916dc86ded67e69822
SHA512 fe93bd4cecc91f72f62dc4c19aae86fc4cec34052c3f381762700900f02021b57f8971c32417be170a7eae5135245971466c25a6b595ea526e846d24c0ccd66a
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN3wPiLsICFq:wQyiKa/X+PNgfa
TLSH
T103667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 40e123227f6bcf197c0f3092f79f795cb01c7b5ef1beee4ae6e8afd6f68c3583
MD5 4cb709ab167c3696ccb1e6c22fd169df
SHA1 5079f9bc4721d29f67bddd1ab183ccb47afa70e1
SHA512 7bd57cd01dac8238cd07cd0108c04c28fc4ecf9500f732fb5223185a7c502dcdcc84edcfac9f6a81561ae43fbf0202492fe671d8eb0b53a6b49b6b3ab8a279fd
SSDEEP 98304:DQRQyi36YOcPbLvw2gAf+PN3wPiLsICFq:SQyiKa/X+PNgfa
TLSH
T1C4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7218cb75425393f1a2700c5f6b46820927faca9eec3a6a7fef3d1a7d6849b80b
MD5 b9f259396f71eaa876acccc5607ea650
SHA1 40566b97c1b9f3bab80e4a7ae143fda1f84b74dc
SHA512 627270a0e614fad5569fa37fe06de6f412312c1436f8246c9d01e0842baafce301b76e813b7b91ea2aa78e6bdb71975a2e6ca32c01c1b5a51c1688aebfb0d70b
SSDEEP 49152:C68Qg55nhceWu7PNU3/8VUY5iLe34LCFq:AthLRc/2PiLsICFq
TLSH
T1DFB54933B2F200A9D44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e40cbb1c3728db0575c3a9e3969f9bcccab251d46c283e5e93b2c661f8c4c1e7
MD5 dc750bc7bf0d9eec622449c33c431435
SHA1 b8ce5e89d24e3d2200536515d45484e18c207584
SHA512 460df04a7bd0eadc901ec11bd8b267cce5e745c6074b7e49365cbc75785e1e76e1e187a3344ca6624f3f088db9b1829f9ac2b4ffad6007a40666ed583655442d
SSDEEP 98304:1y5112gYy5azzVvt69nLKnhZ5PiLsICFq:YLIHEWhDfa
TLSH
T13F167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3f552e13f9298cbfdc60d7a0d3778b34bb122cafdbdad6ad173601fe1c2eeddc
MD5 de862d413d69fd51bce807d44fe6aad1
SHA1 22ce3d7a8659f3c2d7f10660c6db6269cccc8b60
SHA512 66bdaa89364213b93a3003ab8d6cec743bbb1032d4c11faf8da25439dbdeaf53867cb05d32ff29e0790d8d84d6c972ae37726fb434fa71be48908acb444adc79
SSDEEP 49152:JB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glFVUY5iLe34LCFq:fu6Jmdxd2d/PiLsICFq
TLSH
T16CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 186d3d36ad96192b44820325cd773a68d92a3bf01fa35ac5ce2eb46865763667
MD5 00975995e8963c453d27fa7db1ce5125
SHA1 ca922e8a954114f169e93a385c36a828bff78b8e
SHA512 d04e8287e1383b87ba4f7fb83f1bd44152179f2b13712218ef343916dcc877b2cdf40762e6fa7a52dfaa09c56e23bd47f5e428ea1ea87fcafdcbb47ce948520f
SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xuVUY5iLe34LCFq:6mifPWRLPiLsICFq
TLSH
T1C1B5BE13F2D901E8D05ED178875A9232EA72BC460B34B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c424660433d4c975d7dff81c53a5296a796aeebfba0d06dd81a01eddf637265a
MD5 95ca6ef8c935f54168bd94c139adfd58
SHA1 55411150f23be475a361418745e20ebfe86ccbb1
SHA512 faeaf9d4fa19bceff4420d0d412487b3f456b1485e50ee65bb3ef94a167aa491e4b8504328c2967a8ecd9057027e5eae61be96bb36446a8605fed075fdfdca96
SSDEEP 49152:2SuZQIY0Be2KcRVtOnks6NMHqPVUY5iLe34LCFq:Y5dKii61NPiLsICFq
TLSH
T1C9C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8d38777daeb08154da892c6e60fd071c4a7dcbc7e8682e1675c6069077e30aa2
MD5 92a3af2dd350caf93ddf3be01b9df6d1
SHA1 1dc32cab27af72dbabc928037b2986d1b6ac76ed
SHA512 7dbedfb01b77941710810940b02ceae7df7c46bbeff0de58d87041fd8a65b56f2f519caf573900d7868d7b00b5171385df16a3da1ee62119559da27f332cbba0
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5w6VUY5iLe34LCFq:cX2imphHPiLsICFq
TLSH
T10995BE13F2D901E8D05ED178C7468632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 08ce74b8b9577126c30788ff7069786f85674f4062d568ed1b3d44a83e0b220a
MD5 26d27df0e0473eded870fb3004e7b64f
SHA1 d2e294daf5a013b5f79876565b1417fa647fb60b
SHA512 a9fc24219bff7c31796d8b8b48b8893c9cfb8982218b82fd64fb29192d8538c4b31d7875329e6be68e65a964354387a8eb67cbc73d653002572bc0dd95de78ac
SSDEEP 12288:R50Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:Rcw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T18965232D78D0AEE7FB47957855DF51E191B0FEF5B195921FAA03B20C0E3A0E1E82C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 62a46238d722dc547349657e2da0b1e370af98e0f4fbc9afd2dd1a701ea31d3e
MD5 e8a070c342c99d2637243f9d05dbd581
SHA1 fe1cb508f15bbce3056db79f7b04a39d1ecb8c14
SHA512 c3706ca1cd809c68f37ee3bf7dcf7681e1b637d326bb94e9e4355ed1e071f44a67addda1401c4cd08d92be70a84a41050acf51270d02e5525d787b4a9490fc9a
SSDEEP 12288:ji0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:jfw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T1C965233D78E0AEE7FB4B957815DE51E191B0FFB5B155921FAA03B10C0E3A0E1E82C568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ba9813fb1c6a6d3a44c5d80fd446a90d8c00c24126b3448f0ba141e050c07023
MD5 c14b83b8d6f72b21b0b3c2246bfbaa2d
SHA1 54968fb9723b1d008b5b7f8f199a5100482c9e62
SHA512 5eada83622a0310696261353a8f281aad38922804c802be07b43fde5a37bba3f3c238f177007fdc3fd23f44ada4c4946c22c55acf8ac80708a5b0c063bec8092
SSDEEP 12288:400Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:4lw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T19965232D78E0AEE7FB47957815DF52E191B0FEF5B155921FAA03B10C0E3A0E1E82C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 6e68ece849318505705ff4be2f89a35cacdc768db6b9f4ec264a4304827194b5
MD5 dea442402b9816f16b2688b750448fa4
SHA1 fac6f9ec5611f4a25dffdaf003870c6a2bd4ee9b
SHA512 15ba96b9ba1883ac786cbad47bbfb0942d78ab3102493da6fe06d53ce58ab24bc0bb588d83d3f27113d60aa208e66d77ecb1656e3869ce37c682290396e12312
SSDEEP 12288:mVr0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:jw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T13065232935E05EE6FA57D13C85EB51A1E2B1FDF4E231935F9A02650D0E362E0EC3CA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ab67c761e2429433eb560c277decd6e3b4bbe1a31e2aac356e38eb59c09d8723
MD5 b5e1c4c187b819e95d5ed9cdf2a1a1a2
SHA1 ed7bbdfe2803be31c94665df469be12f93aa7f9b
SHA512 9c8e52bd1bc6a198b274d2302db28685a27a085537ee8badfcbf4281b01af95e7385615bcc670b2650271cf35b10ee1153c91e96a0b142b4e3615b27cde6e9cc
SSDEEP 12288:MT0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:M6w9P3EK+q5Ng4qew+z47yGCFq
TLSH
T16C65232D78D0AEE7FB4B957855DF11E191B0FEF5B155921FAA03B10C0E3A0E1E92C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 a464ce4889be0e19fe434c8214212e0099002a8fbe69d5c2af7ef4e6d092ffe1
MD5 380dc247ea23ce8e4ef0f8b1f8a8dd24
SHA1 9add417e64befea8b47d3fca261f59abd0cf0032
SHA512 69415eaf3df6fb71e77095428634ee6f70fd98695cd5fc2216881e45ebb94cb3078533969d5c0f212943312434328852b4f6dd3215a5eeb1d465fd8d392325d4
SSDEEP 12288:cu0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:cjw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T16265232D78E0AEE7FB4B953855DE51E191B0FFB5B155921FAA03B10C0E3A0F1E92C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9c0f8da207bf6ba1e246ff5afb037b6680fa022081d296a5acbea73c1941b90a
MD5 afdc9a7f7908bd54d623cfc54604d2de
SHA1 607db0c493969630b77bebba2d1eb78c7c4b6a0c
SHA512 1176805d2c1ae979a48805267ca034db203968f2b356565552f18ad792f3e7bda611e0bee1e33445ecf600b7932f292b836bd883728782610072fe3d121dc15a
SSDEEP 12288:aK0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:aHw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T1EC65233D78E0AEE7FB4B957815DE51E191B0FEF5A195921FAA03B10C0E3A0F1E81C568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c6d714cdf8a881507cd50bf784ac1f96281be39d0c94108a752ec34fe4318eb6
MD5 aaf4364a044ca8dacb6b56744032bca4
SHA1 e55878ec27f62d467f528908ba708564b28e3b8b
SHA512 e23e81f8722cd2176b24e417434375ad870029f55ace685b86b4381c7845fc60a314e431ec24718446a9cb2036ab3a8e0c964aa2374433cd686e95d091f5978b
SSDEEP 24576:XZMbzFVSO/w9P3EK+q5Ng4qew+z47yGCFq:XZMbzfUVUY5iLe34LCFq
TLSH
T1ED8502A9B3901CF9ED67813EC9958916D2B2BC690770C61F13A4361A1F333E15C3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 66a6a4a5ff90f67556b0207badbb57173aebfedc425ecb7e8685c813fb22ed56
MD5 27db2a86ad689f0fda7a0f82164de900
SHA1 6624674cd02a5a05166a7497703d5319ba7915b7
SHA512 649f483d523859a484219ddd5f55834c78dc0f844a9899c423d750fcf913f09ce0bb92cf405c87e958d3d5278ddd41086c50cd8dd6be8dacde00daa0a8a40557
SSDEEP 12288:wN0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:wow9P3EK+q5Ng4qew+z47yGCFq
TLSH
T1C465232D78E0AEE7FB47957C15DE52E191B0FEF5B195925FAA03B10C0E3A0E1E81C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 a7395646d26fa175589ec8d42f79c168e4a26177505f95b151cf7b8124cfef7c
MD5 ecac7756f1ec085bedad093609f9f3e9
SHA1 43bf1a153a1fb78e93ce0d0eefba756f1fc5a79e
SHA512 73331e4be659d9215b659eca934e63b857e0f59c848b010fc042012323d502d134446d1de8ef80100c25bf5918a4aca1e6db5873ff10b63eac9526bf84037e82
SSDEEP 12288:mx0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:mUw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T19E65233D78E0AEE7FB07957815DE51E191B0FFB5B195925FAA03B20C0E3A0E1E81C568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6043b1971059d64aaaa667212231083250135187ad702c4b13cb5ceadf3c8913
MD5 ff9168887a480ab2e2cc138244a1e2ce
SHA1 c9c1a5e073940950c622b6c83ff30bc638712db6
SHA512 650e39d70af3a809d5fb778505cbbddb64ba0a1485ad7f44b139af5b59c4aa1160e6ca1f8ddc2bdcb84ba93e5b941bd007021eec4aaaf27bb8e480984345dd9e
SSDEEP 12288:yyPz5L8m0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:vzy7w9P3EK+q5Ng4qew+z47yGCFq
TLSH
T1C075021B72E135F9E527923888E61A52F371F87247208AAF1760536A1F372E0DD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3671271cc82284ad86feff38a089ffbbb101326b937b5bea796ed07f9af96455
MD5 83b13cd5e0834d764c3b0f9c66f697a6
SHA1 c535faffe20abeaef766a4ed8185aa913e1812b6
SHA512 0b0631dc7c9db777e319056bdf2f90f9f8f953fe08d77f3cceac8442812837d122bc792242dec64b916897b2469e4d6ff76c69c0bde07100a008a991d166e5e1
SSDEEP 12288:hN0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:how9P3EK+q5Ng4qew+z47yGCFq
TLSH
T15565232D78D0AEE7FB47953C15DE52E191B0FEF5B195925FAA03B10C0E3A0E1E81C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 36be7c22268140fd6df2a6f01904085f511180e487d34eb81741165aeaa0f6b7
MD5 6f935be57de7697354258b596b4224e8
SHA1 ed542648acff61ce05b75e49bc93d21c250220ed
SHA512 a8e55b96bd354d1b07b434906fec86624bd5b9fb824a42bd19868c3c74f23009334959072c5a4ad0e51282eab308a3f046e26b3acb1f13015e3cd6829c07421d
SSDEEP 12288:XN0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:Xow9P3EK+q5Ng4qew+z47yGCFq
TLSH
T14C65232D78D0AEE7FB47953C15DE52E191B0FEF5B155925FAA03B10C0E3A0E1E81C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 d0cc2e86c5fa9032841eeb843336d43de9aaf9d8557908093a5d364dd418dd84
MD5 19082ad8bcdfef0432f2599433d7a982
SHA1 0b00bdb116509f617a5c7e97c94e8683bef9ba3e
SHA512 57f5e1df942d52bccfb7b5552c2a1c7f7f6798ba93188eccee92f5824c8c45a60276328142095c0e813e9b9439744f68ec10966436d5037bbba71b21e77e9e36
SSDEEP 12288:byPz5L8m0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:Wzy7w9P3EK+q5Ng4qew+z47yGCFq
TLSH
T18875021B72E135F9E567923888E61A52F371F87247208AAF5760536A1F372E0DD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 ab5c4e02240055616b0fdb6d8bdeff8043232417e7594fa66c2f10ab7388fb65
MD5 2fdaf2930fd81bfb37323f13ed734a9a
SHA1 1bdf8b968c18c030eec59e87384e396ebcb2f124
SHA512 d92662999b9e4fb7e5f24e9d6036e009c98db5fdccaf81f565a1a5e34dcd770d5923484be4fcfd957b9c5455f77d846ab5947e00955a3a5056cfe231f76333c6
SSDEEP 24576:eTBaLl3z0zDVw9P3EK+q5Ng4qew+z47yGCFq:eTcLljFVUY5iLe34LCFq
TLSH
T1698502A8B3901CF9ED67813ECD964916D2B2BC6A0770C61F13A4361A4F333A15C3DB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 56e7165d9f51265b98f2b8a2f5a5fd0c80d2617c9ae9fedc0120cbc39e5300f1
MD5 10df894b9365de2f3001dd7934bc3933
SHA1 118ed446f566a37ab852cab0ca984440c4e72d50
SHA512 3ab2f944fa3166d6cc3b41a25f8eb81ff778b22978bac2f07c6745a15328f123bace7df0b3848cf59ba7d4938097113b32275a7bc8a39e7459d3e4fc89716862
SSDEEP 24576:63gd9CHKy7GZZw9P3EK+q5Ng4qew+z47yGCFq:cgd9CHKyaUVUY5iLe34LCFq
TLSH
T1F995CF90F3E414E8F1B7DA3589764511DAB6BCA91B31DA8F03A4661A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 a8e3ceb276794c1d26009da393f24b82e20d10ec4067a58d28164a4fc3565c04
MD5 a903ea5a88f44e594886288d6d6a6284
SHA1 fa8b3ee69c4bc3c183b99b01cca7cc763121d5ed
SHA512 be228e5265b2fb65cbff16a0d034fbe6d830394f49f273fb22bf549a4e12e728c8f5a7a073f1f9d3414344f6a1d94878184f17e4d32a4991861d23472531d872
SSDEEP 12288:OU0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:OFw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T11E65232D78D0AEE7FB4B957855DF52E191B0FEF5B155921FAA03B10C0E3A0E1E82C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 33ed423c168be88147dc757fffbf43859c91d84e79c37dca36bb598450a98c77
MD5 7fa679d363b68720187bf6f12c806925
SHA1 2e369317513b9457df4d9b9c18754c492955af30
SHA512 a95d5e8bdc00c6e9dbc5663b35720271ea69914722b4e28865f14368f73ab154040137682aec05d10ef66fff6b695947f76a129f39442190a235c25c4688ae55
SSDEEP 12288:qG0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:qbw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T1F665233C78E0AEF7FA4B957915DF52E191B0FFB5A155921FAA03B10C0E3A0E1E81C568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 e866d9182ac8f061c10264c6e5ff7093561fce9a44f6a5701bcb076fcb74e9f6
MD5 9044e65954d43c89bb1188e4bfb3b19f
SHA1 19efedb349aed05b5e8a0b11d830313784d7938a
SHA512 d77293205b36b21e428a29a78ff960adab906ae3e7008f8f986a6a8fb7365d6616255a43eaccd85279d838b0b98e9f162e1fdd45902fae2dc586a49c15ec75e9
SSDEEP 12288:8P0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:8uw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T11C65232D78D0AEE7FB47953C55DE51E191B0FEF5B195921FAA03B10C0E3A0E1E92C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 bc38f3851a689b20357714a230b1c648403c955399046dbeb51cf2418dec3cc4
MD5 c6d14e5771c010c80a727aaf338fe49a
SHA1 dc26461e2f3315800f619e887a366ca6010ee526
SHA512 aab12aec751ee3c0665474df3e551fa49f6208d1acdb87f8398567bc6c491f00f636836766ac82437f33e49e9d682be462b5324102caebcc0f55deba980b01f9
SSDEEP 12288:YN0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:Yow9P3EK+q5Ng4qew+z47yGCFq
TLSH
T16965232D78E0AEE7FB47957C15DE52E191B0FEF5B155925FAA03B10C0E3A0E1E81C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 297cd05e080f7a7bd47f5954b097b2b1cd7e8a37de4cb2d1fa45966224f12adc
MD5 06dff79139e6270250e70d80356581e2
SHA1 2fd6b96757d1cfc23347485592ef2642e7dcecb6
SHA512 fe29a34daaed89503c640b2b69be5d9d86d64a52664cf0c2ec6b17b3ab6c7a5f54e38135eed7b92b3684c72c3661afbc7416841d790f4251f40ce0276ae2eac1
SSDEEP 12288:aU0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:aFw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T13B65232D78E0AEE7FB47957815DF52E191B0FEF5B155921FAA03B10C0E3A0E1E82C568
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 920bfba5211850b523aa3e20f517604763824d39e5586df9b8aca41261913ae9
MD5 b2150343a605a29b04e1f5b01a6e80df
SHA1 da5f841b700033187804a3eb9c2bcd81478a6d9c
SHA512 cf5cbc4572e826441dd16c916bfa20e88c3ce6608bc00b274202fc54a9d47d06bbd54296aa8f0963f6bd14ead034da6dff09b6288c50d60844a48db58cfb061e
SSDEEP 12288:010Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:0Qw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T14A65232D78D0AEE7FB47957855DE51A191B0FFF5B195921FAA03B20C0E3A0E1E81C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 d5010f85f4b067c8220611ea3c8a0263fe87366a67a5c711c0c7967d887d622a
MD5 815987c84a7f6d3d08a0c4d7d3c7adff
SHA1 2b847fa9e789710890d6abf84518f19e71064437
SHA512 ffc8c4ae319bdca6500ab7067c06a58a94ddc961ad29e962cecc6737b1485ecafeecbdb63dce4ee31d9fee2e162d9253fbcf20170dc5f4e228074b5578ea33cd
SSDEEP 12288:/T0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:/6w9P3EK+q5Ng4qew+z47yGCFq
TLSH
T1A165232D78E0AEE7FB47957855DF11E191B0FEF5B155921FAA03B10C0E3A0E1E92C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 9661421d57c09b618f2af97711b67cb2ee332839f6d2e232dcb365e16aef95c6
MD5 1d6185665265ac8f64ac5a86540ba0b7
SHA1 c5cf8408df4cb6c3f3b37d324111a9fa8d343ab3
SHA512 d2c59cbcc0269fc200a653dde4c1ebbf064421eb12e3a3724a02078022e43b177ec04beea5b85137a2f330741a20df9a0108449d18fc68f32b92f82717b82aa0
SSDEEP 24576:BfwvGk9RX6wkyAIkw9P3EK+q5Ng4qew+z47yGCFq:JMnYIzVUY5iLe34LCFq
TLSH
T16E95D029EBD848E5E1B7913C99F7460AF2B1B8691B31C2CF025A536D0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e3bb8b678bed4571175a8eebabd548145d7e528e15bc5bdcac9de0fb0f99d3d6
MD5 29d4fb2c891124493b38cac6f28ba13e
SHA1 e35ac8f92a0fd10b463dad59b481d8736a094c90
SHA512 898ffb31a9f4b3a9927230eb59b28eef59e3d44d06cec9486eea20a30abd0bfe3ee6c9067929ea21a8b74aacbb149176e1880d94d79bb6ba31631d4d3e0c3d29
SSDEEP 49152:HYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aVUY5iLe34LCs:iySzPQPiLsICFq
TLSH
T15E066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8d4bd3653b4f9c34c989e186ea90c5090aa247d4a4df4720fbd48608ec4a7e4f
MD5 0e4677dc5eb4d188b51ba3eb94282c37
SHA1 389392f9a0d5b5317b56a53de8f631516b179880
SHA512 647e401af5baf3870106fd02255b230d39c02fb282aabc055733f673d098b375e2d9ec035ed26b00d13b0244289d69d9c95d633a060f5d06102f2e4b90ff9923
SSDEEP 24576:V47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYPw9P3EK+q5Ng4qew+z47yGCFq:V47JUQjTirIhCnDHUPfF/KVUY5iLe345
TLSH
T15065AE1DA3EC01E5E1BAD23885554A5AEA71782D1B31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1a1fc5c0e4fd1c17421cc6c1cffa8dfff97216f4378977b83b61be1ef1dae5c5
MD5 73e55c306419cd9eaddf5ff4b0760be3
SHA1 cc7bae76b3ddad175602af4ae4ab0f2705be0ca6
SHA512 a7dffaa969d2a8ca480823c4e79bd53dfa28f807793b7ee4cae7fa478be8be25feeb7a574f852bf3c419f87ad9f22a9d8dca468a415c6c82ca2907e520a9ba9f
SSDEEP 12288:w4sfd0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:SYw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T1B975F119E29416E9D06EA239C79A4641F333BC6593E1D3CB56C0F53E0F3A1D0ADE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 49076bb6afcaefe912cd288568ec811a0eca928452bcbb9f4a9eb45131326b56
MD5 7695f6c826e52d6cf2231c9fb50e5fb3
SHA1 a8c50f460907897de234156762eb5e6813bf2d22
SHA512 93be914f488de342543a8fa6892af7f4683f3c7d61e52abca2dc941d03d768efa7a941be88ffd1e4ae5ed0ef0bd465277500720640d64c0480894fe7e4d6d090
SSDEEP 12288:iqZTIQKJU3f42lkq3vt4XCVanqYbSp4csa6x:iMEQSUP4eRyBbSWc
TLSH
T1FC250700762ADB5FC6A940325E32D1CCA7707D41EE05AB0772C9873FD57666CBAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8473c44d74ed60dfa2e7f76a2476adeed4e5a42b86fb1f899834bcd3ef3bb21e
MD5 0b4cab6994b8285191b3780f8440c3b1
SHA1 ef95bf08c2542c36a3bfc4dcec34986ee22c7ae3
SHA512 38fce908dc8c54c3e4b0a0b545abcf69265ab1b868df2fe565cb4e31edbee5412b1cc1fcffeb5c0bf6cc01d1cb2175b412d686f9244c2dce2cc833b05549c4b7
SSDEEP 12288:yDrpPWhk8ovKERp9HP+LlEFpYq6zGUYsjkfWQhPC2mnE4s56C3:yDrpr4C3
TLSH
T1C065D6816537A3CFD1F76032072A5B4DAB74EC07B7495F2663C8453ED86A726A0B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ae0143686b44a57467635f90e1414853d8ecd2bd783c46308e9776f742d4d382
MD5 f64e6a2a1b058e7cf4eb9b3b7e6ff47e
SHA1 a6dfea92b5163f2671658f28513f8a3186560ea5
SHA512 74239518b68f9126557cb45dfd7a8545f0cc911a2f5044c108421e28fca4f93ac50222f485a338d9316aafc06cb2b305154de714b5b03559e54c35ffca057c09
SSDEEP 12288:Kr7F0Yew9oK3QP1KMbqEvWNg4qeI7VGTtVz/4TvRYinCFqaZRAA:IAw9P3EK+q5Ng4qew+z47yGCFq
TLSH
T12D65233975D4AEE7FA6BA53811EF91706161FEB49744D1DBB902B20C0D3A4E1EC3C628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4a7134b80c3ef642b6820a94143db170d46cd0118ed6730b3cb18c937cf07ca6
MD5 3f2924d45aff33ea630bf1fba97bb67a
SHA1 df2b6a0f42b6c2428eff765c6fbfbdc60c78670f
SHA512 ab6f17ed838c9b9120c51215aed91f4c3820a7983b20bc1acfb4c85717eeec97748418e05c3aafca9355c6d58d15b3c45c06cc5c044447996829b01fc97fea8d
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYGw9P3EK+q5Ng4qew+z47yGCFq:Wgb4mBIBhGF4VUY5iLe34LCFq
TLSH
T11665AE1E32EC02F5E0FAE2B89DAA4417D6B278161731D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 9e2ac5d109c5ef95bb1401c79a0ae351a917ead1956aca659aeadb353f98a81b
MD5 bc519592d543775dc40d440e0667dc22
SHA1 75deda12dfdf2f3d8b1ee855b5624ed70daf1951
SHA512 761d57140a4d0dd9b426f90c03a90fef1e57422598d8e82c5fa080855e4db7b61107d6cc600ac13da96b35bdba4dc0f601c7465499e0df4971a05c3aa163b7d3
SSDEEP 24576:tG88u8FpJqH1Ozria7/m/w9P3EK+q5Ng4qew+z47yGCFq:g7ZFPqVJa7/NVUY5iLe34LCFq
TLSH
T13495016576E006F1D47BD13889864663F6B2F8250364EBDF07A88B551F33AE54B3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 7ab74a3b979ca804750bea2709fa0442d7b084001b15b98b4be297003739670e
MD5 6c04127068514ab3056b99cf335c532f
SHA1 7a341465d15e56321e1f67d970a3f21136461e47
SHA512 625a8e612ae1645368b01c6030c8355333190454cd7c94812fbc092cac1b8b5d58e8f8c72fbc89009aad839573f3453b275fdc7b328eba99de48bc3a32b77226
SSDEEP 24576:nPUr+NQzw9P3EK+q5Ng4qew+z47yGCFq:nJQUVUY5iLe34LCFq
TLSH
T1B075E12F36E81CE5E676E17D85864619E771B8621312D2CF0291816E4F379E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bd03458d5bce974fb0a76ebd074dcbdeae2f3df23747cf957db58231636d4307
MD5 cbee0e8f5d1cf934d3b758ea6f2f2ab0
SHA1 c7a7811d119fef800b23f48b99725a71c9a246cd
SHA512 7c06c86e1fdb8498e2b826a04e410c7bf465fb761f76c703d1bed377b3f36c4f58d635d46c50d9e58db3711902d8794118d0468106724e3061f8c9261fefa5a8
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkVUY5iLe34LCFq:mG05lO43bRPiLsICFq
TLSH
T15FD5CF6E62EC11F9D1BBD07CD9C6460BEBB23825032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f7d1b9ddd4dfa5bac0c51400642ae7364035489bae34f85c3a8749f3543c63be
MD5 3aaab2b9dc3112542e4f5e995e355f8e
SHA1 a10f42b7a687625be7d2d7266d0c241e481d406a
SHA512 51cb0e560dda763c4c24a6c52d3ae606d48273a0c25c2caddfcf124f30ebe03adfab521ce45371fca6f4adcf8f4bc2f2d95277fd3a6ea2834b3cd7e7e5aa2110
SSDEEP 24576:pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnhw9P3EK+q5Ng4qew+z47yGCFq:5a5POZ3BJt2pasx2+m8VUY5iLe34LCFq
TLSH
T1B665BF5EA6F801D5E5B9D17CC583461AF5B1742153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 56b9a07003fae8e8da898b8ba5be8a1588d012d6e500240a263c889b3f363beb
MD5 d119149385d70da02f8ff6b303d02325
SHA1 93766ca13a9c00fe96bb441d57a407b4be7a154a
SHA512 8ce7d0890d645ba98ec5cec330273e95c3ea05f39e0c3e2a726ede294e45fa9e3e7a9dd8e61c314f8d3e8dd85ca9d77ad00b2b3920aab96819e2ded6e2f06ef2
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7Fk3w9P3EK+q5Ng4qew+z47yGCFq:zNc/zEOVHFtVUY5iLe34LCFq
TLSH
T1EA857B2622E901E4F5BBE1BE897B9546FAB17865533086CF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a11d9e5996744ff4583a9d8e827f05d15495edf7830bfdd2a3ff4e5bd39756f0
MD5 6fa8533b12f49f4878139889bfaf2b0b
SHA1 a3eb931d1caa5076a9e1a1382606c725714e6dfb
SHA512 3a370e3dc8f1de70e744ba268f2f8047242024c3a2aff45013a55c26fa99511a2c9f581a600c6d702a70de62b122cd5a5cb6de0057098abc9e8355ff86e63abf
SSDEEP 24576:MTkNvNnaFeYhJNtmZBmaw9P3EK+q5Ng4qew+z47yGCFq:MTMwBtOmBVUY5iLe34LCFq
TLSH
T16455AF6EBAF846E4D1FEC6B48D238512E6727861173293CF5290C13E0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 b036e6d4a772869ff95452ba6a8c35fcb1aba140aeb80aa9c60bc5f5b2e4b43a
MD5 40929beeec4a1706190b16d7f8c3dd20
SHA1 b2a5e49fc1cc304e6f8b35143ad139fcd5306adb
SHA512 3ced908b0102b1bb39302a151595b38303c3ffe2a58b7c380ad573613f370e34b9595eec53d1c4b5f8c6adda2d6bcb8af4b83e1c4721279d80e37ff627a5f5f9
SSDEEP 24576:TD3FHshBIYQgA8w9P3EK+q5Ng4qew+z47yGCFq:TDVHeBIAArVUY5iLe34LCFq
TLSH
T14085E13DE69C04E4E57BD1BC96A38606E77178A9032266CB0690D1B91F2BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/292-302-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/292-82-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/876-60-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/876-59-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/876-263-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/876-66-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1332-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1332-310-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1332-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1332-105-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1332-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1332-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3112-29-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/3112-0-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3112-9-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3112-5-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/3152-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3152-124-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3152-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3152-130-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3152-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3928-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3928-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3928-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3928-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3928-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4140-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4140-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4140-327-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4200-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4200-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4200-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4200-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4252-112-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4252-309-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4252-118-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4252-110-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4684-282-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4684-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4684-70-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4684-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4988-325-0x000001D232190000-0x000001D23241B000-memory.dmp

Download

memory/4988-324-0x000001D232050000-0x000001D232180000-memory.dmp

Download

memory/5004-42-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/5004-44-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/5004-52-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/5004-55-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/5004-57-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/5676-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5676-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5676-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5676-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5676-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download