6f975c59fef2a9eca49475962714603e277eff5ee3e2e6b454c7094a0d0cf080

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260805-bprcsavhlb
SHA256 6f975c59fef2a9eca49475962714603e277eff5ee3e2e6b454c7094a0d0cf080
MD5 0b6ad4d40eaa03724a51286cc03fd2a7
SHA1 7c58defc1523233b83ed0076157fa991967ce1ab
SHA512 ba08b22f604d52c4cfb4310c855612fe978aa602d3eb9742af5847f81101c79659ce13c601c555309b88b8394f59275cad52211c733afbbb4403df311c259222
SSDEEP 49152:b+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755hr:K/PvOBjcXvvOOc5P7wRGpj3
TLSH
T144165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5048	elevation_service.exe
2568	elevation_service.exe
4340	maintenanceservice.exe
4296	OSE.EXE
5776	PerceptionSimulationService.exe
4480	perfhost.exe
2676	ReFsDedupSvc.exe
1120	SensorDataService.exe
4992	ssh-agent.exe
5808	AgentService.exe
5720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6f7d1d54e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\InitializeAssert.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\InitializeAssert.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000397ca8867824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb4c4fc57824dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b5990c57824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cc070c57824dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000085f05e867824dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd5e59867824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1160	2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	5048	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5808	AgentService.exe
Token: 33	5720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeBackupPrivilege	2676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2676	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5048	elevation_service.exe
Token: SeDebugPrivilege	2568	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 808	5720	SearchIndexer.exe	103
PID 5720 wrote to memory of 5800	5720	SearchIndexer.exe	104
PID 5720 wrote to memory of 3484	5720	SearchIndexer.exe	105
PID 5720 wrote to memory of 1192	5720	SearchIndexer.exe	106
PID 5720 wrote to memory of 4692	5720	SearchIndexer.exe	108
PID 5720 wrote to memory of 5020	5720	SearchIndexer.exe	109
PID 5720 wrote to memory of 3148	5720	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_0b6ad4d40eaa03724a51286cc03fd2a7_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4340

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5776

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1120

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 358f9519f2c89e130b2fa0c201696be5f0d4531965ff055e13efdfb5e888405b
MD5 64de3bb59e28e2901b3d84b2a634aebb
SHA1 8628e8614ea264fc3ba031ae83126821e8b7eabb
SHA512 d1d39373bd85be3b94d98ecc5408a276a96713033c9a8f3484f64cee36612ccda0ee83169bc35ff49581705e95b7a9a1d2a205696c3e6b9b27753889b235898e
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmLNiXicJFFRGNzj3:k3q6HjB17wRGpj3
TLSH
T18CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7f9ba36bbf7d0fe196743ee0f7335dcef8b80a79043110b69942fe7982c221cc
MD5 aa7e4966c0f14c22a50c1a267e6fd809
SHA1 714cbccb66c66120120da3af87bb7bf3b9d0a972
SHA512 eeba7e3cb90e0211d16d1fe13108d5d093826a473a8b83d60fd693cd88b0a221f58f2e86a3741535a23b7069451ef529df4ffeb35d90630a42d398c9eae7319d
SSDEEP 24576:zXYfDtczAc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WtcJLNiXicJFFRGNzj3
TLSH
T1FD75012963D408F9EDBB813CC8A28411E6737C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fcf3fd741197eefbf6393cb1cf94ee6f4816dec3cd906b861c71fc0997699b0b
MD5 d1dfc1e842602ae94e56a33296cc0871
SHA1 9e7618a6a7735c8da71444be1264859d3a4149ed
SHA512 9e7c2a26fc3ebff2460795dd09c254a16b6d70af3dc435918fc43d5879d544d29362623b982bb73acd4380018edc73d487d71cb4c044adf1ab0f233f51fc4e20
SSDEEP 24576:z0Le5ji0hmxirMb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zPji0AcOLNiXicJFFRGNzj3
TLSH
T17795AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 418940ebc37dc3623f24985bd5b3de6d5b5fca17056f422ebec0a369e2f65c00
MD5 75129747d59fe738a7590ceac2049a09
SHA1 c789a134d6e489c759bb3851b530e932542c8eeb
SHA512 521222f660612cecb17cd4c81e1973c5eaef8aa12ff1e2f93a891e04b9eb22adccb026a39994f24f8ad3fe96337f5b31379345ae88d23db79d1c80fb1aa27027
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyu5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x/ezSC6vUzPvxHjy6LNiXicJFFRGNzj3
TLSH
T117756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e0113a52725fb381419e5c68e8069cd7b78e64fdca01511ac31145c18ad86e42
MD5 425c6734c7c20fac986cfbb0eec7b1f6
SHA1 bcf0632f69c8da7b0a40f3887dfd8ea37478e45e
SHA512 5bfb7347eac72e6a0ffa38ca1e4452eb848dd977f4f00aecca1771a2d9e596f43729eecff70ae93ae646cb44d46aa418c837b4b8ade0f72650dd80752d0474f8
SSDEEP 24576:nVbqPb88hv/l+6Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nVO88hXl+XLNiXicJFFRGNzj3
TLSH
T114559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 bd555a5530fc11e3754bc16ae6bd4fbdf82c807166ca79ee4fa8479161b768a7
MD5 debdcd248a56f7c1a98359fcad26ca60
SHA1 952d6c1ddb966149f8c30f0433291489fc74dc36
SHA512 83e45b0683dfd1cd6f5d89a04c0166225cf90f87cdc2ecee7347b8e1196d089a70d16ce07c73925a03bba98afd5c4ac09fb3f57d139735174c6c02a6d4dec57e
SSDEEP 24576:BRf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HLNiXicJFFRGNzj3
TLSH
T16E5523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 714e34c4acbabeaa41363ff2a866c0145c8aea2efe362170982320f57361bcc7
MD5 6ec654925544a3768860994939bb4a7d
SHA1 3d35696fa0be603da88ad9dcb9c6d5e610582cee
SHA512 46ad15236d58d458db36f18512e8f92156a4fc376452d60f8afbfa039de2e2f1f262e38b68c6d54479b074adbb53fdba4fb8908ccf63f2aa29ba17e5ebdb9e27
SSDEEP 24576:9JIUo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9JIUoLNiXicJFFRGNzj3
TLSH
T15875CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f2c6b5530fdbd32433f5baf01c9311c90105bf6daabaa5917be415ebf5d0b12c
MD5 06fb7bff2a87bc217557e1f630349e06
SHA1 3e4d446711a2d0358a4e27f09358735cd6ba07a3
SHA512 94254b29ea1e6207d20416931602ec8e1d345ce9a67798ed7742e9299d92bb7686434cb2ce3a184ed8ad160adb8e86e158080232ebc1d235944cc083425a9082
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:VQvGAdlCEL8c/yRNw5Cp7wRGpj3
TLSH
T137266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 de912a1ae5dccbaf5d20cde3c351f8c417b69fca9d8baa6ba260e4b3698cc0d2
MD5 7f9527e3338e86e18734d88c123cb2e3
SHA1 7ca15aec873fa7ab6d30b22f1b43d4df9a4b67ad
SHA512 dc2f0fa7e36c5f49fb7abac6eb555ba8d20445c43650e850319c4012b6aff1ae7a7a4530b51a738b9f42363ed57cc516eeab80b7b6c41e8da8a5200b54351feb
SSDEEP 24576:VdewsAj+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:blj+LNiXicJFFRGNzj3
TLSH
T19775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e3401dcff8ff1d10691cbf466617ce3846a809b477f9c0ded6498b5a021d1811
MD5 7af63559b1920d367260cd56694861e6
SHA1 aa7004aea6910ba148828a4e7ff9bf70bbd86f4d
SHA512 354fc8c34c2db9604c35a1addc9c55e149216d99722ef2ec899497d0ada63f588502ed301a7899202598da695cb5fea9135e8b6dc4aae6bef6971a18244968d6
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHKF9:9UEtQevvqc2W1cpV2EI32u9
TLSH
T1CB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f24051af4baa8f7b71134791ab25a5d83cd4590e3730110f81befc8da2120733
MD5 f19deb019035e5396a49b456774b2dd4
SHA1 e2d7723b0d522f96cbfdcad3f92da1d79df09697
SHA512 179dddf117dc8853c9df56ca9753c902e235229b6cb8925a5240ba367f53dbe2f95f4e3bfacf1266c34b33624d7068a27b063b8454558341b0fc429e44edf0c7
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/zeLNiXicJFFRGNzj3:ooqtVjnmV7wRGpj3
TLSH
T1C5D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9eb4bc9ff23bff0664ed962e3e16d5e156b83841b7c8385c37e8785d3d448cbe
MD5 bd67ef0d9c5c410ca747e1756dae940a
SHA1 66b16bc0ee3d7fa95becc17091796045f4a7c8b7
SHA512 6f0f38d214cca7eeb95a9ab5e1112f725adc8058958b2e0e009ef4e8c33c1dbf8cb896aeae96165f8b10535d1b7512b4e48057f388099fd261ed94a39a0d1429
SSDEEP 24576:2AhGLJIFoiwtA5l7S531/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2AMyFoiq5FLNiXicJFFRGNzj3
TLSH
T14A359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9ecdaa796cb1ed2216a7a98a905ce8b47f9bf02105ba970439ea856dd3966e2a
MD5 aca6f299c4ff234e757dc43569804871
SHA1 5f0c4470434e62e373dd0e1f5fc8b3c29fc3bb6b
SHA512 299bba6fc69f07c02b3f3bcde903008838daec4af297e55b1f895470ea6b4f68da842f63da665b556dc5c9706370f266649741b88642e6d32f97ab630bb4a2e7
SSDEEP 24576:cwuoOWa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cwDORLNiXicJFFRGNzj3
TLSH
T1E175F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 70209901904a2db3737fdc568c858d7ce356ea8839cee9bb24d0e93a2e18ed23
MD5 f3225fa0f2a75b1ed65e6dd6743a8928
SHA1 3a41aa5f92ea2e2881107a1d7c58681c68cdb98c
SHA512 cc2db1fef52e59d129a82517128831cb644206e8bae79d28311e853d5fba3710d213c4761161651329f051fb9b8a9a58f51035a514aa4de93bac72a322ef31fa
SSDEEP 24576:nZuT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+LNiXicJFFRGNzj3
TLSH
T17665129622D820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c53a7f2ca5f277d4b0ea4840532f91942296f6a32b1d76e4a72a578d2370e776
MD5 1a4f391259eba78832934bae462ac9c8
SHA1 3c9a1cd90d3d2f5886aa63c2138d880835b9c881
SHA512 fd5cad7e500ca61b0b283c439dde5607b17137c38e293baa8703a7b0b10eacaeda55a447f08233f1a1330d85248fed4def0c56cbc025589e443655937bae6ac8
SSDEEP 98304:dQRQyi36YOcPQLvw2gAf+PN307wRGpj3:UQyiKayX+PNQF9
TLSH
T18A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 80469492edcea663e183f498e35d2114676288d0102d77dab24a9254fd6c7de0
MD5 13d571579e700b1a18a5cf731d84ec83
SHA1 1860878363bf0b3e920114ad99050a6b67fc9a9f
SHA512 d5c648d0208adad628d744ec357be7cd0bdeb37fa724ce58544825526dff7d20ee5258e767004f555e567680d81beae53f0e86067b73817520c344d30e49961b
SSDEEP 98304:wQRQyi36YOcPQLvw2gAf+PN307wRGpj3:nQyiKayX+PNQF9
TLSH
T1C3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b2e7041143b3371864ebae2f73aec12c1232f019c49d481b1a4f38adf99020d6
MD5 f81ab7fc5230e9d9cde8e8c3383a60c9
SHA1 9f7167b60406f69f69f25a2cb20baf22c77b717c
SHA512 df231b7ff50512c71575b045a23e9d6931ff5a5ac2826ae4ef2599d42ed0ed4a55b01182e42d3519a1db73639c078dd2f647300924ff353e9311d438e3da636d
SSDEEP 49152:268Qg55nhheWu7PNU3/OLNiXicJFFRGNzj3:UthWRc/O7wRGpj3
TLSH
T1C3B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7258efab656504586ef6f1e6c9bed3405dad1f413cc38a35a218ed9c323f0fc8
MD5 b6d1a0211073bf7ed3453f1115e25d59
SHA1 dfdc66bdb86fc60354c5bfad9c548048f14d6ca6
SHA512 5a7d1f968a2d84e540fd8e8accf6784ca53fbf4ead45cdd56e146a4ac722714715e88852afb00863ba1c5c24eda8b84e6db3485f15e662e69e6c2d07bb8b45a4
SSDEEP 98304:jy5112gYy5azzVvL69nLKnhZf7wRGpj3:+LIHmWhhF9
TLSH
T108167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d6b0070220aa7fae19339561cf84e5f8004a841e5cab974a6d215976bac68a6
MD5 410e34ba96cdb15f0441f20588769f4d
SHA1 37cbed873f1ea42b82f452b5431bd48f11f1143e
SHA512 28211c07695ff7113baca71cecd1ae166eca21e2e657384918c6de81c8a9281c0b7b281d95ba381230ec4f9301697e9615701f526e8bb6b7f1c5df8462381c9e
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5LNiXicJFFRGNzj3:Ru6JmVxd2d57wRGpj3
TLSH
T16FD59D13F1D901E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5f91c867e824c2ed43f46bc49effc2a007fa32211657df9eef572a2993fb9ee0
MD5 5582efc86c2363beb501b00c0821d167
SHA1 42e3f0dad00e7e10abe86362aa9b5533a71247f9
SHA512 b88ae0a7e5e6500285243b44a9f2da6119b2c013d8401830338cef7f8b6267cb2c94e3069534b9db0636cc54224830b4f0d3b244b0f262deeaa3d992c9620c41
SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4xILNiXicJFFRGNzj3:xmifPbRV7wRGpj3
TLSH
T119B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dcefdb510e51d3bb744639f237aec24387c0fb77a01898a388a85064b1ea539c
MD5 85a4bf6fce5a6999adf042d12f7d49f7
SHA1 c67d18ae835c5025860ee2e63569e41f2d5f6bcd
SHA512 1c0cd3102edcc4fe0ae4b6b66828bcfe1e756c8aaf9d646af9ec3a241aa488f29d87db047073e1c9f065dbb9df27ad01395722a6e5feaef06f803e1c5c47b0f4
SSDEEP 49152:tSuZQIY0Be2KRRVtOnks6NMHqTLNiXicJFFRGNzj3:j5dKTi61T7wRGpj3
TLSH
T17BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 054257f9dfd6408038868f761cc3df25a2b1d532ad54500ad4ea1372df60b1ac
MD5 5c194342329bf780a36a4fa3b351031e
SHA1 2785c3ca61e71c2ef899861e8787c31ff43dc922
SHA512 364e88ee1e8bfb6e2a4ede11899f364efafbe7b551efd3cdf35e9074b02b16a3e351d792a06404e3efdbaadab6d64dd41f35a0cd7efebb6fdcec642f35964c85
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wcLNiXicJFFRGNzj3:MX2iyphx7wRGpj3
TLSH
T17E95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 b5c84a18b1c044f05abbdf3696a6563fe7314e34e861f4316078c877adc947f0
MD5 f7040544488b5b7e08a5fe13d9497297
SHA1 ef9a1cabe30d9ac1cbb86c798b272aa3f3123b9c
SHA512 9faa2bb0db00e711ee2feec2090dfe1d7a965216f985480e79ae01806315ea9af11ce2964894890353ee976f73f74c090b7141d9fc3b16ef12591f8c5f1b5674
SSDEEP 12288:gjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 db09480405a5338052068350897f5ef407ef4df53c25b3b67163eb077d1390f8
MD5 8c7fe4642b9f474144c48e9666a15646
SHA1 bd00814c05212b3083fbcb50aae3992f3e5d510f
SHA512 a3b37ad3210a742a6b82a9abe05daf51f760a0bdb66ae91e67ba8826b63c48c043689d5c704631a42f2c44ba98632d22a9a6aa4c4136f7a43b932c72260b8710
SSDEEP 12288:AwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ai/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 eed539256b2ee85e78eec5696148caed1aca95de9255f9014817fb5f68727dd6
MD5 02bd4fe416baacd094eced294857825c
SHA1 d72ae98ba03445393b6eedf4420ba720fed50254
SHA512 63dd8fb514e4a13025643d6c26fb0fbdda6f720b8818dd9bfab83ea746240404ea47a938123148d1b29d7cec67eb27be8b15c269a0af4119aeea9238189b17be
SSDEEP 12288:yWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AA5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1a1c41d5848c12c889e661e6a81d1b4d0ff5b515246c28ceae733c1e57c5055d
MD5 03fa76751823106f9f95ac324cc4c8b2
SHA1 7bfaff7658636ae8a6da23de737a624d94469806
SHA512 652cbee354cae9a0390f6740ffb7681ff9976dfa416f465ac285d68c896135642f641692d8cea17c15822a6014426a8df39909e33ee35615276a7123404fa3ca
SSDEEP 12288:kVJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C0552393168901F1E9FD8039C6764428F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 dde027ea3959ebefcfc329e84acf000bd3c9a93fdec3641265ef53eee7821765
MD5 00dedb2c760b3e4567df0fae2c06f801
SHA1 c417bbae83d15afd309394208de954c852cc0f8e
SHA512 541dfdc09a86df8eb069257f56a1994c3b6ba70536c61b1968717a9c7375656cd239419af4f6e7c058a2289daf986de20afc9888519f317b3a5571432b65b118
SSDEEP 12288:mxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AA5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 cf14fbcdcf98c43df6a8f71515084ed4b97ce9f7768249d4ba08efe2b36b25d8
MD5 f2e6c91b62b4284d827c66752774e4af
SHA1 7f940d4bb39da5467cf65568959769a5f298adc4
SHA512 f4765ae37f209fba8c6243ad7141165b087a20ce9e18fd5e65893ee6ab7a3f01dbb6ee29f18b1fe88365dd27e5e6b2444bac836dd8e47c78eb74684875b6f41a
SSDEEP 12288:9siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B45523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 2b748b539d3d829ed362af9c5831836d2c04c026f6a3386b5ddc0d75b4c079a1
MD5 5116c3c1055b00f6f1a386a5837a0e72
SHA1 7d2eda236a17765a637dd8be907c916c9f50eaf8
SHA512 94bc93ef4e8c7d3e48efc57a3e597b8fe1347f08e777987d47fa64ec582b1f85590a811b4b8104a9b033ab418a847c48f7f1f14e8c5aa634fdedd934700412cc
SSDEEP 12288:eYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1215523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5be4982051fc4c935230bc8fa8a221763bfe898a659c2f6bd9df506e3626d028
MD5 f05ae9f9d3fa5a9cfe50b549108f20c7
SHA1 b0edbf0f69a5110b4a0c0f20bb9a2a9e719460bc
SHA512 5500b2681fe51a711c2ae0b2282be38f24ca15a2ccde2e943bbf55a36c36e74bd27be24bd4837844768d9383be02fab84960990ed5601da3b1d4c22b57aeb1b4
SSDEEP 24576:tZMSzFVSOC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tZMSzfGLNiXicJFFRGNzj3
TLSH
T115750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 ae1dba82a7b84ebbda686b3c5ebedc1674c822f59d32d3e10808327b1265243c
MD5 b06962207773d76cdfe1a6808b27e5c9
SHA1 26ad6e181a7de0ee1cde665b318b0b821ed4f959
SHA512 8cbebab70d25b43728edfbf9177c621ec5dc0ac6f68fe3a33e0c26351539b06bf96ff126638d8322b63253c1049c8aa294202bf89d80bbc7208512ae87617565
SSDEEP 12288:O3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B25523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 4e7fd7e701b0d6b3955e0dafb17f1073d3311c649e3e104f852784bdf8fe949b
MD5 76d986a6dbdd012067442dee2e4c1223
SHA1 c34ab86aede3067aa15c1cd72b087b4feeda0ebd
SHA512 03d66db231e2ece0b9929306689bedb666a5d86268c627df3d88d381eb089d5296e03991d7b9a14d5ae180ab833edbe208b2e4d0d9afbdd30bbf506ec407baf2
SSDEEP 12288:HbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 fbc953a39f7944b6a43e8dfc215b4f7c54c590700f14a6cad0294ac610f36d12
MD5 b81a919c19dd9e61e28c3b31c927e05b
SHA1 6e3e3435ed1b83c01c720f131c2c2d32d045cb02
SHA512 d322933b5f0914b2c334438732d5333a15c7992f616cd8a54873754521879769e308d7eba716024e95352719ad58505a65c45066c532ef568b380e6b089d07dc
SSDEEP 24576:1zyu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1xLNiXicJFFRGNzj3
TLSH
T107650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 eac4b7e639053c1a0ab0cf779aa897b19b18226571525b04fa7a4d1afe8313e8
MD5 c2dba5db0dc210e024577eee6522464e
SHA1 43e31b3159d96d543d3499b864f87661a75e9536
SHA512 10f054e62b6bef6da139a25da9e73a7bc9850c622404cada829a760c2b747c465281ddae0395d1d64a623568eec4bf3468d057136da889502e9f1879fbf16d61
SSDEEP 12288:Y3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 7e9dfb129924a653dfd00c362f5be10b8285fcf9864e04496d5dba1c856b9e1f
MD5 778ce1407f98a839dd3f0d68acd7c2ec
SHA1 bf2ae45ea43c4bcf326204fada5feb8d231c0b56
SHA512 f866dea74a38458524b48b888944f4647e22bcb473be925eddac2adaf106a37ff2da374543ce644a1da1383ec43e0c19e3ed200f480f13c5d211768c0d1a9979
SSDEEP 12288:23iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3548955B1FAFC003986754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 38d558ba540eab3c685250e9bc4b5f52383a1310cc5cbb0485b67dc61670dedd
MD5 7a541d45927f78c6b384324c8baba2d6
SHA1 3959d67a819dc44ba039c8f11c18402b76bcbc89
SHA512 71301606f5264880a314418776ba2840710f0b276effe70315fb573bcf13bda3806b1fee9f16b434270a429fdfa9597da07401fc737073a85194d4f36630a3bf
SSDEEP 24576:hzyu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hxLNiXicJFFRGNzj3
TLSH
T1F3650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 762ba24090c82c8fe97acc8fe4b475830d0758fd469bc70c911b3416a792d32c
MD5 c2ffe46865ad1ab38b9652b574c16e7e
SHA1 fad61c30d6b32e0069fd4fab301c361e0de63480
SHA512 23cce27db1dd834da99e72fe089989884d7ba50e687a1809428d580c17aa7111a5f1eb8636fbf0e0f92933fdfb7e69338cb81d8ede90e9f423436209f9655480
SSDEEP 24576:qTHaLl3z0zDw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qT6Llj5LNiXicJFFRGNzj3
TLSH
T12C7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b9663974a828b10850d96c5b0b94039448393b1d014e5e0152c3d8cb0a6fe8a9
MD5 28c412104d0bcb7effe1ce9aef69d260
SHA1 008cae5c53dd106e4e9ea1a27a28c2e054326dc0
SHA512 51444ce8eb31f872b3ca96f3aa4432225fc7fe1ea7ace982613dfdea2d6689a65de6c3062b79de747d41e9f67514934ad2d7419ecf043dd318d02e71d8019956
SSDEEP 24576:337d9CHKy7GZU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H7d9CHKyaGLNiXicJFFRGNzj3
TLSH
T1C285CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 27127ee2b978dd06dd3df29e0f098ac35a8bf7dc12e653829bf08a0c8a8af13b
MD5 0d48794ead1b9d25027ef63fc2bc958b
SHA1 1416cb2af5aa0c2c121197c59bbba5f95583f704
SHA512 db8606e8d1180095ed0e1558912b56d9e1c4af8ac5cd05f2400c40d71855b49795f8029e53acf59d49fe90b7df63c0455b6ec873d32e94f5df89d5f1e83605a5
SSDEEP 12288:d2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 d659479809cba4ddbef26e9bd3c5c20b8552220c67b0732b21db9a785fc4b9c9
MD5 2a03dd2c0853e4a4d4952798c08c5398
SHA1 1bcccc1f7b1a88ff7ed3efc4bc3a7e688a451269
SHA512 883fa0ea18e7a6e19eb6b7422e4a28a6ac82fa73e5d8c5ae8ac9fad3adef9788ee1842132b00c54f280923d06f15527b2d3851b26db1c597419ee69b276d43ed
SSDEEP 12288:DEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D2558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 f4d99802f153ab26bcd9ad769afdb549836a6d72517a5facf3201b4a46e39492
MD5 2915fb72a5e4ab0e9d13d606396a60bd
SHA1 d9b56a96185c5426b1604ee0026975025216f293
SHA512 cfdbbb14f0ee1dec80ed8440ae7a858e8bba0d4b8903a5ef020f06bfc30fdc4dd973dd4a83d04b5442cad1d496e1ba07687617035c2d07c98b4ffa446ede321f
SSDEEP 12288:c9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ch/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D3548955B1FAFC003986764428F5882E1DEB5619E3E2483D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 d6c5c5201290d87e355cbcf925fe136830025b67e03bea7332b81abc0b118bdf
MD5 5aac8cd64d459d2453875b169a34a7bb
SHA1 51e592b3290201f3b51291607680dc67c0927b4a
SHA512 165a1ac518f57ad6b1ca3b72afd8934e2de47f88ab3241f9b5526bc9cd46f2971bce51f015a1b0d8beccdabfa4a604f0a553cb1264bf1b22e41458d2f530832f
SSDEEP 12288:13iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 2057c472f647407b23ff29d9a39b46a5e876222cd63c0888c0da86c364b1f03b
MD5 2ed913031a9ffb90cf7e999595577bfc
SHA1 461430717cd0f827419780ccba439c50ab6cea5c
SHA512 a236c2d0469657dcff7aa907aaf93bead5a8eb94cbbe515db01d5f999ad69216cb5f026410b30482c5862aa072136aa64c8819ed4e30f232bb56876251da49f1
SSDEEP 12288:B2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 ab0107ac74a6c7d58054373a6377cacb49ed9fe3289585cab16bd3e9e9cdbd3e
MD5 ecfa214a6598ca779731624a8b4fd624
SHA1 04b8c2d147d4598c61526631d4d63f6db875a8db
SHA512 5d9ab48f33f03807106b4d46f8194f3bfb68e5bfa33f460341f3bba7075a0769249f8c2305fb34fc27ca702e54e3fb9b1925cc4e65c2f8ccb47da930de5e25d9
SSDEEP 12288:EfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Er/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 cdcd7d10cab56ac108656988b86a4dc3d52f71d7374e12b638c5711416c2033a
MD5 03850742cbcae12965176a531a471a51
SHA1 a4138c6dc19dd657c05629832f44e253eadf129a
SHA512 5044c49582e1714f61b83a5686bac41e812f20aa765b3556f1c309cae2f78e87a7e614a8b2ba06504c2d70cc86dc5e7dace9bf6881acf727f69a4ab1ad409d0e
SSDEEP 12288:7xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:79/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 795f2a6dc85174d42d51543aabd6865756d832798e842ae448c61552a51b439d
MD5 b11e56f0bc994ad65c61c76d363c7770
SHA1 093bc3da1e2533b57f556f400c4d7faafa159b98
SHA512 957f3bd1c7a1526153c8c9895cba3e7b3f9103249067ad12e22c941f6dc9dc692642038bde39d7511cf55d71fd46f45f22796f5d9874925f7845c7009f7ab473
SSDEEP 24576:ffwvok9RX6wkyAI//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5MnYI/LNiXicJFFRGNzj3
TLSH
T1C385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2623978ae902152c64e21a60d4dbfbb28d00d718795ffa92320035163a017794
MD5 75792deafa3315621d852c667097b067
SHA1 c4cb4643ed1b5632d762e41566a374cef02f253f
SHA512 0812da4e89534cdf16aa35923fc0c26c1b44bb65b6f1574506a801c5252479c572c1551d6c55987872f43c63673d0f4b00ef95d3df4b0d7d33703db874e0c3a1
SSDEEP 49152:yYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08LNiXicJFFRGN:sySzPU7wRGpj3
TLSH
T177066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 60de41983922f7491224ae8e82d9decb4cbea8095dafcfdd78dca309118694da
MD5 8774a7d8cfd7654f234366c641b5c437
SHA1 32a9bec53f1903ada1ff319b5d95332c0881317e
SHA512 f97640fae23162339b5a56bb42e98fd3c7c77013987da64315e5d6f38d25ee2bfff5ee17eb0f7e4d2c0dafc9fe4768f9ed091a20275a7b9c8fddb46c8fe4544b
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x47JUQj1irIhCnDHUPfF/sLNiXicJFFS
TLSH
T1C665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 23e425f9ad41fd0266c52d577e8945ae44eb6f9b44d2f54ff7916409863f6b3d
MD5 2882e103c45db22d3e75e8e419623fb9
SHA1 34ace1fea1b1dbb6162921edd79b82e409579fb6
SHA512 c9bf40b3b9e8bd82e1d5b6c5e410067efcb131ecab337c419c3cd8079596c164a0e3e2401990a161062a3b8b2644c1846c27aa38f02d3a8693ce51b01e138abd
SSDEEP 12288:1NsfniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E865F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e8b4926abf799e314198ceebe602e93bb180b0ec7658b4e1b9e5960f026db90b
MD5 986cc005f2b18649285187c91ba82bc8
SHA1 605773c62578cb4ed810f2eb3b860104f712a6dc
SHA512 93b72635133d2029a65bbdacb8365986a5918afa10015af58e0032079580f55ad65e0bee50fdbd6d8d7327877fd97691757bc5a2d5ae57e5ee5a2d0b844daf97
SSDEEP 12288:rjP0+VU3fSH6SsMrmKz5HEH5dWfZB2D7qcR+vvTUfIStKFJ:rj8eUP47sMDz5HG5Ufn47nmTMEL
TLSH
T15C351850766BD75FC6AD40322E32C1CCA7707D41EE05AB0373C8873F9576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e6a32e6015ef5ef12e65d0d9b70bffe2ea3caceaae5a985b0076e2858e16e6ae
MD5 f7c9811d0b649b461390a8c7b5bfded4
SHA1 7da20241731e88814ab27dd2955c0f30f1ba2c66
SHA512 f15600e656fdb11d89cc8710ec44dec22705ed7ae7537283e59bf675a358eb7f399bcdd420cfda36f75cfcf0dedae57c9aaea3d4311faa1803d314dac8525262
SSDEEP 6144:MJ9DPafCcTAfknLpvOODabVvpRQ9DFA78E1e26tMxgc0lImkiMNXGwJWCI3pZ5jR:gECmLEmuwoHlO45rUks6d7I
TLSH
T16F65D8815437E2CFD1F62032172A5B4CABA4DC5677096F26B388453AD82AB25B0FD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 c22ecaa3f3ea9f2870a3cb8e7f0f6c2bae9e9590147d9203645b6c955f42a8e5
MD5 c0c8c41e71f062b3767023ad63b7b30f
SHA1 ffae7400375602f157260235664881a0458b71c9
SHA512 2e2b6b490d93667d09002ce93e4d0abb6a98c224ddb90c279b926f427ef063f8d6b63f8c594fbb4591917d88fa782fd6047b56cd70a431628a9d928d25561d66
SSDEEP 12288:2M7PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:z7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T183552393428D59B1FAFD1039857A8434B54D7E2C9F1598E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 47ae2394614a7da19fd64ccea71360bd95d0d32cb6466c1918b4111f3eef489f
MD5 35f0609a3f3d72fe8379384d0f9dfb68
SHA1 eba69af6bc319dc24c43382c4cb0eb9199ff138a
SHA512 1d92e28140049199304c5e0ed10d9cbc191c59125a7264432e036c69aa228598180e4d4646b14fb82dd96ec94be43762a1521fa9076b39d8e9e0ea0a4f0e562b
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bY5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Sgb4mBIBhGFyLNiXicJFFRGNzj3
TLSH
T1E465AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 995d74a79349c41012dc93ee96c8c8d3aee731ee6f3ceac1dbff938478f8ce11
MD5 6db8c249a7f7e7002645d59cb9f5c9c5
SHA1 56c8f4b566e40f4ad69e3acb209f38438c688a23
SHA512 e1b4efa01113f0f31f45894ecb8dd2e29c0c48aad8b87e88009611f809f652100caa208f4ccf949948647a70bc89e0cd63bba043f737c74696cb85354cb6af89
SSDEEP 24576:CG88u8FpJqH1bzria7/mC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z7ZFPqVea7/BLNiXicJFFRGNzj3
TLSH
T1AB95F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ae52f8864bd08a4396a589d743529be1c89a1004534887526b584658d671f296
MD5 72f79d506bf0ecbc09fad362e981ff98
SHA1 3674ab1aefe742c48687810bd64a6149a5857abc
SHA512 aa099d58a907871dfabf9e66f260db1f89ab97ddc1aab7ef3076fabb40bcaf0f66fbefef807ca452ee06ffa852e322c43c34704b8a2838e2f5bb658eb698ba0a
SSDEEP 24576:+PUr+NQG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+JQGLNiXicJFFRGNzj3
TLSH
T15775F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2c9b704724f97c746bfb10dd8f3b63a0882fa2858c40dfa2d0bf6988cbf65d28
MD5 eb3c082d8753594b653f169f198813cc
SHA1 8df7fab269ca52debbbccf1e9e432032074adfa6
SHA512 2dec6e9033a2d8dc9ee19f4aba26f05bafd301b69df347aa092b1005caa54a7abf007d3d6a35f4258c5fd5c6feb579a33ccd6c7e6090fd3c5cf41edb475f84c6
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWLNiXicJFFRGNzj3:xG05lO43bH7wRGpj3
TLSH
T17CD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cd616e23a533065f807188abb9fa90de98ee9a3ca08166074e2f5ef095b0ec59
MD5 8e05bf20d19534a2319e0a8833e5ae22
SHA1 ab3d28509aa4f8d49c78a08e26a157758b61203b
SHA512 d97e657f8cd09cf3111b06c752b2448b97cd9265292aa1de94e730b7f526830f63e57b12ec80c3be8102c6eada90187c463e1a271ddf7a30c2a88c11e2478fdc
SSDEEP 24576:ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidn8/TwSfVcYG3K/cJHlnFR+IGNe8jg:na5POZ3+Jt2pasx2+mOLNiXicJFFRGNf
TLSH
T1DB65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 56e7f364b27747de70588fe1ea994734a96b344a8cdd9aa1bced9900c7b2ddf8
MD5 aafad6cf555b9d7f0b9b700cf2df7e07
SHA1 8d78ebf8e0e7c87c7963689c908fae9544ea1ac6
SHA512 1f78ef9a65cc310f46648a1336b379196e78b059e346f7946b609367031506d0a8a634bf745c0b443d109bbdea17679e2f770380f22ad06723dd430482304138
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7Fk6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cNc/zEOVHFhLNiXicJFFRGNzj3
TLSH
T126858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8410e224ff67529091ee01d1a0ca600c16e4f7317f02b08ff72d2f4a17248ed7
MD5 784af4613318d3d8aa78ff752dcecef8
SHA1 975aa3127e5d99ea9107e0b3d50cd995d71a71c8
SHA512 1118e25e870615f1be79945091836f56f164b094054db8a72031ad74417aff5c9b938c65cca6f55b6fd878a073ea4c13fd9b77d3f8c2d6b336fa82876a1dadf2
SSDEEP 24576:W8kNvNnaFeYhJNtmZBmt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W8MwBtOmtLNiXicJFFRGNzj3
TLSH
T1AA55AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 5c04f22d71f3b161a610c8724b289adb4fdd5217e1bff4ee0fb4331cdfd45d95
MD5 66f8a7962562b613b6676650002e7c7c
SHA1 61cdaedc49533bb62d6e6ff7090cc36d97a4a855
SHA512 eb72ceba223f3182e63ccb3e82f3488d6694f3ba17e24f8cc3eaff1537a95b386676ef02236c4bdfb741faded199988ebb9bee6651859159080f11e4e83b8be3
SSDEEP 24576:+D3FHshBIYQgA3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+DVHeBIAA3LNiXicJFFRGNzj3
TLSH
T17F85E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-112-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1120-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1120-316-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1120-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1120-106-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1120-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1160-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1160-8-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1160-29-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1160-7-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1160-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/2568-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2568-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2568-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2568-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2568-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2676-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2676-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2676-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2676-335-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2676-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2676-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4296-59-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/4296-60-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4296-66-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4296-289-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/4340-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4340-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4340-43-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/4340-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4340-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4340-57-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/4480-313-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/4480-83-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/4480-82-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/4480-88-0x0000000000AA0000-0x0000000000B06000-memory.dmp

Download

memory/4992-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4992-117-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/4992-125-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4992-319-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/5048-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5048-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5720-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5720-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5720-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5720-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5720-320-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/5776-304-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/5776-78-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5776-72-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5776-70-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/5808-141-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5808-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5808-138-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5808-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download