11a15ba5f5ac88b73928c108a939ac84b428f480402074ec0e05e7c89496e451

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 09:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260807-k14xpaaq71
SHA256 11a15ba5f5ac88b73928c108a939ac84b428f480402074ec0e05e7c89496e451
MD5 ba73f954a12a154cb589ddd6ff82a4f2
SHA1 06dfc13a623d760ede434aa2365d3beafe90e418
SHA512 b0adf96c49196ee968ddf46d8b74b291532153d520476c9c4a8b59e0659dac5b2ef4ed4ffab8bbfc0ae362cb5bf71340ba3d00eadbaf72de7c30f42c0ffc85ee
SSDEEP 49152:s+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN7551t:R/PvOBjcXvvOOc5mU7dG1yfpVBlH
TLSH
T1B7165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2916	elevation_service.exe
4636	elevation_service.exe
4320	maintenanceservice.exe
3152	PerceptionSimulationService.exe
1052	perfhost.exe
5076	ReFsDedupSvc.exe
4524	SensorDataService.exe
5344	ssh-agent.exe
1732	AgentService.exe
2432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4cb0da6ce62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002714d8e14b26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007df5ace34b26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066b8f2234c26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee2268e44b26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052b513e44b26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3cabde14b26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4992	2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2916	elevation_service.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1732	AgentService.exe
Token: 33	2432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeDebugPrivilege	2916	elevation_service.exe
Token: SeDebugPrivilege	4636	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3860	2432	SearchIndexer.exe	102
PID 2432 wrote to memory of 5528	2432	SearchIndexer.exe	103
PID 2432 wrote to memory of 2092	2432	SearchIndexer.exe	104
PID 2432 wrote to memory of 1136	2432	SearchIndexer.exe	105
PID 2432 wrote to memory of 2096	2432	SearchIndexer.exe	109
PID 2432 wrote to memory of 3924	2432	SearchIndexer.exe	110
PID 2432 wrote to memory of 5440	2432	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ba73f954a12a154cb589ddd6ff82a4f2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1052

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 efc0f216957d03e9e9b01f1144421f1a222ac3eb3f81303907337675601f9efe
MD5 00a94e822aa59b9bd9e2e0b173985e91
SHA1 1e8cb9ffa0d0ba486184638287413ae75f770da5
SHA512 eba21840227906fca1ae0ef80d01e03aeda194a55e7cb401949150db62c8eb9cf54f18a382c02ac50761a822625e8d0ffbf42b1a29c4c9f6c774225a947f05d9
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvgDUYmvFur31yAipQCtXxc0H:n3q6HjBDU7dG1yfpVBlH
TLSH
T188D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 3e5c780e57600da2740a0b3f77bef739f1957e1a283a9113b70dc4a148155081
MD5 b43cad8d141329412ef1fe1a34d9e24a
SHA1 41681ed28d3c200cd3a97f51cc840341fabf2c1e
SHA512 33895dae3e5c41f3d2ea78bf7593940b975b29df93a7f93d0c8c9fe1d26bceea49b767abb1d543198564cd3d46ddc2fd044de3574f044603bedb76566c3edf02
SSDEEP 24576:zXYfDtczAS8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Wtc9gDUYmvFur31yAipQCtXxc0H
TLSH
T14805F12977D404F5ED27823CC9A6C111EA3378954760EB9B03B49A2A0F337D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0cae187618558195b84175d35d1a335fc510a64851f9c46c67183b034f91149f
MD5 232d115063729454dcf5899134e67d50
SHA1 b38cc851b72320821596fbbdda8a7eaa5ece0228
SHA512 04ad4e7e8904a37142d5cbc6193374d3daf9e7e9a649ee6b484db7370ae1929678976ffefdd32b6570d1d704759cdca2b4583dc4681a36e6358c4347c1dfddd7
SSDEEP 24576:40Le5ji0hmxirMb8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:4Pji0AcUgDUYmvFur31yAipQCtXxc0H
TLSH
T100359E26F5748331D073C0B9C5D2A69AED72308657308ACB4296D77C2F67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b325c6e9e8987544c12660ddda9c1052ea95dc126d5e10ce966fe63bb66d1d0f
MD5 f64ed6ec89e4b7991e3f1da59f231079
SHA1 6d70c7b8c0e294c135f67dbdd2b00d30479b9a4f
SHA512 4d336be11051c7f0b218ebf978aab0867db583cf283811dbda44e448ce11b679cffbde0db5b2b2dce60ac974292368c567f175d7fdffeacb16918a87db992088
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyu58NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:1/ezSC6vUzPvxHjyogDUYmvFur31yAif
TLSH
T147756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5bc7ae1f91bd7332f4fd176c793cdcdbb48d73534bba52df9ffcead08c5fdcb7
MD5 051fbbd956a359a3ec8f5d139aca8ec3
SHA1 768edf61ac1e46690e84709eb65986badc01aef6
SHA512 a958a9fda3a4f58396e66c25655897bf6ab15682d27d9b8dd87a0134efdaaf25443e7247cd05c3368a10e104f2d33fb591b9942d4a03d71f04bb01748291bc2e
SSDEEP 24576:/VbqPb88hv/l+6m8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:/VO88hXl+fgDUYmvFur31yAipQCtXxcm
TLSH
T1C555AE66F5748331D073C0BAC5D2AA9AEE3234425B31CACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 d75f351f26619d3403cc51b84d8f9084464fda6214f06027db7a37383e95d035
MD5 ce0e8dfcf24cf69d49c243ed49dad3e2
SHA1 b29bb9bb93f0e11a66de02fce9aabc1af6830168
SHA512 adad3d811f31a450407422df07c53d7f29cf8d9602862f2d9d99508bad694474727ad669b2a3937a3a5644ffa2a89faca45b5b6ca4392fb84ac0425202e09d86
SSDEEP 12288:QR3FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:QR38NDFKYmKOF0zr31JwAlcR3QC0OXxx
TLSH
T17BC4237B694CB0D3EA260530C5FDB1E16A4A3FF86946DE36A2383B2E0174DDAC85445F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 41e7f3a2b7615a20c87aee1b37b30881c752d549e7099192fecee43c7e5a0a7a
MD5 0bd787b46b86ffe6acb813801d3e96d3
SHA1 51f7ff7e3d78e02d0bdfbd4f32a2f8aa55c20096
SHA512 aee6131259df80b975e690e11c5cf0fad18f0778e36237656bf5f2f7664aac1fbbcb726005e2550fe169670cf0a7e07fa6382322c4867e4e6ea07fda19027a67
SSDEEP 24576:QJIUu8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:QJIUugDUYmvFur31yAipQCtXxc0H
TLSH
T10D05CF3BEE28FCD2C67A4DB85A91C240E76278704F52A7CBD174830E8E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 17e3b2aa85771250cc712d14e0e0f7f06c604ffe7dc0da37edf7a024a4ea1b0e
MD5 a6690897309f8c509aff46a21eda39cd
SHA1 cb4bb6b2f01505d67515968926330a3d5868bf71
SHA512 c5fd9f646bf7dd4fd69f0398ed3c031775c360aae2de6f64686120833e1f065cd962a557bd7855dc32a4dc47d6098e50d249ef8b3d92c073dc14dfc603c70a0f
SSDEEP 98304:sQvGAdlCEL8c/yRNw5CQU7dG1yfpVBlH:RvyEYc/y3w8QUoiPBx
TLSH
T184267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 08c30fdd13ce6477a72c98b25faf221cf0645e0e6c9d5a6679c41ca4323c962d
MD5 734ba1bd0d8f58209fc1c3fc70e5c971
SHA1 7db35e456f23845eeb6ca15555f8cdb74bbf253a
SHA512 a6fae52b4d82b5abae4495221171493b6caf19714d92c3eff4c17ba790cb8ba30f3e8cb5c26a46f47836d6a3de0c4f1fd357c0926007c41a391afcc2ae1548d9
SSDEEP 24576:kdewsAjE8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:8ljEgDUYmvFur31yAipQCtXxc0H
TLSH
T14815E031FE74E032C77B0DB21B7AD316182D7A604B521AC3E3B85E9E45306D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 90e6714fac6ea38c140253320497880555c00ec97fce1c7f0ab73483b7a560db
MD5 80663df3931872536970c6b4990696e8
SHA1 0118e7be0498fb7ff0c88e70c60f7acc896097d7
SHA512 5b5846b62785e37d7e0cc28f6a5168e89fa6dc15cf0eece35ea90e42832bb94564010b8e14289c37a012a6b232a3b4807e9736f16f356b97557da676c280ccd8
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9UoiPBx:3UEtQevvqc2W1cpV2EI329
TLSH
T197474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4621573b6b81b38f898067d42a8ad1fe1ad8b3101d8aa057999d939f22e067c5
MD5 dfb59d198be42de4df27bc73303fce68
SHA1 f755dcf3a69ff04ae8e224df4c0bbf15ffc377c1
SHA512 45f796e83ab308a740b8e188ba0bff78e81ef19ab7bc24514755bc376abd43726aac7cc52af81cccf5b328191c0ba9e60103b47e070b79215ff0dee6b473d537
SSDEEP 49152:mCbRquA/m2yL5zifFiV+XenmE3/zkgDUYmvFur31yAipQCtXxc0H:LoqHVjnmsU7dG1yfpVBlH
TLSH
T150D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3efd2527ebd2c3d853ce9e77eb56b32ad1a7ef97a9ee15828eaa3b149327b0c1
MD5 a44803282b38aa3b56ade4fffc1fcd54
SHA1 6a5d0e3e6470e24b66a3bf0e7eb1694b8ab58cdd
SHA512 13d2e9fba317f8276000ef79afcc8763c69575be343428628215aede228e376eaac6aefb595cad21398bb7013b308aecf6967b53b115c13f434e0dbf7b34ef38
SSDEEP 24576:zAhGLJIFoiwtA5l7S53d8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:zAMyFoiq5tgDUYmvFur31yAipQCtXxcm
TLSH
T1AC35AE81E7F951D4F5B3AA7899B69171EA76BCA55E31C20F2160D21F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 4d7b2c853bdb0c5a1b5557bc99a6217e9fb2d352dfe7e370477391a0486a44f2
MD5 6c0c63ce3b70ee87337c2a14467103e0
SHA1 e2180cc60999b9c04a3bb96ebbb1b824c4a4e1f3
SHA512 f96c7ac6414b8eb7cdaac6a18ac2fe7eefbb5eaef292e435933927635cfdd72d5978fb6360b0fbce2f5d1ef5a27cf70f907e3ad49b872df5468e1986312da97d
SSDEEP 12288:qBZ1Iy0FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:kZuj8NDFKYmKOF0zr31JwAlcR3QC0OXn
TLSH
T17AE4126A36C870F2E5234238C9F99245E77238A5677687DF1234176A0F32EC69D38727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 27a67390365e725cf9d48b23a33f38cd9f47504e87f3c1cd512bb11592ca65d9
MD5 d1cde3cc785e6a88c0203d9638275104
SHA1 ef6a9828d3a6fd6b4d1d6f31e3014acab1625a56
SHA512 d798877045add71a7ef975b572cd22bbe6ea88ed6fb9b51b4a87cd7071edf4fc573e37f585caf06203812ea1cb735a6901982bd043c10195f0d00c48e6077a83
SSDEEP 98304:TQRQyi36YOcPQLvw2gAf+PN33U7dG1yfpVBlH:CQyiKayX+PNHUoiPBx
TLSH
T129667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f0d2fc773e2bb9532dc49e544941ee8dcceefaafc39d73f2480c72fdeb22d340
MD5 9f0aa9a57b2aa0575b78e6eb6170a4a8
SHA1 715ac7505471b855034203bc16c40bff59d27a4b
SHA512 8b1d5557a90f2cd7f7087b34db6ece670065beb89e1e32b79e9a67d6d53a3d5bc60ce70ba151c5cfbb04e6035b0c7df0a2a7a6aae07dd8fe506326b9e086f43a
SSDEEP 98304:yQRQyi36YOcPQLvw2gAf+PN33U7dG1yfpVBlH:pQyiKayX+PNHUoiPBx
TLSH
T177667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 52c64f7112af64a0c1638e4de8184665c2eebb886fe9a583e4e20df0b48c3b98
MD5 502cbdd7d3098c7a37e8929084ef2b9a
SHA1 b501e4ef144d5ceaa2ee368fbfdee32d2049159d
SHA512 ee04d9735fec6993fa8da07c0001e1f5ff329f4e967d35e0710d866f376575010c7d9a1c54049cc152774bdb91327de2156c9b9f01256e38fad0f280e4119605
SSDEEP 49152:b68Qg55nhheWu7PNU3/UgDUYmvFur31yAipQCtXxc0H:lthWRc/VU7dG1yfpVBlH
TLSH
T1D6B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8115720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 47bb9a8be2d8dc1097b27f81bdae9759abca9a8ec41c90544e091c48fd6652ad
MD5 c39be825bf6ad8c4dcd6d74d22db711f
SHA1 51ab2c133233466739c4010cde2ccd3abbf5419f
SHA512 2ef26305b13f5076d9d0a1689388ede8fde876605bb37729186b98c25da5cfa2234cd8deba39f60f839df8cb7b80768cfde8db7d6123b8ab7964e3ec3d3e897a
SSDEEP 98304:My5112gYy5azzVvL69nLKnhZiU7dG1yfpVBlH:NLIHmWhkUoiPBx
TLSH
T1C2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 681cca2f271572203682f734cc2b37323bef10d5a9e92e25311bd3ddeee1d7e8
MD5 26a5e688fa758a2ad86924049da30eb0
SHA1 5030b25f8267fec7862fc69bd7bc02d2b7ffa79f
SHA512 0929cbc7237775fc32adbe845e505a197cb7f1a195f587b50c74ba0f7c87c95d6765e7bc54713c2830b963ec4e417442adf6b98a3448ca4d10877a26f4814624
SSDEEP 49152:QB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gligDUYmvFur31yAipQCtXxc0H:Ku6JmVxd2dXU7dG1yfpVBlH
TLSH
T1FDD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 29b1980c710d0dd37693f890a2879c4151929b36924055b4a1d229fd502322da
MD5 d128cc35d3b249b87d67168845febfa7
SHA1 be4b582cd9f7e5bbfa8de0cc2ae32dac4797e9be
SHA512 92723f1f9654a6fcd009711718da3989cafecfb7c0d62ea73ac003169bda3eb7e48373416c94946eb017dbde8d4e05d027d2ccf95b8f7afbe55c1bbcccf26592
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xOgDUYmvFur31yAipQCtXxc0H:kmifPbRsU7dG1yfpVBlH
TLSH
T182B5BE13F2D900E8D06ED178875A9232EA62BC450B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a569fe30dd59ea2875f234a3f5b2c55cb2665ce136576f06a0b9ae30ba24fabe
MD5 0044741c4da819735c28f480cf9bdb81
SHA1 0e18414aba70bc9d5220b566fffa644d9d16a0a0
SHA512 8bbb644f43017c12fa7e554d398f7a75c5ff510cc92917028eafc2366e423732cac4e1545cc00a2788bf5ceaff1849e6eccda7e1c07f961265d3f3a8ad278bc4
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqjgDUYmvFur31yAipQCtXxc0H:e5dKTi61GU7dG1yfpVBlH
TLSH
T139C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 52389906f17f39595f0df018e35eba2c8ca8031d8cbeae12d5a1033d50b454af
MD5 b99fdab005d70184d143ee15212ee861
SHA1 c835a41e8dacd379ef921ef4c7410c341cd7b268
SHA512 f5753ded0d42fadcb17dfb91a35e5e3caceefbf10ea944ab9d5856baec5eca2b3f163b2037033fe32934be0e3214eca47b6eb6f24312004815260e82de84e1ff
SSDEEP 49152:rhtSn8EApI0figngiDn0AP5wagDUYmvFur31yAipQCtXxc0H:qX2iyphIU7dG1yfpVBlH
TLSH
T15E95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 995fb9e9c04f45f51af713003c315d5e061da40a9827e2a06a307db8a1a22da5
MD5 4b2462e60fe1b4cb2908f1d6424dc616
SHA1 7570907768e486533663f6315d7787f92425f67d
SHA512 ff625538121091b82fa7dbb39e175904ba181ace7e26df8b90873a2e7df44bdd00e5c79acb1adfc70537feaff1ca00c4447b2b6ba6c49e650eb11d83ffdaa927
SSDEEP 12288:+fFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+f8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T120C4237B684DB1C3E9120570C5FCA2D5A94E3FF9BA469E36723C372A0270DDA981485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ab217b8b56fe695cfd22a4eeca2a7f0bc24b4fbd59143a4fcc36dcd49ac9d2f9
MD5 bbf1182a46ea8a33f4b83682939029a1
SHA1 ab874ca4a9744f9eb3a8ddb1ef157482c380022b
SHA512 ebcf8401460fa6b2a57b591421be7a99e5329f34069b52c77f532d450466c2e363d3924c1c320b39cb0337d605a9b157c174dd2c2c1f67c88da38a8adfa17360
SSDEEP 12288:5AFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:5A8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T110C4237B684DB1C3D9120570C6FCA2D5A90A3FF9B646DE76723C372A0270DDA981486F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7541d5a44e5731908ec0b55b8c01861871d3443abe2661b93664448bbd4dd262
MD5 02d468572854d7f6aa89bd8bbcf5eea6
SHA1 c4dd57f08fb00d67f95a53ad3a0467dc88e64402
SHA512 d7a41c616f2f1ec269554db193115584d5913cbe7f84b44dea5402b3eb265036eae41c81405e35fd7c6869853d488b313c1eee118958a03dd052ead3db21b2b6
SSDEEP 12288:v2FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:v28NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1ACC4237B684DB1C3D9120570C2FCA2D1A94A3FF9BA46DE76B23C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e317e2d2050efe9b638cec37f6b7b348a6a958fec5ec6ef8b71117f92fe81e0b
MD5 181f049e4565960b774b74569fea6a58
SHA1 8b95648221ef6e9cbe7f538a3fa4d664a2b458f2
SHA512 80279af1ec49cda95cf3795209132af0c5eb55f25d9ba0af32a99b572eeb4ff9fe76ceb448477cfbf17b95c1abcfca52cdd06c85c61a554a420f3df465fc007e
SSDEEP 12288:iV9FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Y8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
TLSH
T1CAD423673A4D60C2D8228274C5FDA191E66A3EF8B712DF7F63342B1A0670AC5D83495F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f053dc17fb85b71d69a4b82997b391639cf70035c3f8aa0d66ba0ea44b0ad99c
MD5 26d8bd5358eef1be2772833dc11b7932
SHA1 49eefb855faa33b83401d9570df4628dedde196e
SHA512 6e35e2cafe224101054201c3a77ad6738934193db496da5b93d58f3127b1b274dda83a4dc292015699b9416872dadf400102bdac40577e79cc30923d450b741a
SSDEEP 12288:/1FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:/18NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T12CC4237B684DB1C3E9110570C5FDA2D1A90A3FF9B646DE76723C372A0270DDA981489F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 8d20e3776486eae73b3f6617edb2b25104a1e01ceff780afd0b59eb6a7b5cf3c
MD5 6b6faa61069672ded3d8ceb635f72f4e
SHA1 b4c1feabc9fd5899001c139de83fabde0ae42f83
SHA512 3b788f9b9cadf3cb5195d79626368c0e34d1316fe3e3acb70a5dc40d11110cb844c10fb6b3d2a239009b29d7c90e833f4d7ba9468aa09f71fcadf3ff8682f75c
SSDEEP 12288:ZsFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Zs8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1E7C4237B684DB1C3E9120570C5FCA2D5A90A3FF9B646DE76723C372A0270DDA981486F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c886acd8b7a75ed91b44d81f3e849a08466e245180e5001548d585dc88b77d9a
MD5 4a91212ee5d3e828d4912e865018693b
SHA1 33cf5e6759f1b2e6ef9ba19ed59a04eee584e55c
SHA512 4a3636b0fcd0cbe3d505324275f755b1da54b4e29d846b98637a5cbf76362f735f2e5a8411880356a3def3567c24ef6d779ece27dd523bf4ca942cc189ee59e3
SSDEEP 12288:rYFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:rY8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1E5C4237B684DB1C3D9120570C6FCA2E5A94A3FF9B646DE36723C372A0270DDA941486F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 fb5f0ae5ca9b5d0cbc2e258000e92672e9c7aa8f7a67c798018ba55e76d4bce9
MD5 e45020188310d17d8d73084a54cc9776
SHA1 5f50936d810ad49c0a96b360d4c71c78d4656839
SHA512 e8a17eaeadead3839265a391a0a18d57dd5e2479e54dec5190bdb9155cb8c47091f59a1fdb42547857ab80a384b6bd56dcf0ef2603c8b3bb0c3e1d61f4e447ce
SSDEEP 24576:yZMSzFVSOg8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:yZMSzfcgDUYmvFur31yAipQCtXxc0H
TLSH
T1CC0502A5B39418F5EC23413DC9699506D6B27C691B60CA1F13B8372B0F337A15C3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f89ddd7b4684de2451dd04020be8a4e23512ef26ea48f00039cd541ad8b7d6d7
MD5 91bd192fdcd18feabe9bd10751c1640d
SHA1 654f5cef47eb2dbbd62adbe809a8d8a816443afd
SHA512 a084edea2fe15a4f0b2c4b3c6b5838c75a959f437ae8221480396080976cba30307b7bf22af2486087d1e72bdbd584dc233b3dc3fe8386737deed9b56c9cbe90
SSDEEP 12288:lTFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:lT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T19CC4237B684DB1C3E9110570C2ECA2D1A94E3FF9B646DE76B23C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 02be68fe6a30455a1e1a7fa8f9f8372a2ccbfbcf1c87354ee154be4383bdbb6c
MD5 211c2cba3912816aa979f14189f53cb1
SHA1 b5822faf648e0256149cc34cba7ff63231933e77
SHA512 e43cfa55424bb7ede3af542e695b9a2d31cdcdeb61742c6bec7b84f55ae81d49ae4b3907f9c02df2205a67da215a53ef37d757143d174bba3caf4868b9c24ff6
SSDEEP 12288:mnFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:mn8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T10FC4237B684DB1C3D9120570C6ECA2D5A90E3FF9B646DE76B23C371A0270DDA981486F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 2716554352708458a98a441ae9e5e108889ea1e4772e72c203bcc881f4e3fc04
MD5 f311c274234ab7095892fc1c8a9f6269
SHA1 3b9db588e543bd4c6865c081b02fe40c35549e63
SHA512 241ef2751d95da7e93de1c8729396e2522b738e69c3afc2c04a4d934d025f448a865ce567ee753a0cd07c7ef8b2397b3c99530dfe738131ca29d1c931acf3a03
SSDEEP 12288:byPz5L80FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Wzy08NDFKYmKOF0zr31JwAlcR3QC0OXn
TLSH
T14DF4121B769930F5D1368238C8AA1642F776787617208FAF2374173A1F33AD19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a47cc182557d285792147ca0192b41183bc735ae610eb854edc8b69e734e2e31
MD5 dd8e375a05dc537cd7d4b1967577fe06
SHA1 c911562c0c5ddcf06db6ccc07c741bc7b43355ab
SHA512 5240f9cfef2241ef7931e2149350b2a43bbb22d471f14cd319e3e5d02de7b2046089a9b6a37d48fb840139d66891a9709698173781fbae8c4acef059f962bbc9
SSDEEP 12288:YTFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:YT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T10AC4237B684DB1C3E9120570C6ECA2D1A94E3FF9B646DE76B23C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 66b7a1ed30ff6b15bfdf4896febe8afabeec7e0966c568503e9551d7bb951f79
MD5 38cb106f1ee7dfd19cb1d9c890a00f72
SHA1 13aa27495c53bc538697db555c11f2c19f01e8e5
SHA512 af470ddbe761a0c56222e37002f2edb4525e9228f2fa96e64307518b7d315fd183e7c0a152d6f7cf7e450d6e1c3a9e15e88e38be9ef6d91fd309b6ad70f45f57
SSDEEP 12288:fTFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:fT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1CCC4237B684DB1C3E9120570C6ECA2D5A90E3FF9B646DE76B23C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 223cd7049c5d6d53b304aa12cf825c6ac93cf72ae05f3a9ae3bd51be18550def
MD5 73abeae25b143ea67cc617cee5e90c07
SHA1 c2e715fa0fb0bb84876ad5a4008dbb7bf74e3667
SHA512 086d4e948b5fcfc6667a6771a6499bb387bbc3c32f2d8f4ac3e994b150c7f4982271cb91cc00cdad630da977977268b71bf44d0c0bf6d35ea0cbd0db8c461a53
SSDEEP 12288:SyPz5L80FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Pzy08NDFKYmKOF0zr31JwAlcR3QC0OXn
TLSH
T10CF4121B769930F5D1368238C8AA1642F776787617208FAF2374173A1F33AD19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f8c37fc6ef50250900290aef1559b5ed10fe3ec6c6d3f094a0cd0c94b722a7b1
MD5 f8ba79c1549dbc32126ecd49469f956c
SHA1 d8cec281d7f897cd32cbc23ba9abf62e7863ca5d
SHA512 58ae2b234099752ba7c12c843272dd9efc5cbb594868e531db34d89730c05d63e1d02619de2748791b6eb40076d2f00a84b63be0022c483222280ea616cf37a2
SSDEEP 24576:oTHaLl3z0zDG8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:oT6Llj5gDUYmvFur31yAipQCtXxc0H
TLSH
T1330502A5B35018F5EC27813EC9699516D6B27C6A0760CA1F13B8372B0F337A15C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 fbeed83aa2e0c9bf9af0bed45321a569f86c36457840d2a161867064daadba4d
MD5 eb9acf23ec31c8b6289beba78b2d42b3
SHA1 4d486f84d9a1c4c096b9283a527c97a9cabb0cf8
SHA512 6191409c8675a9a70079e9837a07dab334277b21af40b48d9d5134c58612878546fe50040e209674ba9e82a8b15d0a2edeed4cbf00a518f131e8c29e359951b9
SSDEEP 24576:j37d9CHKy7GZi8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:D7d9CHKyacgDUYmvFur31yAipQCtXxcm
TLSH
T1B425CF91F3E810E5F1778A35C9769511DA767CA91B21DE8F03A8261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 fb107361a06089a8e5843eb257e1d5c4893cea38badc65f2815169f629d84904
MD5 0982e59521a66c3b290ebd0cd05b57e5
SHA1 9ec7b16f7c1023eaafd59d3d8f610a30e915064b
SHA512 6fa5f6ca8ce1d7fc27819099c343adb41c6f0210057ed1af995504282dfe59d662a1ec3fdbe50b2ab9f7b4dd1354689b3fb722acb0b4bea41e322c33eae51ce0
SSDEEP 12288:kWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:kW8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T158C4237B684DB1C3E9110570C5FCA2D1A94A3FF9B646DE76B23C372A0270DDA981489F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4cbc6eae2bdef1b581d0002aee294d43d8476281041bebf8ecf8cb0f4d432e78
MD5 2f8cbf9e84771a7f38303bc6ae8c3290
SHA1 8b3abc485d9b10ec39f43f013fc68ed91eebfe4d
SHA512 e760c56f62d0ef9fe1bb3a3ccb28b8e8edbfd03bf6a28779da1249c973e7ebbc2a330c136ab71e12f465fcd82f6b3a1eec164262e888e23399215e607f8b9743
SSDEEP 12288:bUFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:bU8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T11AC4237A684DB1D3E9160570C1FCA2D1AA0A3FF9B646DE76723C372A0270DDAC81446F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 723bae0152cbe300044fe1f0bcad44fe2c6e080c66ef1e0c2d8e9ae4ad31e8d1
MD5 d46a4c8d7aa97aa0ed7f54368cd2eeb9
SHA1 ae176f9ddd38194802e197fb4b2f016bb67c0aa5
SHA512 376b6cd13919ed117d23c367e776b7f9cd54e410461e425f1b9e9a7704abb86e1de6572a19a69e6d74ed283427bd06c832717ce5b6040a2c47a4387f8699f7a0
SSDEEP 12288:BxFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Bx8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T182C4237B684DB1C3D9120570C2FCA2E5A94A3FF9B646DE76B23C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b479ec5c3ef3c30461ae6bc818b2986e614992225edcc7b60cbd6d4261d3d96f
MD5 fa39a2756ea7c3a8fc0dbfd72ab9b38c
SHA1 7c4b207d4c4dc5458c70ef28931a73164098c98a
SHA512 ed5a969ce7347f90a80b31625a3bbfc739489196909a012e54df810b40df009542dd54e0a8f8b1f3cefe88f4bfe24ebf7f62ec9c16a50848599453be36550deb
SSDEEP 12288:WTFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:WT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1F2C4237B684DB1C3E9120570C2ECA2D5A94E3FF9B646DE76B23C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 48e692df533b7e47828afb2e7dcc90420c6f74f266bc2306073bb238e25c0c22
MD5 5cafbcbec08d1d8703e7674a11200efa
SHA1 ee4cb6a794de42583a319a60e9228f277ef50379
SHA512 5d871738199bedbd9c8316f51fb10bb5d7079abb62c7770586fdccadfe0662b187a3e29fba9c4b1f9e007a248b053d54b27296e7db79f1fa4eee3b8a7e55b606
SSDEEP 12288:XWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:XW8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1E2C4237B684DB1C3D9120570C5FCA2D1A94A3FF9B646DE76B23C372A0270DDA981489F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 6c7ed63c7ad72c86921a9df286fef1f450fb4675870e1f766010ce43f0f7717a
MD5 07d9b2a3303933f9036a925d0d4b2fca
SHA1 406bd894cc79e1eb819a5ab8319b01ec7582dbc3
SHA512 b1bd8d69c5f291788a8ec8f5bf253f0817d4a63e1a957d35bc244cab5aa745b99424813cefc44e7425ce3d03151e7801ac520c73c6ca7077922e5d180e06f551
SSDEEP 12288:4rFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:4r8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1EEC4237B684DB1C3D9120570C6ECA2E1A94E3FF9B646DE76B23C371A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 7644fd7775d289fce1b580b2ab102c019b4ab22e4110ff34a3a7958e89302544
MD5 5e1d39ef3b2644b1c05cb11f91702e38
SHA1 f6824741c539bad03d158e3c56a8a8044cf65d5c
SHA512 e34713c2289cc2bc0dac3484c169e1873c973f3dc86cff1ea5b3c367bb81ce3f2e9d1a47cfcc5d0dedb41d3d7bbe0d6746310f9592d738e95a5c4d71e2a6c4d3
SSDEEP 12288:r1FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:r18NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1A3C4237B684DB1C3D9110570C5FCA2E1A94A3FF9B646DE76B23C372A0270DDA941489F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 666c245e1334fa28afa70c9dad031a948801b14b05e8c3fc3b0af054aaaa8ac4
MD5 92af2df25ce6402c19631ad3857731f9
SHA1 6d60c79167f56bd1b4b7905b99383d08414e5106
SHA512 b578dbecb7166e5ec60a52662ff827ad27ac1a4d744ea49e65afb884b5972cd029d4797d1263c8788068e9d8876758ae7844786d1912781d896beaa1b4990607
SSDEEP 24576:ifwvok9RX6wkyAIX8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:OMnYIXgDUYmvFur31yAipQCtXxc0H
TLSH
T19935DF29EBCC44E1E177923C89B7460AF6B178691B31C6CF126A536E0E33ED49D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7a034e4dab7167e72497cccc4666d91b97ee0486a8e0268cf1cddf412b3488da
MD5 7a04b21a50d8c08be1fac4bf7f9a0c2e
SHA1 d8dea8cd0450c046f93c1b43c9f74ca4383f8fe0
SHA512 aa47c0959f28da6fca0a48139fd2cb3f929b4a86858c1b7f99ff6dee8bac23c6e8e495361e61a7bc3b16d06b1f1c427860d220852c32407e25fef9a0726e6eba
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06gDUYmvFur31s:UySzPXU7dG1yfpVBlH
TLSH
T193067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4fd97a078cd082573983597baeafbff8e9be768d40ae86edae423399c185e9c9
MD5 2ac92d475681764b20c2c9cfaf61d31e
SHA1 02d7a7240f73ec795c74bf34984e05a3e70ce485
SHA512 a5a00553408abfbafe67968b88832f0b81c4938ced898ada63a4fd8cc233b656d657bd50d5889457b1ba00b1b0149b127836ff5c3f9de9febdbf91a95d5a20a5
SSDEEP 24576:L47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYQ8NDFKYmKOF0zr31JwAlcR3QC0OXxx:L47JUQj1irIhCnDHUPfF/qgDUYmvFurK
TLSH
T1F765AE1EA3EC01E5E17A827885558A5AEA71782D1F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c01ed2499faa9fb0eda4e175e3b52343e675fee88ff11ef439d427ddfd04d9b5
MD5 577a23a77c5b2b2c1dab5cfa0035d08e
SHA1 467860ce7d5a9f1033e0f751b09b6106d4ccc481
SHA512 d80f57874fcfcf6f35fb67992fe8eed84b904c41d6854f4facd247a38e714c069ca4e60dc42499a2f7942ec02e9934bc1ff85348bcf7a953307bee22ffe7a2d1
SSDEEP 12288:TNsfjFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Qj8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1C7E4011AD28812E5C02E5235C7A99281F7273C6597E1D7CB63E0F63E0F75AD09DE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d9ef1db88b7a3d0a2b1693537e6caf7eb31ce434a8f153186d35ee041bf94437
MD5 14a8167861683cd75f22ced8dd9ae918
SHA1 d64ab52a8ef605373b227ca4bbc5c12824673154
SHA512 8f1057d87193d52e52ff6167e15729f2fc841ce01dced177ea2345f4431f8e8fb5c57a30cd7019dc7be6fd352f448dcde116636232a3e7b0e8503f0c11dd8065
SSDEEP 12288:EkZdRU3fEj8uplK6z1u/JJvvhbOTfr1IAOyBEN5ys:EkZ3UPQzqJvvhbSfredyBENks
TLSH
T145451740762AD69FC6A950321E36D6CCA7707D41FE086F0773C8873FD476669B6B2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 0bf48acc06b99bbbf07d2d1f5c8eb4c72717b63f52a7b159e9c2f1aef0f7ff3c
MD5 75ce0c9da252687f1772e48bf054bb45
SHA1 e790ab5c3c0a449e0cc6bd97edb005f0594c253e
SHA512 a1b1e7e2db2f845fcb4e287d009fa29b5944510b8e48c50e28fdec1f6da0bebd3030d40111aec2ca3de84f1c8d14c52893ef77e2beea7baef49bb8d6c73122ca
SSDEEP 12288:3FU/mft6mIldlFDq85CgUMiH1DWlRlwOgcX:3FUufAVz7GvgWWfOO5
TLSH
T15C552B41A5A7E35FC9FE90374632C6CDBB746C02BB452B0173848A2C987757EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 cbfc1b2f7b075ae7729f92eb1941e8c6ac2e24e5c4f7496cb74636a6b44cc0aa
MD5 ccba603b1ab45e49ee6c6f202f3ddfa8
SHA1 ec6ef4187b417e131d76ed4d0330c5539a07c504
SHA512 ef3d7926c1e09d6ef38671f4f015e43931aabff681275d4ba8e15e6d8256d8882b426c6a6e7c28a132ae27dd75853994307341dcb865095be43769a0108e1062
SSDEEP 12288:Tz77FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:D78NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T115D42377AA8DB182E936057085EDE260760E3EF86B45DAE7B138371A0170DCACD7491F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 444b7a29b3d5afda2526675a3780e117134a6b20c3216e95ad5c29f896da5a2a
MD5 c98d3bf19f6a36cd035275d7df0bc88c
SHA1 fd79d848ac274624bcba4a03c9f0af34a45c16b3
SHA512 e906da541f83bfd7ed458d3a9cc2cf51624534651e2ed80e1f2a3c3a44a988488f62ae708e8e949e02b23ce3c8b4c9f5306d4d77fbcd0ff89b89183e555b27e1
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bY58NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Xgb4mBIBhGFQgDUYmvFur31yAipQCtXn
TLSH
T1DD659E1E22EC02F5E0F6D2B8CDAA4417D6B278161731D6DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5b285d1851ff32ca738336a65b52b29d9e145924b0537c0c843ce41abe0f98e7
MD5 f018cc1c49380c2c857559c87b5c0815
SHA1 9967e7c14335ef646248a8d0f7085c128d60b72f
SHA512 5e4fb6fe51f75455241a002552044adffacd07ccaf1822cf5bc797aece5fe58f9690b08d3cd11815e484c99fa3d5f2142f2cfe59421fb1e5640d7e4d1bbfd95a
SSDEEP 24576:FG88u8FpJqH1bzria7/mg8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:o7ZFPqVea7/RgDUYmvFur31yAipQCtXn
TLSH
T14A35F16576E501F1D437D1388A864263F6B2B8251364EFEF07AC8B550F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 60c7b37d0e495332ad125124fb24774b88f4aa66431b05b378b7c595b43f2575
MD5 20c85fc3f7554430e3b5771cd915113d
SHA1 8b5f867d1b70b8d0055f0bdd46a640955dbf146f
SHA512 8437d881262152588e0ec89779dffea5f1b676a24eed016ead0217d95ebe044581e1991df82f97638ea1ff1516816dd158e9e2aa44847a4f53f6989caa701c96
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsgDUYmvFur31yAipZ:7G05lO43b6U7dG1yfpVBlH
TLSH
T14AD5CF6E62EC11F5D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5a7697ed4da6291daf4b6452203664674c80d860cd7cb8877ee3c1f501600c84
MD5 4bf737b24c6c8ded7454b9ad443d4338
SHA1 e2f47c020e2df61ede03f16d3f10903c966d4ebe
SHA512 16aab9c7339f9d976ef1454377854acef6edfd9dda6e6fd0cf4db3a57dbdc6895f6be07f78f242aca551fbfaa24e089a83e14bcb9f8591167bf2b1bc51a54740
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn68NDFKYmKOF0zr31JwAlcR3QC0O3:ha5POZ3+Jt2pasx2+mUgDUYmvFur31yH
TLSH
T10A65BF5EA6EC01D5D579D17CC583861AF5B1342253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 efed0a7041aba84c95ed10dd7bc153f1a17929d9e76bf41e295792561c9bbc77
MD5 d9d27a1b2308eef587a60d972766e447
SHA1 888d076d3b94df16550fb8ab21f1f00c2d32689c
SHA512 2b6d5ce37b11ad4f1c5f11276fbd3f6c305867c7fa2b240c6bb9d8ac4d9ebcd7eac3bd0efe328a7b449b2e2acc0bc6940edd3f4dc703265a5e0b0ea46ab6f49a
SSDEEP 49152:qNc/zEOVHFxgDUYmvFur31yAipQCtXxc0H:bIA+U7dG1yfpVBlH
TLSH
T153857C2622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c21702f27bf01bd800fcf851156dec6f7c258d7b9b37c721ad873c34a2238f49
MD5 ed4afa48c3d9ebdae9fbc1bd2990ba2d
SHA1 e26975f3213fb77aba3c946bab9197a6ee3c37a9
SHA512 2e7f7a55ca497d63f379226812b3eeaa338444c5fbf7fa463e4582648aaed380af05d034c645a8c28e12e66d5b433996a9d57be316e9b17342c14f5b60e9bc4e
SSDEEP 24576:W8kNvNnaFeYhJNtmZBme8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:W8MwBtOmegDUYmvFur31yAipQCtXxc0H
TLSH
T15055AF6EBAB846E4D1BEC6B4CD238112EA727461173293CB5390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 57509a7b55646b731f223ae5631c264cbbf33b4ed0bf0c9a21dfd1fa149bee20
MD5 aecfaa21b015f89d49cc9ccca57273f1
SHA1 740764e42c5b0169b08b4747dae25172eff69a73
SHA512 74fdb4b9d5ee4123009f173260ac2951522e92a18a1e4e3ba89779ffa5b7959dbd095e33e89573bf09181621cf393f629add4ef983b9f4eb20efc4b931ca3744
SSDEEP 24576:WPUr+NQc8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:WJQcgDUYmvFur31yAipQCtXxc0H
TLSH
T1A505E12F269C18E5E636A17CC5968319F77278621712D6DF02A0817E0B73EE8BC3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 7d3cc831a0b2f7f3d7399174832b5ff9fe529d4f4d706417adec39eead0eb560
MD5 ee48ca06371b7b2fa6b3190cecfb1f73
SHA1 6f64d404679832af769c0b9cdd35d3089c693d26
SHA512 df30f5fcef16a6a7f16ed116fdae9850a9788e32e00a06b451a4f60c87a88590b704dbd2475aad78c900c58c4cb35a5c14712b1d9eb3bacbad6b75d54566e87d
SSDEEP 24576:UD3FHshBIYQgA/8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:UDVHeBIAA/gDUYmvFur31yAipQCtXxcm
TLSH
T10525E17EE65C00E4E57BC1BCC6638606E77138AD03225ADB12D491BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 805KB
SHA256 dcd022157112a7ab7e6c0f2448e27ab786b5e95f5704ed0a451dafa9213f9b99
MD5 cde65bd6b2ff902c4a62034748d9726b
SHA1 812ed3d84e1e691f5f165312196a8edf3afc9473
SHA512 eef9131bef49be922eb2e871b6f6a87f4d53d174deb5dc7f200f11fb65ecd675879a24050a6fcc3aabf8b31569d6e452e3e7994154382459a4871efe4802e21e
SSDEEP 24576:vwuoOWI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:vwDO1gDUYmvFur31yAipQCtXxc0H
TLSH
T1E005F14A769818F9E9674238C59BD136F7B2BC512A21DB2F1370C71B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-73-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1052-79-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1052-74-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1052-303-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1732-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1732-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1732-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1732-130-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2092-389-0x000001D329830000-0x000001D329A78000-memory.dmp

Download

memory/2092-321-0x000001D329830000-0x000001D329A78000-memory.dmp

Download

memory/2432-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2432-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2432-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2432-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2916-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2916-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2916-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2916-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2916-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3152-302-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3152-70-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3152-63-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3152-61-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4320-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4320-46-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/4320-47-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/4320-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4320-50-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/4320-40-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/4524-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-97-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4524-103-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4524-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-308-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4524-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4636-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4636-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4636-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4636-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4636-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4992-0-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4992-2-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4992-9-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4992-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/4992-56-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5076-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-323-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5076-84-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5076-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5344-116-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5344-110-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5344-306-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5344-108-0x0000000140000000-0x000000014013E000-memory.dmp

Download