4fa47fedfed8084b57bebfbc6d44581e3deba3549f985c5e3db8463746f68658

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Size 12.3MB
Sample260807-ltk2nssbmd
SHA256 4fa47fedfed8084b57bebfbc6d44581e3deba3549f985c5e3db8463746f68658
MD5 d5018642844b91088a7bd48dcaaec923
SHA1 86e26fdc6beb4bbe3d965919a3e4a72c1b43d4b8
SHA512 99e771d257f4ce88a6640a037c9d13066dfe7b9e91c2f20b18e986bb1c5531442b7bce81f3fdd3187c325b69b097f2ef514eae523a56f101ec6a4af532d01e5a
SSDEEP 196608:vhr1I2Wcqkjj7UlG8drCeqBvKCzcLknW9:vhr1tqkP7UlZdrWlDzcLk
TLSH
T1EED65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5676	elevation_service.exe
3460	elevation_service.exe
2272	maintenanceservice.exe
3300	OSE.EXE
2852	PerceptionSimulationService.exe
5576	perfhost.exe
1672	ReFsDedupSvc.exe
5044	SensorDataService.exe
2140	ssh-agent.exe
4136	AgentService.exe
5452	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e52ac78d238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000005f131d5226dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f670e51c5226dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001304685f5226dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5f99e5f5226dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006915ed1d5226dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006419835f5226dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5732	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5676	elevation_service.exe
Token: SeBackupPrivilege	1672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1672	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1672	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1672	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1672	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1672	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4136	AgentService.exe
Token: 33	5452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5452	SearchIndexer.exe
Token: SeDebugPrivilege	5676	elevation_service.exe
Token: SeDebugPrivilege	3460	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5732	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5732	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 4884	5732	2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe	88
PID 5452 wrote to memory of 944	5452	SearchIndexer.exe	101
PID 5452 wrote to memory of 1272	5452	SearchIndexer.exe	102
PID 5452 wrote to memory of 3076	5452	SearchIndexer.exe	103
PID 5452 wrote to memory of 3644	5452	SearchIndexer.exe	104
PID 5452 wrote to memory of 4808	5452	SearchIndexer.exe	108
PID 5452 wrote to memory of 3012	5452	SearchIndexer.exe	109
PID 5452 wrote to memory of 4208	5452	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-07_d5018642844b91088a7bd48dcaaec923_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe" --type=collab-renderer --proc=5732
  2⤵
  PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2272

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2852

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5576

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 2748 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 2748 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cc3989471b20eaa5dc2f78961372f579ffada7b27434f72361cfe51e983a93d5
MD5 4368d47a39c4f05ecbac470f74af6cb9
SHA1 29d73dc6f995148fa9cfabf304df78ba512f93f5
SHA512 55378df1f0accb625f56df21c431fdc941979fb872a4b4fbf4a02265e34626504a158066c7bcdaa4f9bca6ee4c713a0b9701a27212682c6a802d95c82ee89d2b
SSDEEP 49152:4b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnN/snji6attJM:S3q6sjBeEnW6at
TLSH
T16FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 e6113542e26dc8963bc470acc827af5c17daaf78f0ceb42ecaabf579de3a4348
MD5 f708cedc62a7c2b16d2f3c214f513e30
SHA1 b548eda42dc017c3bbb53069e27c5f71cc890158
SHA512 8dff549db903371a16f299e117bef474e7b2ddc45b4d418135fc0e0ab335758afbd5eaac967b1a06213b5d14de50ca0c98ef9c31249faa314bbba68d4bca4f1b
SSDEEP 24576:6XYfDtczAlt/sBlDqgZQd6XKtiMJYiPU:htcu/snji6attJM
TLSH
T11B85012977D108F9ED6B823DCCA28501EA7378544764F6CB03E4A9691F332D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 6dfc52acc4be993004199945e1a117ecdf3c60b6fd5214fb708f2d0f178f18db
MD5 abcb714ad8c783c6a0eaca9745a9aaa3
SHA1 1e40765ad936632532dc8a7a42cbc0a26e8c39c1
SHA512 aa3c1c61b75f530ecd999792573751525f2d031566e2ab1b62fd4a31af3ad3355395533ceee0c9221c908256d4806b746f56ae4f7509e747adc8ca5bb9c33c91
SSDEEP 24576:U0Le5ji0hmxLrMKt/sBlDqgZQd6XKtiMJYiPU:UPji0AJh/snji6attJM
TLSH
T1AD959E16F5B48335D073C0B9C5D2A68AED7230865B3089CB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 504968106ce8d33a7eae5e037c604d896b92f6ee8b9bb5740255dc4a3983105a
MD5 54c102dcb9f63bbc6769d6e592d86a9f
SHA1 1a07b09620ea5f9bea240fd0cb534a67b3e755a9
SHA512 1d824deeb1950f2787c0ccd5221b02f73ee35899bb32b7299b930ac705e70d56e4aca1f161bf89fddf384e16a1e0ab54a41146e227356c5caafb99250d44c1d5
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWn6q8wyukt/sBlDqgZQd6XKtiMJYiPU:s/ezSC6vUzPveHjyd/snji6attJM
TLSH
T1B5755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5185faa65e8ef7a6e5e1667a3518a4187ebf745413ad24d6dab747dab2ac6374
MD5 12b55d42ec437d7dfcbb8cca9f11d2d7
SHA1 64af33af5a49e1704cecfd48a98b93421c301a9b
SHA512 9e77df92491a1c4f79923e331d254f25ad595f8b8bee190e7ecbf120bee1272322ce3d50b76283679951c27f39e838d4923380c3f6f60586609d0c213c693842
SSDEEP 24576:5VbqPb88hv/l+Ypt/sBlDqgZQd6XKtiMJYiPU:5VO88hXl+W/snji6attJM
TLSH
T12A559E66F5B48331D073C0BAC5D2AA9AEE3230415B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9ed50fb99bf48ca1e5391c342fa7fb10616e86c28a357983100f77033fd670d3
MD5 f9c49861059eb3581ba8ab4ddf48346f
SHA1 a04738cfeb0260b7d639600dac8e69b900e06f83
SHA512 daabb04f581ab64100ad9d06d9c8e3b734084db1ac4df7b3f705ffd9f8e45e1547b28cb7e4e71226af6885d9f593f8bdd48090884ae95eabdd6f9d6a716abd34
SSDEEP 12288:59/Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:59+t/sBlDqgZQd6XKtiMJYiPU
TLSH
T12565231F58C390D7DBBF5A362EA97800E4B33B0CAE48709795D2B59C5E3D01299BD227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 0ba79d04648cfc1ff66071fd7a294349923b39c15b24dc5dc6413cbee704a4ad
MD5 712f024fa4ed390bc062f77f50f43657
SHA1 a792c6ccd7478735080cae5f14b9a11370d5e885
SHA512 7cc4598247be97285565c2714881b53e4ba7a3cbe7f7d929d60608ad8bdcc144758a7d4e25ab8e731607d0ed4ee4a2b4ef30cc0377d68165fe495ff289d36699
SSDEEP 12288:0eBNUbTVO86UOGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:0JIUht/sBlDqgZQd6XKtiMJYiPU
TLSH
T12E85CF3BAE28FCD2C27E8DB95A918600E77274304F52A3CBD165C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0fbb4108fda7edb9be22b849c8b226d2c6d87158b7fc761275464492e8e54b92
MD5 17530b6e9d40d463e501ae789a8ae795
SHA1 6dc9904380b2ae77dfb4b445541f0578c5c536a9
SHA512 c940091bedbb12b90fb5246f68d0ffea4d5e2cb400d6335736c85caca5212c3fda9a498cf303041526b6fe69d9c9c5f0232b853839e17901d1b1a656ac31943d
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:hQvGAdlCEL8c/DRNw5COEnW6at
TLSH
T132266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 1a49df00cf5e12de076f21451601158d65662fdfcd31175cf1c50229e06c8798
MD5 ef200a055ab51390f31dcdf9a8e6f682
SHA1 2855f415be653adb6c64b11431582629012a0a71
SHA512 60694364427e70287d9350e4c2a4d86a2c527180a9313256627ef2be4c5407166cb2ebf6150385be59d0e6fcdd88fbc7cf846e0e0e7b6042e64147f282e0198b
SSDEEP 12288:sAwSfxL/2Dc3DDLLmt0LDQewsAj0Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5+:RSewsAjbt/sBlDqgZQd6XKtiMJYiPU
TLSH
T18385E031FAB5E036C3BF0DB21B26D706543D7A204F5129C3E3E89A9D59341D2277AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 74a4dfac5ac771e282eb5ae60a1999baff4dab1b96177d9fc5ae9174d39ecd06
MD5 29e113f9221e48abfa11325c26c73aab
SHA1 0b95870531698307e74cbc2ffee68f33f75b0c42
SHA512 b187bc2d09715901733f039bf39790c9f88e30ccbfaa6c534fcf62e7b36369271a545ad715d8b6d5b29c71ad0f6faa26447ab03c75de902ea2271dd0c47df429
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHOnW9:TUEtQevvqc2W1cpV2tI32O
TLSH
T1C3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3b089bb4d763f8dde4b4fe32145d1e12bf2d6b9d909b556dfbfb1eb4d57268aa
MD5 3db41b037a062f966c9786278aa59ace
SHA1 9d123486305b997c29bc2ff1c8869e10cbf301c6
SHA512 62f5b2ff10b7f50aa5adef34891f2821d45d693b955de1d39b4df11fb79126c2498de27901461a0f49a1dc9ecde5c8147b509fc74be3e9761232aa69a13ac40e
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zx/snji6attJM:GoquVjnm6EnW6at
TLSH
T133D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dd577c0733d79980d6b41cf83e7650c685bd2b9fa5397ddbe694faf5f5bae947
MD5 17b521a30ae24fece4598ab15d754bef
SHA1 0a33aa3c85cb35c795987d8145a487c828f873bd
SHA512 ffe659a76ec347819dacbab1e6c612606f1501f7d0a80a85d2e9b33f6c1c256fe92687c395d87983b5cd5bf331a911f3dc5e6605c5c79fc523aee57520388c9f
SSDEEP 24576:pAhGL3IFoiwtA5l7S53Qt/sBlDqgZQd6XKtiMJYiPU:pAMUFoiq5q/snji6attJM
TLSH
T1B935AD81EBF955D4F5B3AAB89DB69170EA76BCA95E30D20F2150D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b55f335f6bc30c67902202915aa66e36046012d379f99067999aee759ad72094
MD5 15aa6c8760461eab1ad726d8c7898f51
SHA1 e6fdd3a60b2af9634371a60fbaef2f76469e5950
SHA512 2fa7521f198a10e5bdca1676c49267aa48c19a453758ddb6aed855c4ec91f847f3758f4d055691f8f4c3f5f537abd6237bdebe59283259ec534607b7adcc2306
SSDEEP 12288:cmw5HEjsChNfBFgl0WDm+ChGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNA1:ZwumOWXt/sBlDqgZQd6XKtiMJYiPU
TLSH
T15285014A36E50CF9EA6782398597D532F7F3B8052A25D71F03A0C65B6F37221AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f90bf49fa1d5cb0006ad43e7ee2961dc033a3e103ea0229392b1a062d5aa1580
MD5 fc30d6441dfa22bb0ac026093188f756
SHA1 129ac91022bfe4c5ffd594588ae350a27853f7bd
SHA512 8c59d20d966bf2f19ae1714149bb4fb9da095baf99a3be11106aacab7c48c8c67a2e80d08e4fb42b60452cdf2fff3dd8d8874d038fa18ea10468e38c96f5bb5b
SSDEEP 12288:JEZ1IykGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:GZuit/sBlDqgZQd6XKtiMJYiPU
TLSH
T14975121E32D160FAD2AB523D9DE56900E3B334196B3663CF12A592A92F375C25D3D332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a62303276a44136d06f0c454f31e2690f7d953161ad073a7a1022f6d2e226d2c
MD5 bd605a166f13050f02b39e0d30806bdd
SHA1 a223f39374964cb4bbf55a68ef59bcc48cf3755e
SHA512 399efff3d24f0cb9e92b90e7234f24b1b62b7d4831d94734d68330de49c631af60ee04ab2eb1ddb6cf153ec780c2501689c52a67f490ce197c992a640c26c256
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:BQRQyi36YOcPbLvw2gAf+PN3PEnW6at
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 21c5914ea9d9956b02664eaa2f534f4fe8c24bf33c67fbb7255bd0040dc23d1e
MD5 7cafd9a3e261e093f0a52b5a494623b4
SHA1 02c0689dd156cd0b7b30e455aa0075ea51b4aa2e
SHA512 54856044ea3e6e91f6376fb8d1d0b40f75700d19fccac3e64faf8831ea06fd3f3b2053d12fbf1fdeec890f740f66511ef259b60fb1cba78daeaa76d9d88a8cba
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:cQRQyi36YOcPbLvw2gAf+PN3PEnW6at
TLSH
T185667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c952791126ef9db6f56f91388b751f54f3804a9039fc6125bb3a14c8f560fd64
MD5 e13e742662aac1de3f6fb182eec94226
SHA1 78f489e47b74c77d91a32605533a4914132f9df7
SHA512 f3271407d2aa09ed9c65bfe1419618ba5041fdc53d41421f68838ec06fa997534804b6c92da3774cefb735bb0cd95c44e4ff1dfeb32e33e7fc26138bc1fc0eee
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0St/sBlDqgZQd6XR:X68Qg55nhceWu7PNU3/h/snji6attJM
TLSH
T155B55A33B2F20099C44DE1769F4A972196D27C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fecb8ac54a923afb4d71af7f9a7d4ef779dd180e6281e772676e7d8026102281
MD5 38753f4a1efe4f8634d61f84fcc97a4b
SHA1 54647b17350a9494efaa0abd7a61ae8cd4dbe831
SHA512 0ac08299a12e4421d74eee6e34d166e0a125fe5bddae4024c29cd19e02ccb785708bd05634c3785e886f4f1612d6bdf008d9f2aad7d0c68cfa8de98bd222da48
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99g:ey5112gYy5azzVvt69nLKnhZUEnW6at
TLSH
T154167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 22f90e810d2fbc1ef1866b5f5ac72821d05d9960e7167599617ac315d73a7cf9
MD5 cc07e94d75b24d4cb67d3766a4d34be0
SHA1 8361532d908869453d4555ceed37564b1b160d00
SHA512 b5f329b070d29bc09b2228de8257cf3a0971eb9dfe5d64ccab466cbd797eede6542a3249018feb503febe4a33ec8b108ccbe65de39ed55c53fb24bc363f1839f
SSDEEP 49152:YB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glC/snji6attJM:yu6Jmdxd2dCEnW6at
TLSH
T1C2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1007c4b63c11fc7e612196c44d7156ec1266c4d374d27a24bf5a6f24a8302db4
MD5 f1a180eab0c3fcb57bb2e5d73a45cbd1
SHA1 97193bb7f1b4d1d92579aa96c97a5027e31042fa
SHA512 84778acdd46c290b74a00e55eeb76b297305402446ee5d06d07711b7a905b09f5a606b78e372bfe0a6181d7ac3bca45b1511ae47b4443a0f7542e81a229de612
SSDEEP 49152:G1hpsNoJpF1A63U44CwH7R4xz/snji6attJM:GmifPWR6EnW6at
TLSH
T198B5BE13F2D900E8D06ED17887569632EA72BC450B34B6DF0A90B7962F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e9bf2416134ecdd871d67175e80eff147c1f7864978144c0902edb5e264cebbd
MD5 e73be58ce12f7a7093828db69aa4ed67
SHA1 bc0c3010e6eb806be9308ccf281408b836d910c3
SHA512 cdc639f8ae5007c14ed1701875027b1ef661975c06d69e65d02334a5893a61b22f1dea25c07cac3752748a0a835c9c4448ae00e1eb65a4a207b5a7e380e80764
SSDEEP 49152:3SuZQIY0Be2KcRVtOnks6NMHqY/snji6attJM:t5dKii61YEnW6at
TLSH
T103C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c83c297a5ad48f6a9fdfb5e6cfc7b2a97e56676dad58f02319c9a15fb3ede500
MD5 f26c92e47b6e8eae3ebae831848eb05b
SHA1 021ef3d463cdf6c6f2f5b395f087c53174c4bd0b
SHA512 8bf0fd3f15acff6c008a359bd151748695b95fa1953d3417c21375419a6893fa08360cbbc683e18d5a9b8f2311ea95cf1d8a4d234f97c1c449225c63a0a4b46f
SSDEEP 49152:rhtSn8EApI0fig3giDn0AP5wH/snji6attJM:qX2imphGEnW6at
TLSH
T11C95BE13F2D900E8D06ED178C7568632E962BC150B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2944f48ce9fb5a943ccb650c035179c7fb9188ef91e496a3b633c20accfd11b9
MD5 8634801a042654006408f6ea96d40b55
SHA1 606a88f2a077e0ebb1856f45dc45809e7415c8ac
SHA512 374d1ff3d65fa744096db41fe61a7583312e8cab22026747424a9fbed1d0b4e3154384fa8b09320ca4478979451b6dcb0ddc15e3f9f97c8f2d873ac934f4241f
SSDEEP 12288:T3Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:T2t/sBlDqgZQd6XKtiMJYiPU
TLSH
T17865231F68C3949BD76E5A762EA93400F473324CFE4930DBA6CAB0586F3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 abd6b7cdb876f80d1a435107ea6854cef44fda7b45ca54365227aff1ca35ab60
MD5 9770ae26b03bd696bc22db8b864fae12
SHA1 18066e9fad64840fcbe745c70b7f5363aa5ba386
SHA512 4b90e714d73c7723211c4b3e694b4ec5ff176c8bcd80c11880a5a58e7366f206b04fb0508cef1697591d51423a0aed5751c85421087e73e2fbeaee8a6d2af9d0
SSDEEP 12288:54Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:5/t/sBlDqgZQd6XKtiMJYiPU
TLSH
T19465231F68C3949BD76E5A762EA97400F473330CFE4930DBA6CAB0586F3D01319AD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 41e0cfa3da2e1f32477eed1fcc3d8c5d05a8c280c212e8e82c037f6b744fcf99
MD5 a443b0fb4767b1b922fafc0aca1b076d
SHA1 8234cc9acaf727b16ea9a6c718b40194bdadd08b
SHA512 048aed2d7890bbbf8cbf99c63794a86b7e8772e78b2a624568b491f6ef9181d1dadac1234936b612c0077db08ba2d8f7313502cab45af29f574629339d1d366e
SSDEEP 12288:+mGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:+Zt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1B565231F68C3949BD76E5A762EA93400F473334CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 380a17135f97951be711f62acdef23cd59b002096d82ac5408b727ea5b8647a3
MD5 688d04f35bc4dd31255621292d9e5ff4
SHA1 db82a7775e513ed73e7aa79f6defa1c85fddf834
SHA512 4444cda96c79f229cc20818159c5f5589bd4def9c90150761134201aa4421a715e14400d4fe1784dd0626c64e02e96fcd4df0c8586c3f0c42ec1204e5ce57c4b
SSDEEP 12288:dVNGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:It/sBlDqgZQd6XKtiMJYiPU
TLSH
T13E65231F29C380D6DABBD67A5EA56400F2B33A4CEB2670DF96C1745C1E392125C7CB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 78b217ab5286c162503f75a6ddb0e7fa25b6d48716af82c02576748d360fc0ee
MD5 d99a9400e9c4d3ab3695ca518a9b14ff
SHA1 8248954890b83659c184b4c1656f4e1efb3ff446
SHA512 9b37df8575eee2ce88cf5e575276362f19060dd6285254fcd31b63e5f35518d21ff61496924532142af5355c84960177fca030bcda668a766d6a80941381f8c0
SSDEEP 12288:TVGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:T4t/sBlDqgZQd6XKtiMJYiPU
TLSH
T1B065231F68C3949BD76E5A762EA93400F473334CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f91c50e2a62d9a7e64152ac0f8dcb1ce37e27825c963507f81792c0829f776bc
MD5 add774e6c8fadd91f8fc7ad46391302d
SHA1 dfd86105dc7546b46945801121c61345e77f12a3
SHA512 2bd32d62f0b7ef6eec8fac49a403d00a98677106d7b75cc50a73e317fed3a2553434c34378d248c317052aed55126e6c7292f37905ee520acc92bdac61242b23
SSDEEP 12288:msGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:mzt/sBlDqgZQd6XKtiMJYiPU
TLSH
T18F65231F68C3849BD76E5A762EA57400E473374CFE4930DBA6CAB0586E3D01319BC67A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 8741acb098d574a80c24ed99da6dbebe9ffcd851f8553eb01d3a159d554ca7f7
MD5 e72c8978f5d267a5b5e000acaee8a301
SHA1 2a336288f87acfd958621fb798cf2c344d0713e0
SHA512 c0c0e3f32c6eaadd6334a0a70b5bef06c464a262e2e925fb7cd96a957c5869e175052d6b15d8eac8b2566c03c52c71cec2aa5319453010782a8f05c71c8f7713
SSDEEP 12288:IgGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:IHt/sBlDqgZQd6XKtiMJYiPU
TLSH
T13265231F68C3849BD76E5A762EA97800E473334CFE49709BA6CAB0586F3D013196C676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 0c5e1489d4c05a8084f1593840293807ca2bb38d5e2d602bafa92d3d043fbf0a
MD5 9c6e3aa1e1283273f0674937c0798406
SHA1 699f5c6da85f7c945e98edbe502e37e0dc775aae
SHA512 44d00380d1f68de9b1b55559d6a054bab054513d029cbb2edf8a2633ac936a195774835ae3f461a5ffb9b20cbe5629cf9e3bdfd815951723bd7cbafb6f069d21
SSDEEP 24576:NZMbzFVSOft/sBlDqgZQd6XKtiMJYiPU:NZMbzfJ/snji6attJM
TLSH
T133850299B39118F8ED67823ECD659905D2B37C190B60C65F03E4366A1F373A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 33e9be2a44c6f70303acbb6e4262cfdefbf2a01ddeb6df06960c91b87ceca42b
MD5 55b4c421bb004758bcc8dd4d9812ecbe
SHA1 a21a02ef80dc05b87e7e57773db66de33a50fed8
SHA512 bb7c4bf373b927bada54ff51c7a015d40ee3d4740faee9bd6e5ea4f5be2a8ce5f6dd4a2fc7dfbb7e7eb91c1b8b9e5aae0ac6c3b908564e48c32fea7c529c73a8
SSDEEP 12288:aDGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ayt/sBlDqgZQd6XKtiMJYiPU
TLSH
T19265231F68C3949BDB6E5A762EA93500E473334CFE4930DBA6CAB0586F3D013197C666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 54c13014d35dc4521dea54e73f374c3f914208e0c07e4aaa9d2d5d49e966b5ff
MD5 7e8172f83f004d600e1273fd707926a1
SHA1 7ac69f3273d578ab62bbad236b8e74da1786bd55
SHA512 176df206d69a5edee9c56e4fe30d300cbb8a64b1e1f0486368297cb5e8c717dd6652345f2f672573bc5ec8a94c99821fc6561f4c719baea07412240df8ff90cc
SSDEEP 12288:zvGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:zOt/sBlDqgZQd6XKtiMJYiPU
TLSH
T18A65231F68C3849BDB6E5A762EA57400E473334CFE4930DBA6CAB0586F3D013196D676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2ba5979a65e1ba789593873683ca669553b23e31c8ffbc46b4efdd84e9ad0cce
MD5 b325eb07ff49e5c5baffb6d5ff6ef98c
SHA1 79962b1d2026495f1c383b16b27b38dce452813d
SHA512 8d9d96403dd0d605cd84ec45f497ee5641004dd846f8ea6fcb2eb3c7917e13f136547d4e84a5ed542c09e51f1ac50f1450675e01eceab5f1112acbe1d9921d20
SSDEEP 12288:RyPz5L8kGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Azyrt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1F775120B72D230F9D27B92398DA21901F37274395B249AEF53A4567A2F372915D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 dccdb4257d55b39aade7dc10990c2a906d4a76c6bfe03a38dab8d714c7e7ab56
MD5 a2644d8f9e1e2db1a8f1a2d8c3b14345
SHA1 252661461372d892cbcd4925e5b2377da555114b
SHA512 854691dd313e0bf781bf051725441b70fa21350c160ed20001078dd44e30d19a71f4e0e4cedeafc1afd8e97dc9a9de7f44f333c4db30b35616251f0dd0ef9b91
SSDEEP 12288:ADGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Ayt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1A365231F68C3949BDB6E5A762EA93400E473334CFE4930DBA6CAB0586F3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 8dcb1659b1b85098025e87abb4361b47ed0e3dfa4e3d451804812c3976d63cc2
MD5 bbbe17406e415011d8d57038678c354b
SHA1 84bd589120e6e78e87be32ba2de9b823aabb3e1f
SHA512 eaa2950a38c1762e8d2959d2076a88a0962f985efdf6e772f11b0039d3cab374658d601ff2bcdc7d52cbc1f0339b7f6796864b343f84f11533bc0299662c5cbc
SSDEEP 12288:3DGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:3yt/sBlDqgZQd6XKtiMJYiPU
TLSH
T19965231F68C394DBD76E5A762EA93800E473334CFE4930DBA6CAB0586E3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 52f0e78967f93cab3ca895f9cd91a14524052f4c101695976d3c43aac490d6b0
MD5 55dd1454e48f721d4308e3d16eee5856
SHA1 a317b9ffdf4c0ac407a63bb0c79538a2d63969e3
SHA512 498c61a2c31eb8ed36b380176539dc9264492fa64cd6c4117aed960b08a724f4740672d286eee0b45d1aed3947539efec89c48c7744aca644cec04f0d35b0c2a
SSDEEP 12288:WyPz5L8kGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:rzyrt/sBlDqgZQd6XKtiMJYiPU
TLSH
T19575120B72D230F9D27B92398DA21901F37274395B249AEF53A4567A2F372915D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 5836b65acb1079142f93ef37d7217a6e86095882265b539a3e2d0daa10886759
MD5 df6dd49a2d6abe855e32e0b734d3b699
SHA1 d238db841313b891b50877061be72bc9461423db
SHA512 ace3a8d48394a32b9e5923ca2cad508e8207f74baaa6dda742b360922916c10c8f170617edaf8f9b423a4ff22d45053b85e94fd5190c143ac29af81ca39f70d9
SSDEEP 24576:0TBaLl3z0zDJt/sBlDqgZQd6XKtiMJYiPU:0TcLlje/snji6attJM
TLSH
T12A850269B39018F8ED67823ECD659906D2B37C190B60C65F03E4366A5F373611C3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 1a899ff084d1a26bfed0e856a0357debb5885d0578cac555598babf7b93f6bf5
MD5 cbe9c73986ac9db89b5422bd00fcdfa6
SHA1 ce09a2b4c1410f5669fd0380636026968f091ae1
SHA512 5786da6b8d4639ef630b596a25bc7da43330208003da7dc9e1ea0258bef426aa4c3ff7f541dc06020a6eee6af7275d9c35772f4ecbba4a0b5284fd1d2684b835
SSDEEP 24576:j3pd9CHKy7GZdt/sBlDqgZQd6XKtiMJYiPU:Dpd9CHKyaJ/snji6attJM
TLSH
T12695CF90F3E410E8F1B79A358D765501DAB67C9A5B31DA8F03A8661A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 95d7fe0d18485b48140d09d5d0af2893176b0608d322c527ca3b96de318ad420
MD5 808c0bf9ac2765a1eb5ae5e7f21470b8
SHA1 ecba15c8fc07d37da15144838c975a37571ed89f
SHA512 6f06cec168e6f94fbe1edd45f040e1cdb4207fbaa2bc73c3a74c97246641414d12ea1fff9ad6978a7b98b08a10d6465d822f744d2c813736240fcd7b56dd5874
SSDEEP 12288:LGGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:L5t/sBlDqgZQd6XKtiMJYiPU
TLSH
T1C265231F68C3949BDB6E5A762EA93400F473324CFE4930DBA6CAB0586F3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d66cd7ed317723f6d96495baa5beffeb60f7ca0976e04560f979e9259118cc0f
MD5 5064f197063ffb70aaed5167b3e8241f
SHA1 36237a430369511fd7a72392528be4948a0e50d8
SHA512 ac9abc687f9e0569021158e1b0b2c6876d2f07840711ffed8ae81e737f4e604313bfdfc9690244f2525fedb266ccfa99f2da7032b82d85a2f484268e7b0157a0
SSDEEP 12288:HEGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:HLt/sBlDqgZQd6XKtiMJYiPU
TLSH
T17865231F68C384DBD76E5A762EA97900F473330CFE4930DBA6CAB0586E3D013196D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 0463527e81b1ec548b943300b1d2edfd62ba55999bca7862ff3f69d4e08d60fa
MD5 04392ff190ba2e083c8d9ab0d2d244a5
SHA1 faa879cf662bfafe6b3d2775df33db34958e00f3
SHA512 7d84e49996f98cb408ba46c0b5819d4ed9796074a1d0c074dc2a052a5be9e1425fe62ccec1dd90c5136f8d67d89987fe70dab7779bb3483b802ae44f91685282
SSDEEP 12288:CJGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Cst/sBlDqgZQd6XKtiMJYiPU
TLSH
T14265231F68C3949BD76E5A762EA93500E473334CFE4930DBA6CAB0586F3D013197C666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 9449480cf35408311eb7e07477c6082cba9f1c8216e4a64a8ff5fceff11ea3fd
MD5 0ab7720bfdc7b15755d57c12cee9c43c
SHA1 a59a6e9d41b9d863974cc04c93261808ceac0366
SHA512 dc8abb00ab7474df47260ffea5460cadbb81f01bc79b26ff4d00c1532574456f04618f155d577347eda86afc77b8c230a7c94c5973450f3568961fa10eb41e31
SSDEEP 12288:UDGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Uyt/sBlDqgZQd6XKtiMJYiPU
TLSH
T18965231F68C3949BD76E5A762EA93800E473334CFE4930DBA6CAB0586F3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 fb9268962210e7b06284a4d2b641f96849ec93e56ccb1ea022733f8e0204d3b3
MD5 69ca7790aa3a118a2a55326281307891
SHA1 04daba2142c472bcac1a560d59373b996029cd5e
SHA512 f93771f6891de488f1c27f6ccdb9a7c450412f6817a022c64032b2a0fabd454a9ac4afa5fd4fb08ec4859ae6595d4be1a7cba7d298c3e59567754bf63f4274d7
SSDEEP 12288:aGGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:a5t/sBlDqgZQd6XKtiMJYiPU
TLSH
T15865231F68C3949BD76E5A762EA93400F4B3324CFE4930DBA6CAB0586F3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 961e6664891bf750086bafc5c0d4320ba701875dc45943cd652adeb28879d8e2
MD5 42c84375cc942a877faff803ee80ea42
SHA1 28bb64d2e1aab967162715091d00dd228abbd112
SHA512 5d4e0725bb37ac7989cd9a4e6a8e15c7dcf9ce03201d594bc92ec708e0c596b1d91316659516d48523bdab4101d3b9b71aa60362aa1807b173ae177df2cc633b
SSDEEP 12288:arGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:a6t/sBlDqgZQd6XKtiMJYiPU
TLSH
T1AA65231F68C384DBD76E5A762EA53800E4B3374CFE4A30DBA6C6B0586F3D013196D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 ef56bb85db012ea4a35257e7913fb98598aeee432d2149c912acdd3b3bc25d75
MD5 6f45569d0aceb3cf838a13b5c5fa3fb4
SHA1 c25de40487082656fc0247d5e001253609fa5d55
SHA512 ef02cd51e1f38a07b434b75eac78e85d96f10407fce010e350327e7792076baed0d49c01a097f0673d627e168087e9e44628ee76e7b437f9f09083d9f93e9898
SSDEEP 12288:JVGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:J4t/sBlDqgZQd6XKtiMJYiPU
TLSH
T1DA65231F68C3949BD76E5A762EA53400F4B3324CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 abd395e9b408c700b029a69a49ff96e1692a122c319ce783b07d78d0607163ab
MD5 ee20553b35734f1e2e7dabd27dd07209
SHA1 295e4236c7405f51fffa81060b32cc5df38ed53e
SHA512 566ebce863ba0e300b5ce837b78d02b0fbc3b1493bbc4219f920bbb5ce30dda21f37db9d630129eab7a709bb2c2c0fa5c536a49bb2cf55831215982be7440d3a
SSDEEP 24576:ufwv2k9RX6wkyAIet/sBlDqgZQd6XKtiMJYiPU:UMnYI0/snji6attJM
TLSH
T12C95DF2DEBD844E5E1B7923C99B7460AF6B178681B31D2CF029A53AD0E37ED05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a90f735671ad2c57675c3c4706099e2a9203d5cccd46074d6414687740248b17
MD5 a88b9b57b5f3e19d231c274a7b7b8d5b
SHA1 1319518e554836849d0112a565c20aca2af14f1b
SHA512 56a6d2de576a4e9672e308a28c4b98da27c81e20f82a9f294cce301f2847ac6331feeca68c514f4ea6f1d96c3e11c41036df2186bde894825175f2a864760435
SSDEEP 49152:4YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0n/snji6attJM:vySzPvEnW6at
TLSH
T1F9066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 33ac97e0a369c6f68f5a172da4d8a9e7dd96b1d1cdafa2b154bd759b5d22535e
MD5 ad99cb3ba80dc98c94eaf5937cb9b128
SHA1 712db5b3bab6bd491ae3895de881f31ecce1e7eb
SHA512 cf3b503c3de6c17880ff14235735d8587aa8e00cbe90fc62b3fdb4b5b2820bce0c271d1653eb6bd5c8ca4e38fac5ba291a1f47f3b84c49b77e40876ace795a72
SSDEEP 24576:R47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYvt/sBlDqgZQd6XKtiMJYiPU:R47JUQjTirIhCnDHUPfF/X/snji6att+
TLSH
T1E365AE1EA3EC01E5E1BA927885154A1AEA71742D1F31DACF12B0837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 cafa90a76c6401ed20fc404bcdf5b562a7401d84164fc9a5324dc185c3e0aa30
MD5 32d71a9fefd0e4aeef3888eab98f1f67
SHA1 01cb0a85a9749e6e016541f9f6dcb8a94c6247d8
SHA512 36a8e5e0f4494aaf3ceaab606e4c9bb5b9aaff58b2686ae9c683efb7ef01b7c2b1abfef7a9ed2abc950ce423ec7bf0bd1018db80b5b7a3bc2f58c14888aacc23
SSDEEP 12288:uVsfTGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:jit/sBlDqgZQd6XKtiMJYiPU
TLSH
T1F275F11AD29541E9C16E627ACB565A00F3733C2897E1E3CB52C0F53E1F3A2915DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2d69e8555fe9bc3aedb9ec837b3cbb1620d9df9b40fe81097bb7e6832b04a171
MD5 fe9705d54dfefac2ae3a79c2a685f2d2
SHA1 36b267ab01efdcda3683d467ae84f9d5aa0a0157
SHA512 d3f8ab21c48deba3f542008f77e30602ace411a0b9232eaab9df40f4c38eebf59f988c068d13801488871eea5c922430ac2f936a2affdd03d0563a66c893756c
SSDEEP 12288:Ejl/6y5vJIjsxds5md/pLuCgDerLS7rYJ1:E56cIjs9daDererYJ
TLSH
T1C5451750762AC75FC6A940325E32D1CCAB707D45EE456F0773C88B3FC576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4cee76ed1302483c0fc9593dd2259743df321d005aa74b52677d5a72efb77437
MD5 077928f248c004c5d9586ade21ac36f9
SHA1 8d38159b181bdef6b34e9696bbbeb86a8d5b9c2d
SHA512 b5fb8c38cc603f50f6655e164ce9f8386f1c7b3f2d866c64c37e979146d7795c01578cf6a53e2b55689daa17cddf3cd4d111ec9fd94034a24b2e9d4c205a9296
SSDEEP 6144:oHfR0h2IT2IM2ICfBGwFjrxWEN91OlNid9W9EyAKDexHjAKDexH0v0nIYz3iH1+g:oJ0fj0RCnvA0aG
TLSH
T1F465E881A137A39FD1FB5032033A6F4DA764EC06B7095E26B388453AD86A715B0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 6f316e6f6b6ed8dc87afc7ad455e875f8fd0a0095476aa3374cc24e775fd101d
MD5 ff88f8aa111f8fc6bf94bf3f4bfbb286
SHA1 df0c5ccf0308191cfa93866454516781659edb22
SHA512 2d9c62549b69ea0ca544e560aac4b1dbabe46603febd06c5e1351e79fc6aef82b6ee55413dc97cb0cf4cfe6c046612cfb10ead7833b1a16f872554e8938cca6d
SSDEEP 12288:lO77Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:4qt/sBlDqgZQd6XKtiMJYiPU
TLSH
T12F65232F65C79897EABE5A7529A97400B037331CAF04B0D7E5C5B1986E3D0824DBC72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 07317fd2aa9096ad5199813b1df0831d8234b84ff807ca55bd8302c12f507673
MD5 092fa8afe5634a96e9b1e81955ae339b
SHA1 06d4b62132afd4f3a72441c8d4e4662ff683b143
SHA512 2ac94164d6b23ad543fc5d12c0fc06656b569baa446364a6da878260f88167262a77c8935709eac58d5adec0288d2e887d948c7ab006a934a2ffd0eee29bdc5d
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYkt/sBlDqgZQd6XKtiMJYiPU:dgb4mBIBhGFl/snji6attJM
TLSH
T18065AE1E22E802F5E1FAD2B89DAA4417D6B378160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 03ba6b58d7ff5c62c006a515af5b49fe7637c2dc119c86ebd6fc8d7d1d93ce92
MD5 d90df0cfd61f1861865b6e5405319650
SHA1 11031e7e11b57a9f8f48e458213734f5efe2d2b9
SHA512 c92475e6213632fa61019f70f46ddd8d607dc67fa40d614bb4ce8575e71abdbb153e9379f10dbb0732f0da28fea2399805ed46284fba34cd57d9f661e43ad255
SSDEEP 24576:bG88u8FpJqH1Nzria7/mft/sBlDqgZQd6XKtiMJYiPU:67ZFPqV0a7/W/snji6attJM
TLSH
T1E495012A76E101F1D47BD1388A864663F6B2B4251364FBDF07E88B551F236E10B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 d036956d5e7656c18595200f064a9fb91b8f03d1f45dd4c3692e97ec7787a50f
MD5 12cc736f13cc4ce369324fe7c92e237e
SHA1 843ac1cafe8992fb432c381f201115ae8c329e1a
SHA512 b4240a97a12325ec5c567df56882f68717f12e2c50701dcf1d712db1d0a8b2cd495108b0f77dc2a9b01b7ff61603720bc11155512b6a8cdc4db8fb3cf2d8f682
SSDEEP 12288:KHvUrBFrEjwaQcGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:KPUr+NQDt/sBlDqgZQd6XKtiMJYiPU
TLSH
T17585F12F22D918E5E67AE17D89828609F77274651712E2CF02D1817E4F279E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a7da932a1c452d251af5ab87b307f95a067526f50ebcc2d5e0a4922b34482dd7
MD5 98a9f807d1b9b9cfff10e8623d7da056
SHA1 c002419af6a4f48b59196cd1540db5152f17120c
SHA512 7660168ef53f1b2240b7b97dfd4b488386baae652c51790067faa86a2e32f579ef4419ed013cc63e91c30096e312434a847dc0871fe8ccacdba29883f9d984ba
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZ/snji6attJM:cG05lO43bMEnW6at
TLSH
T1DBD5CF6E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6036741a9933508c9c9868f1dd206edd543519e32c9ef1e862fc513531405ca7
MD5 1ac91b39a268f0ae4eb6ab044e11c8f1
SHA1 ebd7cb95e2abdff019f9863bef699695c101a720
SHA512 7564b1e2045ac8659cca8d8fb49e1d294546e68efccfd8c9447abcddc8b912168416f30da299a5e8c8a30a5da9dbe86028dbbb60c6aa8683ffe4131c095252d3
SSDEEP 24576:dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFt/sBlDqgZQd6XKtiMJYiPU:ta5POZ3BJt2pasx2+mh/snji6attJM
TLSH
T12665BF5EA6FC01D5D5B9D17DC583460AF5B2342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 64db28d20d249ab95560de35137710069eb89a1bba3df0cc5811b2777ace6d92
MD5 e99b84a53a7e7ba339a05fdcfdf3cf45
SHA1 18531b09f2971aed1d80054d4f1541f29dd57d7c
SHA512 95611cd2644c20601d281d00cebb2720e3c45f2c0f9a9fa951d894ef10c331f47c42c9729c84faebd4d032a84d331ff231e7255e15a8ec84d79bd9ee894a2b8b
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fk3t/sBlDqgZQd6XKtiMJYiPU:xNc/zEOVHF2/snji6attJM
TLSH
T1A9858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 64c0adedc36c095a46f9e5f95c86456cc0e0780ed1635bbaca8b3978ab2c8d93
MD5 4c314efe66f88c2c90458dfdbbb97581
SHA1 633f6017bdeb7b2d4f57dab28cad728f2e5ce9be
SHA512 187ee382130eada59657a30def2142e232412560f23fec71b0150f0d44a00ff5e0548819728bd673b11443752d1d001270d76cc7d24e3391fd02c2efc89378e6
SSDEEP 24576:9TkNvNnaFeYhJNtmZBm8t/sBlDqgZQd6XKtiMJYiPU:9TMwBtOmm/snji6attJM
TLSH
T18755AF2EBAF846E4D1FEC6B58D238512F6727461173292CB5390C13E0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a3ea6d57cfc2865bdae595d736a8ab3305b1f73df8bcc1e1a8eb371378de3069
MD5 427bcae8ef2e6b0fc408356264328b7d
SHA1 09fd0d4a9ebe7f6ab9f81f0bf1e75608a650a560
SHA512 877961e8e56e346424f7e222de42a54c66e882c7e9ccf656b605ee9897034a965902813d00e9226df328d642b40346a7a6b8a4dd59014329f272252fb4d6d1b4
SSDEEP 24576:CD3FHshBIYQgAWt/sBlDqgZQd6XKtiMJYiPU:CDVHeBIAA8/snji6attJM
TLSH
T17795E13EE69D04E4E57BD1BC9A638906E67234AC072265CB02D4D1B91F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1672-337-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1672-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1672-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1672-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1672-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2140-119-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2140-127-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2140-319-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/2140-121-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2272-77-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2272-53-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2272-54-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2272-60-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2272-66-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2852-87-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2852-303-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2852-79-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2852-81-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3300-74-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3300-68-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3300-286-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/3300-64-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/3460-41-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3460-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3460-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3460-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4136-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4136-142-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4136-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4136-134-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4136-140-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4884-36-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4884-18-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4884-20-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4884-12-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4884-33-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4884-19-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5044-108-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5044-114-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5044-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5044-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5044-320-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5044-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5452-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5452-323-0x0000000003000000-0x000000000329E000-memory.dmp

Download

memory/5452-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5452-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5452-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5576-91-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5576-316-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5676-31-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5676-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5676-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5676-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5732-0-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5732-38-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5732-49-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5732-6-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5732-9-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download