f3a71950fe07fc35df49c509d21ea0420c882991dbc19360dd17a2028e2189d4

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260807-nwad3afe89
SHA256 f3a71950fe07fc35df49c509d21ea0420c882991dbc19360dd17a2028e2189d4
MD5 52a3e72dac35469594c221c14620605a
SHA1 494a0973b62fb3e5c7d946e71ab65945f954557a
SHA512 17f101aa6c5298839c444df1f81f16b89da84e5f866f3c4087135fee13a167ecef5416c423d905fa5be36beda25cdf4e36243af3d2857f8742ceed40bd4ea712
SSDEEP 49152:2+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755LL:f/PvOcjcXvvOOc5HousfEkW54NQX
TLSH
T1C3165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
404	elevation_service.exe
2400	elevation_service.exe
2216	maintenanceservice.exe
2656	OSE.EXE
908	PerceptionSimulationService.exe
5532	perfhost.exe
4336	ReFsDedupSvc.exe
4852	SensorDataService.exe
1380	ssh-agent.exe
3728	AgentService.exe
3364	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\94accf7423e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b2472246226dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058761e236226dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a00fe5236226dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1e0a1636226dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe47b1636226dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
404	elevation_service.exe
404	elevation_service.exe
404	elevation_service.exe
404	elevation_service.exe
404	elevation_service.exe
404	elevation_service.exe
404	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3888	2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	404	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3728	AgentService.exe
Token: 33	3364	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3364	SearchIndexer.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeDebugPrivilege	404	elevation_service.exe
Token: SeDebugPrivilege	2400	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4964	3364	SearchIndexer.exe	104
PID 3364 wrote to memory of 5808	3364	SearchIndexer.exe	105
PID 3364 wrote to memory of 4544	3364	SearchIndexer.exe	106
PID 3364 wrote to memory of 5752	3364	SearchIndexer.exe	107
PID 3364 wrote to memory of 5960	3364	SearchIndexer.exe	109
PID 3364 wrote to memory of 5444	3364	SearchIndexer.exe	110
PID 3364 wrote to memory of 4776	3364	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_52a3e72dac35469594c221c14620605a_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5532

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e996b0770f3b1b3b6132023373d23fc82dd22434a46a06ce365a2db5812b9ed2
MD5 b6c6cc1ca19c7fa72461058c40fb2879
SHA1 cf22f2f8a9acf9e446871fc3c58aa407b3774350
SHA512 a17875382ce4f3655ab833a7f24e35f99a71da6f3a29e3ba17d28c912870e7027d79d4e9692e82c1cdfeedb94ab2b336dde0afddec303a8d59162303e496d4ac
SSDEEP 49152:5b+632BuPkFKRrdE6ohrstBhuXjfS4LWxn8EkoiZqDfEFiJJ854TJQE0:P3q60jBZousfEkW54NQX
TLSH
T11BD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 2ae447d2800aa8a209ec428dfdbfc86e6937f3f3c854514233d36d60db23c459
MD5 7eff594668d72ff842415276ab660b82
SHA1 2ef7ba562f1af5f9553a03777cb572abcdff63b4
SHA512 eb3f77b3e9db9f5c5d4b3ddacba43d002db48a248f908b8bd049100c34564132c794120f9f7e086ea9ce0f976b709d82b6e7a0cfb7fd7a4dd7da3049a52f251e
SSDEEP 24576:HXYfDtczAbEk962hZqDfX0Fiz9DV854P7JQEtK:Stc+EkoiZqDfEFiJJ854TJQE0
TLSH
T15F05F12863D408F9ED67823CC8A28512EA727C5547A0F79B03E4952A5F337D85E3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fdf99da064086504b9cf1b54cb757ef8e5e098265001cee814c5010b5abbaa38
MD5 a1e677d895db2a66be81a8040102e615
SHA1 98ba4424f4d12e0ee50bb1960252ca03f63958f0
SHA512 86afeb2e73655597b26090ddcb704076651cba8dad61ad6774a991ed5577732a53bcb4c7cedb586a968a678615b4801f79d55846d6087a1ea92cce88baea16c6
SSDEEP 24576:K0Le5ji0hmxNrMGEk962hZqDfX0Fiz9DV854P7JQEtK:KPji0A7zEkoiZqDfEFiJJ854TJQE0
TLSH
T1DC35AE16F6748371D073C0B9C5D2A69AED7130861B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1542676ec9ffc0b662a7fab353d0b2a5bccf6b71128b4cdde7743e85c313de93
MD5 484dd68307d879a9b70888e29744751c
SHA1 8c03ef0916e5679390692d174ceee161615de497
SHA512 2bf9af23bdf99930b76de46733729a46baff5e3a56db1da29b1307aa66634734fad103832cbbed792b0248560300b95321fb6190c52f7cf151489553a70b8ad7
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWr6q8wyuMEk962hZqDfX0Fiz9DV854P7JQEtK:f/ezSC6vUzPviHjyfEkoiZqDfEFiJJ8j
TLSH
T13B755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a517a4af0b89fc90dc0bbbd17155bb41b287624cec3d17b5c87c7d77193120f4
MD5 fa5de0dc4552732a437664683330c05c
SHA1 62d1f623b72e392098a48137697d2f85a8bbf607
SHA512 a137b3b7356d8dd3b266dc4b653644056dbe11025bea776f8e80c77e26e79230cf314868888214b1762de57e4d941a6e5db1b8515ee6ccb1d22f09b283b39ac1
SSDEEP 24576:8VbqPb88hv/l+bFEk962hZqDfX0Fiz9DV854P7JQEtK:8VO88hXl+ZEkoiZqDfEFiJJ854TJQE0
TLSH
T1FB559E65F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a3ec6f96a681a4b08b71bc031359b095ee6a40221bfb0fd32bf0fc558e1a873b
MD5 ee3f4725c9f3c0ffdebcf190f464b51b
SHA1 984f48c998e0021870ca5e421fca0cf4d6a71cc1
SHA512 43d6677e812bc69e191b857458a89adefa3eae928d1b7958721cab3878636f2ec8a81acbfc0fa3bc979028c73da36f834ddfa45af7528b93938df5be6328f4d3
SSDEEP 12288:0jKDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:0jKEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T114C42341454428F5EE730634E4A7A4E768B87C899FD0B9274B81F24F813EB21DD2EE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 bc977e45044918a681b7c7fe3fc68279d51752ea2c15dcb616f2c812c21c7421
MD5 d103a23301063f77314fd491ef3f8120
SHA1 7d11eb2b49496d16833654bbce15e736ecaafae1
SHA512 92d4044ae73c40f90e55fa78f452873b36237337d0f056674891a60f03dafae0845725bd9d98de04ca44cc7d594438cfc760699b0a960f585a63924045d54de7
SSDEEP 24576:vJIUdEk962hZqDfX0Fiz9DV854P7JQEtK:vJIUdEkoiZqDfEFiJJ854TJQE0
TLSH
T1BD05CF3BAE28FCE2C67A4D785691C240E77278704F51A3CBD165C20EDE236E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 761821a68e021ce04e1c60f228096533fe0ac9952ed16603e648ac9b67000688
MD5 e75ac90a188086a5049d907ed9194c66
SHA1 06e555d845dda96b1e0d6b00ab19d8d716189750
SHA512 f38963c0ae27e4dbf7f082486624d1e0f18240c7b7e028b83a61f7afab29a86aa66a5ab7e01b51e7dfd5f74d477f2c4579c9678b2d9f99ef78b50507fd9e4b56
SSDEEP 98304:XQvGAdlCEL8c/RRNw5CuousfEkW54NQX:AvyEYc/R3w89u8+54NQ
TLSH
T17F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 95b3ef911ed8a2220d3b83aeea1a67728a4a4198cc602d2ac67c10ffa89d26fd
MD5 2437b67093cdab621846b4b1483b333c
SHA1 ed512bb8f95b035aadeba47a11e135d62a419bfb
SHA512 b89869004b1ecf4041b792f022764296fd47d6027fb31a6a090a3be79c7416e4e60b5e3ab3bd3e91376494909c7f975e2a1d5a71f41f825ce1d4acfc14ddd09d
SSDEEP 24576:8SewsAjjEk962hZqDfX0Fiz9DV854P7JQEtK:PljjEkoiZqDfEFiJJ854TJQE0
TLSH
T12C15E031FA74E436C67B0DB21B36C716187C79204F9129C3E3E89A9E59342D2277AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6c796aa80abeb7f51173f22c1d6deb53bfeb359a9d76138c06c810ca56773658
MD5 44555b99fd8e0ed274ae3ed7c5863460
SHA1 1c113c3c83a171eafa4a9b9a1dd7e53a048d0383
SHA512 14c28411869d617aad9b7d27ad214080f6a856e0c8b4dab14568ea23bac86a9fbb5928197b43c059b3233e28570c8b5310ae11a46ff441456e30d9386d452a9f
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHau8+54NQ:oUEtQevvqc2W1cpV2RI32B8y4W
TLSH
T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 35420b1cdfea8926805c4fc538620640458a8da8e3d6b93acd0a5bd242416a87
MD5 f99a6bdb7736e58601bae5849e915549
SHA1 068a410f626ccedb2013f03216b24e44cf6fc475
SHA512 4fb0024779636f0a5a5223e3f6efb2681b917efc3cd3dae9aa9e3fbe72e3074b1cba9e6289bb04452de51828a5b3f5963cdad3b905590122d76cef7cad901109
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zDEkoiZqDfEFiJJ854TJQE0:QoqtVjnm6ousfEkW54NQX
TLSH
T19ED58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 52dcc53b8642e394ac38da6c53ccd5e19775e87f392802d10fe3abb31ee6a581
MD5 fe1ad959a777b69ad05e20dbea6ac08b
SHA1 2d69bb41b3ae0f54d1a57fbb41d37777a21d2743
SHA512 990a837aa1955702d01a2bbad854291e82440d59d04e42de1fcd27603f0616c0cbabaddf414dc464df917f9657004ab43461965bd40ce052521a43c12db8b38b
SSDEEP 24576:nAhGL2IFoiwtA5l7S53IEk962hZqDfX0Fiz9DV854P7JQEtK:nAM1Foiq5YEkoiZqDfEFiJJ854TJQE0
TLSH
T1C035AD80E7F955D4F5B3AA7899B69171EA76BCAA5E30D20F2250D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d6c16f0a2a5f0bc7868a1d7833603daddaf9ff0bc1c2bc368c27a35311a8acd5
MD5 51fdfa2154a39abde2af9e845b878e68
SHA1 a34031f0f1d655d378bf45d73d86ddb4a3687575
SHA512 72e7131cd718880b2a2a3a60a5acd7353821cc2d2d088a606de9ce81effeb1a0cac7897970f6119181499104ac2c9cbe7a3173659f41afd2f3b85ca14ac7599b
SSDEEP 24576:gwuXOW/Ek962hZqDfX0Fiz9DV854P7JQEtK:gwsOEEkoiZqDfEFiJJ854TJQE0
TLSH
T1E605F04666A41CF9E9674238C597C136F7F2BC062A61DB1F07A0C65B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c14d71df8313f975cefdb7408c97bf5b9889f11eb6c17153086dd95860e6a509
MD5 34725e63c8b417eeac3d0e0d68692857
SHA1 35cc3a402f8e75ccaf70276870722c98c7fbebef
SHA512 ef39d502ca7672b59c78b029e01e7cc2f84915dea94ed754df484a1ddaac6f4260c708df4fddeb7cd8059c36021d004b402951e200671549dd7158f89d5ff847
SSDEEP 12288:N/Z1IyTDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:1Zu+Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T117E4124522D434F9E9A30238D8E29586E7B038566BB193CF0750925E5F37FD25E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d9d17fa9a9ff8df2d4668dc7afae8b57efc09eb1644fd058dc2799bc220045cc
MD5 77d87f306cff2d4721fae129ac901690
SHA1 03b70e5d086204715e9b7800ab3df151b258cb0c
SHA512 ef40fe7f7cee51a77b13ee7d779a1cb890f7484930ca7e648a36dd5db4a2caf26165269d5886f674bc8a5feb83e0803fd98df89e2681f061f75214d13b1c612b
SSDEEP 98304:HQRQyi36YOcPhLvw2gAf+PN3/ousfEkW54NQX:WQyiKahX+PNgu8+54NQ
TLSH
T13E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fb829e3c4679b6541a829538be2fd8656d8899d39b2ebc444654374832677d91
MD5 e799b6f083ce2e1aa8562f8a22e1ec66
SHA1 18b2aa5d55bd06bb7efcec42b7a809202829d92a
SHA512 41703d23736a66137256557abb67cb90c98acad4151e78350e6331020602f530e6b3279bce05b4e9187e76d3a99d469614c9b73596daf521f1c2bd708546fa4f
SSDEEP 98304:KQRQyi36YOcPhLvw2gAf+PN3/ousfEkW54NQX:hQyiKahX+PNgu8+54NQ
TLSH
T14D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e4e66aa49ffc4926e4e684c2b51ccd4630723e824445fde5f4280f9f71d7fbbb
MD5 36e7c18eba76d5deb523c77feed5b65d
SHA1 d0fd32f9e7032cde018339431e0ccf63ee492de9
SHA512 7e69d495b6f5a286da916adcb030322c2199afafa63c8495761497d25134016e1f3d728d095856edbff5c40b884d142428feab31bc74b1eb61a4de561d7f7d83
SSDEEP 49152:H68Qg55nhceWu7PNU3/zEkoiZqDfEFiJJ854TJQE0:xthLRc/lousfEkW54NQX
TLSH
T115B55A33B2F200A9C44DE1769F46973196E17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fd71de45e929ee2068caf98f54cb37f0d4098fbea652a86f5826602f65f14df7
MD5 f94bfda761fe1ffb1463ab66a34acdbc
SHA1 3b85e44673833f33d495b1e293f967790e15e7dd
SHA512 6891aba8570fc11443e2ed6fb749266cdc439242e45e8b6e05454576a68e7f885942cf3bbab08f6d64c0737b263e5ed1d8c6d28a7238b698ae7d4fbff8c2052c
SSDEEP 98304:by5112gYy5azzVva69nLKnhZ4ousfEkW54NQX:2LIHjWhZu8+54NQ
TLSH
T181167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5fc2853fc1c195b5c8d8382efb9ff40d6d768e4d9bb49d615c6e4ea7d4189a7f
MD5 a2fd7d7bf80e37b05d2b3b81ab75ef41
SHA1 ffcd62bc788540beadeb3115da61fe75535dd9b6
SHA512 e703bd80d010d19b8b259ac60eaefe68cfc74951ae571880dcc1b26a32d8af8b014b1b8fff2fc05d32e6ef970413915ccf7359f1f871c0cba860455323542373
SSDEEP 49152:qB+taZ3usBWOBr4tEG20bqx0z+n217aau1glrEkoiZqDfEFiJJ854TJQE0:4u6JmUxd2d9ousfEkW54NQX
TLSH
T1A1D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2dfe8eb344f69e7cbe785466733f51b7eded48d9c8d6a69f3283738dfdf7a84f
MD5 842f42eb8ce7357aebf3f90fdfd52d41
SHA1 9a6ae228a2630108768c47fe5aaef256f9d61afe
SHA512 99e363d69390df2fead02f986432bdbc6a549e944947e24b669aa205113abf8f46958fd73ae097f1f3560f854edea6e9bc138080c160601deda0617d764a49ff
SSDEEP 49152:31hpsNoJpF1A6BU44CwH7R4x9EkoiZqDfEFiJJ854TJQE0:3mifPkR6ousfEkW54NQX
TLSH
T1A6B5AD13F29901E8D06ED17887569232EA72BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8bdd33de2e961d7c5d06c2c13fb91c107ba9b721c60735618d4699adc7a6f449
MD5 928adbd68adbce8d4661a3bc2768e004
SHA1 c79dfc28ced469291f3c987c0ae132536fffaac1
SHA512 76a2eba5de635553616df75e41a2260bc263028cca68c9efcd7f0c0c3ce4c3f655e8d0c357e02a93f55adc5bf9c6fec43b11491e6aac2bfb46900aabc7c2de24
SSDEEP 49152:RSuZQIY0Be2KNRVtOnks6NMHq+EkoiZqDfEFiJJ854TJQE0:/5dKvi61cousfEkW54NQX
TLSH
T142C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0c76b3312775902fb4cab1a8de5a5c0bc2f0e4701c8e720a2eb92b9130fb37f1
MD5 7d28bdd45dae2da8364187102a3bf73d
SHA1 3a33e9a105586918e096ec3854da7d2a11e601af
SHA512 88cabf3d416bba8cface451830069a03284d6e1e9cccaa47e860240a1cfbe6f02d8c9c44250e5d244315497371a59f85c2d804e27565a6352e0761f19ac98dde
SSDEEP 49152:chtSn8EApI0figXgiDn0AP5wxEkoiZqDfEFiJJ854TJQE0:dX2iyphWousfEkW54NQX
TLSH
T12E95BE13F2D900E8D05ED178C7568632E962BC160B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e27b04065753f968c23334563f1ab52c4f9cab99af62a35bd2022e57ee617cad
MD5 8512c65cbce5875e44d235df99b921a6
SHA1 960ba0a016e21b15ad36f5636b3986e1e8d65971
SHA512 fdfe926ecfbd05f8baafc5ae8493385be2a348c1430bf84fce6aa5c0395b36ae5b7886403ae42c91564743596128bacdb1d44e8b664bdd1b03a4844511997de6
SSDEEP 12288:0CDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:0CEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T158C4234144561DF5ED230234D4A3A0E7A8B83C8AAFD1B52B5B81F10F927AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e142f9e3a7d0afbfd97d2853b8d70b06ad7c92d53110f36f677d7dc7ac22ce20
MD5 31ea580d80293cc5a25d1c2c61f8a6b4
SHA1 0c6f9a50aaf40f0dae2e31b3833e35a58dfac88b
SHA512 c76c58a21bddd3cb16ba7f1ad894546e0aefa6f9870b5e6ee892427e56a2d3bcad850543046bb29ea0957be176a583d6b840f2829f0bfac4f872c458b8b27ab1
SSDEEP 12288:knDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:knEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T18CC4234144561DF5ED230234D5A3A0E7A8B83C8AAFD1B52B5B81F10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5cd58120edf0f14ddeff543372f208e697b38c5940e1c3801091ba45e3a6ba36
MD5 c88b7bd607812403fcc02febf3622b29
SHA1 2cfaa04153e86e66a29a293581e407cfa239d4e5
SHA512 ffc144ba2a84b568619e3ca19d4e184287c1cf4343d9ddfb290ed1b1e958ae98d60e3c9f935b85c806fe50161496866a22b31de3eb30c14a93debf95071deb29
SSDEEP 12288:MVDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:MVEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T174C4234144561DF5DD220234D563A0E7A8B83C8AAFD1B52B9B81F10F913AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 11e0ee5dae680944d16d0b86389bce271a3fa65a8811eeeff90941b23ff2efd6
MD5 2e89ad8c68bb9c7c437902fcdfdfd625
SHA1 06724203ba5518919b03135c31fa901055814b6c
SHA512 7b6c6514fa27b4941b8224223de5a1bc7f653c8bf86df0364e8a8a7959d3dc2512bde47f8cc840e6c6627c4703eb8554e6f0d31e9c7c158328225f345b7e99a9
SSDEEP 12288:IVoDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:1Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T170D42341069618E5DC734334C4B390E7E5B87C99AFB1BA6F9B80A10F4A76B205D3DF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 70749c1cd8111c163e2b1ea2fdae3f502fb0cf84458b38327bc0375abb2b99a4
MD5 62f31a1c385c8020201da1932bf828d6
SHA1 3f7ae9992c36122414062c1009ff85549e8e4df2
SHA512 ba755a2b79fcf11604f7de5e1688bbe5db4ac6a372031d72221d2dea80266f0a2fa8c6c765cbd2ee406214e16b1f24edcbcd279a7694fbefd1e835d07342514f
SSDEEP 12288:lwDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:lwEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1D6C4234144562DF5DD220234D563A0E7A8B83C8AAFD1B42B5B85F10F923EF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 0700c36f389b2c73eaf1730a7a0a2a405f537e598ddad01903e2c7760243ba76
MD5 3a8f780c310b2d1f0e731768c80578e1
SHA1 f1aef081cfbb627c71d78167420accb51d8f1933
SHA512 33e611063e448583d5b4ccb5d6344783cd473a3675dc20d137ebafa67a86710912613452dde71f7c45574f79bb13c963e5b35c397e32e09175a3cc27206b01d8
SSDEEP 12288:nbDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:nbEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T136C4234144561DF5ED230234D5A3A0E7A8783C8AAFD1B52B5B81F10F923AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a7e3190bb80d4caa081957bfa1eae77e8e299aa032bef06d3d19f6e99da77785
MD5 76c92a6e399eae0161aefed1fb6575ce
SHA1 31c999ae23dbfdf5151df41f5bd7ba72648a9462
SHA512 8d70ddb8e087667a10b9a38b252c83d7962f296460fd49eb473f47f5265823d6d994d42094b5f617be84c0fafcdf5f6632a1c4b4988c6deab78557359df081d8
SSDEEP 12288:QPDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:QPEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1CEC4234044561DF5ED230234D563A0E7A8B83C8AAFD1B52B9B81E10F927EF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 be5365d1115796757959566bb448dcf3f19729e2c17a30001bc4da2c2c4941d5
MD5 dee5b590caf0e9a0cecc031fc8f669c8
SHA1 1d307616a763585b7d249d270ba23edd4f6cbb57
SHA512 32677034b8703cf7ed11164c1e10351a82d93dd5672c90c14a80274018f0095a1781ffa138c13b59ab5a2b0288e9baff60f1e71cb936205bfae1181436dfcd6d
SSDEEP 24576:SZMMzFVSOHEk962hZqDfX0Fiz9DV854P7JQEtK:SZMMzfLEkoiZqDfEFiJJ854TJQE0
TLSH
T1E505F195B3901CF8EC63423EC9668956D6B17C5A0BA0C61F03A4322B5F377A11D3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8add4850e097ede79545c343cf652b787221b1d48bb588d6af4eec61850c7633
MD5 937de4e4b0f03fac4d6f1718a79101b3
SHA1 079e0612c9f054d0249c50ea2cf12af33148f948
SHA512 0173fe35788ec376a5e83998b10d65b76e0272d52802504ce069cc38336035154a154fbdd7ac0d66fd1c2c5c6a2bf0c3a7cc2593e2f8d3269a2e207fa9e8e856
SSDEEP 12288:1uDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:1uEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T189C4234140561DF5DD220234D463A0E7A8BC3C8EAFD1B52B9B85E10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 abb23cafca912cb0d14cf3535c6c022df0173fde666e9d33409e178eec640181
MD5 e73aa7779b10e837df6fc8e5f4961f9d
SHA1 95adede474764b6ac3211554048b2d53bacbe2ec
SHA512 92a867feb3d7ae0da8b3d84ef5bdcc0aa12199a36ae8e53a71204922581851d5b550cafd04fea12b4f6162c23bb2fdef72a780f1cada522d6679aad4f30e9a0e
SSDEEP 12288:l6DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:l6Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T113C4234144561DF5ED230234D5A3A0E7A87C3C8AAFD1B52B9B81E10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 94aa2359e3a7d22f428c76dee77d2aaac7593429577516775cb8bdc9b333a9f4
MD5 2e45492c9b6b6958def8b67c3797291d
SHA1 6207f1bb46d8f22965177cea6ad16481d10a57d5
SHA512 7cdd1654dd3bf34ad4297db8420c62e1fbf9b14a2ea4dbed083be000bb14f491b2d1b8736b2907fd96de8709ce4a828ec8dccc120697cbb2f3f582537901df2a
SSDEEP 12288:WyPz5L8TDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:rzyTEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T128F4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B2F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2515e9dfc6a171d28a5a73c6870d297de9b97d7e82ed5d4dd35f610faaae8462
MD5 93745f5d4c6deaa4d5384747e4c969ba
SHA1 7b13c80e497ef6ebb13f1f8b8ceace06f9a35225
SHA512 a9f47e31a844e285ee0c3881e01fb139b1d16edd661edabdb6a6d603b31ee55946193976ed774fe849ca1637db60ec5f04ee4d8eb7e0d3dcf3f763187ee44a0c
SSDEEP 12288:KuDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:KuEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T16CC4234140562DF5DD220234D563A0E7A8BC3C8AAFD1B52B9B85E10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0705b7907f65f178a24a4c97593f63de94466f0782715270cf1ba8e3e787c30e
MD5 eddfbd492809c124004c12a103a77e1c
SHA1 b993caa3cfffb6e3c8bf5c09cd10cbf322e6af7e
SHA512 fab1811d932f06567c65acfc70337614cb39466e4d5c2edd8d977d5596c9ccf773d21f84d2f9a68336e52136337c11ed4208bf3904ac872ccf438bc93983fd8b
SSDEEP 12288:buDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:buEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1DEC4234140562DF5DD220234D563A0E7A8BC3C8EAFD1B52B9B81E10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a354fb5dd5ef71c21e87744a0ae39e721f20276ee613962e7485040f1b371f73
MD5 7317155235bc25c59fb2fdeaaf4fdf97
SHA1 6fafa3fb3c06bfc489c192be3b721e60d062214f
SHA512 86266b083a71ac024749568337702dad4bec7168b940acbfdbd8b965d11aa2f1b2d2fe103dc7852f7acb63ad503602e3f92262a24f212c414b32e5c2ae753455
SSDEEP 12288:lyPz5L8TDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:szyTEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T172F4020762A130F9D5334238C8A31952F7B578764B609AAF17A0527B1F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 956ff783d758ef975d08127653891b97f1dec6f0fbba33f01b234cb406f6535c
MD5 0bffd1304e4825e4c55d64bfa9b447d6
SHA1 c901106bff5676cb0e0e5262806174de983593c9
SHA512 2d04c3025d423ce09a79413524a1345753730ad52321e36f85f0c422a048fd28eeb0f687df7ca1be4158b828664823d82d78ff32038fdd32ee67e0a82cdd87d1
SSDEEP 24576:JT9aLl3z0zDlEk962hZqDfX0Fiz9DV854P7JQEtK:JTQLljMEkoiZqDfEFiJJ854TJQE0
TLSH
T1BF05F194B3901CF8EC63423EC8668956D6B17C5A0BA0CA1F03A4366B5F377611D3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f40880a556941b7cd2c7f56c6529fb706305519eb28f0d36255c84d33f1d3dec
MD5 b508c361d0bdf1465c74b1dde9b59c8b
SHA1 7223eefbe7d25ddd06fe75eb008b74e3750b7ecb
SHA512 fe1c7743e93e3d89592871d9e6c5eab69fc42d24f969430678b93a4b52fb7ca8ca8d3b0fd9da03ec319c26335b7b7c696cc174a25f5291ef4c118d8ba63dffb3
SSDEEP 24576:V3td9CHKy7GZpEk962hZqDfX0Fiz9DV854P7JQEtK:1td9CHKyaLEkoiZqDfEFiJJ854TJQE0
TLSH
T12125CF90F3E414E8F0B38A35C9765512DAB67C5A1B71DA8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8f8076609deac02728acabb96ff8a207ab4221e790a05601e5e7138a693c623f
MD5 8876cbe9451549fdcc2eaf11294cd844
SHA1 d36d6e7453f2c19144033a3edf2b0b95781e4403
SHA512 2582bba244c3fc78d3394a185e69c0eb68b444913355d7fcb47689d8d8fb164f30c162856b184621f7ad65e7e6fec55d94c3d2015d315135d217f51ab0c6bbd9
SSDEEP 12288:k1DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:k1Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T165C4234144561DF5ED230234D463A0E7A8B83C8AAFD1B52B5B85F10F923AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 58dc6541b292a4c1665262be96a2dfcfa160e7bb441e5a83f06c8171cf217600
MD5 fcb85a07abf07df02012d4e5d55be25e
SHA1 24886ce8ae0caec1676add76a5fb4eac4bfa57f6
SHA512 c78d0afb04de45f7f9a8feb79aad39a7cf7b584fcac719f2976097bf8a9bdeeccac495e75997d2800d30314f67fc2ee919f28fbda1218a176cf05084eb293993
SSDEEP 12288:CzDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:CzEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1AFC4234044551DF5ED230234D5A7A0E7A8B83C8AAFD1B92B5B81E10F827EF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c7772eef97ec78922c1badeb978ff014511bad041e8823116619c7c1b866b2de
MD5 eab8a2b446407c4f483cec0c13a5bb5c
SHA1 80edd008ebfa8cb99b94c3bcef977cffc92856c0
SHA512 60317a1b9bcf2a44ea6cb8789cb21b93991f3e5e3460545cc8b92fee6f30ec4f419998e46ddcd9693626640f8abf0423e3b36490b20694fcae29839939a96647
SSDEEP 12288:YUDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:YUEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T191C4234144561DF5DD220234D563A0E7A8B83C8EAFD1B52B9B81E10F923EF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 a6b012d490e14538cfe984e52bd6d605f7913ca792bd46a706bf154edb377ff3
MD5 5aa48b23611cf32aac5284a3068c91bd
SHA1 c9ea58723ae70899aac74f21b9a5e1ca510e586e
SHA512 0d1dbece5aebccfb9fd713282217d567b94ab6adfb810b84e75cf9ec0f9ceb7c945591fbb0335d760b361381fd0b012faab5eb171e2bfde889f19eb3bb57e5ec
SSDEEP 12288:nuDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:nuEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1CEC4234140562DF5DD220234D563A0E7A8BC3C8AAFD1B52B9B85E10F923EF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 47bf3f2fde476130571edbefaa611458abc4e1d5b558cb2b0cd1d3f75022c4c2
MD5 51782a40a8e8d78a6d5a3b7909a2992b
SHA1 48b064a52464c6a59c1945842987beba32b456b3
SHA512 9d2a308af168e9d14f97ebd3d205fa6cbde819b26ffe03315f38105b0a128991f888843ced5dc7a14363077162f68a82c566bfe05159ef71527b13aedc0eb2d5
SSDEEP 12288:h1DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:h1Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T168C4234144562DF5DD230234D463A0E7A8B83C8AAFD1B52B5B85F10F923AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 18d6d96bf995bcde5f64ab0c1275343d7c12c7ec3c8b9dd167463ed343156151
MD5 08c980990e7c91310f7cf567a712ac46
SHA1 052cb43f9f17af9584a85e81fa9be4dc6751b757
SHA512 8eee2112692c546023aa2693463e3d3e6873dd566740a9c4c396028c2ce908f8a5918b3513a99e012b8843775589b7afe189a7a78dd34601b78eac88707c93b0
SSDEEP 12288:IWDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:IWEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1B9C4234144561DF5DD220234D5A3A0E7A8BC3C8AAFD1B52B9B81E10F923AF365D1EE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 304b573b340d5d62f180d66af7c1a667dcd52a9e43b5fc95ce88a76c5b26ff2c
MD5 5a03fc089eb4192f51476d2952887dc9
SHA1 f6cf1dca10ddaf2f0f7c47816d1ba462e7c7a4d1
SHA512 4f6386bc7e1de6892217b627bdb7a0f23d39654daf2f26d813be3e73d3a804cfe74262c9db76bba44d1f4a789cda347373107e280f55bf7ebc01fa1618ebdc90
SSDEEP 12288:QwDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:QwEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T19BC42340445619F5DD220234D4A3A0E7A8B83C8EAFD1B42B5B85F10F923EF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 c6a1499b96a964e651d3b803c664c95dc60bd7ddca6f3293b81c06fe35a49387
MD5 8ce7523a61e3c35590923c3b940297d6
SHA1 5eb8220ac10de678ed2549c68cab86aaaea4d83c
SHA512 2704906bd70bca78938bf208ca95af8530d2878281d16d314e73b54649e21f6df85fc3d88a4f830e5e30830f1640353740f5045cc27c44ba04b65ec37fd719a8
SSDEEP 24576:kfwvok9RX6wkyAIqEk962hZqDfX0Fiz9DV854P7JQEtK:UMnYIqEkoiZqDfEFiJJ854TJQE0
TLSH
T11435DF29EBD808E5E177923CD9B3460AF6B178591B31C6CF029A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b6181af9337e466d60e24fac3de65ab1fe6ebc3b9290fc35f8a9e07dc837fc66
MD5 9423a72563c3aef6e87a314224283046
SHA1 ff0a27c4f0744b0ff093934068705702a738f0c1
SHA512 0f15dcea0153c5e6dc667ef498a14be80f265f788bc9fdc87576b2277b0691c12dfa51a5ca06d7dfc7b33831e464965e8491dde65a18208f8a12107712315488
SSDEEP 49152:RYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0REkoiZqDfEFik:vySzPfousfEkW54NQX
TLSH
T16E066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6efb0510ae6416f2d737114a065971207dd5144a6c328af7c65555fb918909a2
MD5 e02dad4215eeb2489eac5e3722687829
SHA1 a8da0d62b3582d7f46389c361f10112590bf5199
SHA512 7008d52c9e31432f5f65a58183d8ce81658edab3af1e2e84268787174954ca58aa3e55f7baf65e7a7e5a9b51a2d7c74bc16efd6ada6a7340416bc3bb5ea16b32
SSDEEP 24576:b47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY3Ek962hZqDfX0Fiz9DV854P7JQEtK:b47JUQj4irIhCnDHUPfF/BEkoiZqDfEd
TLSH
T18265AD1DA3EC01E5E1BA827885154A5AEA71782E1F31DACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 223383e2634c4701afbf6c58eb6ceadf9886186761915c87eba465394fc31731
MD5 7b304efacd5e74e8daa142f3dbe89af2
SHA1 34195bb3988a32deb800332392bddd63f9076427
SHA512 2419146b6d658b1a81390e4ebcfbc74e2366ba45c77bf6e60db1c818e92057ead1b4dd2068deb3ed045d41b8d7ca45ab8f9bdbaf6007de4bd208e352b5da4a3a
SSDEEP 12288:pGsf+DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:b+Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T10BE4F109C29812E8C46E5235C7565682B7773C659BE1E3CB57C0F13E0F3AAA05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e08daadf3ac15d026e25f650fa405c49854c710a84550a86090c5f151326d81a
MD5 2ecf6ffccc85ba35acef781be496edd7
SHA1 28b86b59529f1ad5c474256be44a5d70b875c126
SHA512 7988b46cc5c9616544a4f89c549cdfc3eb21199638af5c205fa2b943ed8dea228e97a6045fd431f3f6b1d0c9bf9e7d4c691f86cb9ad48f851d7335e8ba6260e4
SSDEEP 6144:HsBC2narD9m94dgPJyDPotMxwnjr1U3fhkC9X3g0q6au03RlBpIWI1n3LOJ0pryO:Y8kzU3fv9ngwazBnjl/PxZr9DRpb
TLSH
T166451740762AC74FC66980325E32D5CCAB707D41EE04AF1373C99B3ED576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 d920595e54dfc455f29876cfb3af54450b7340ffd0c15346d15efe82bc7933c5
MD5 989ffa89d331a4d7c7a9eefa22f72b31
SHA1 a4ca6218edd1d641f070c608e2a83dbfc79dc9ef
SHA512 a3adbf33856f352a536e201c8a130af7a08c46ceb53f38bb08f943ac24ebba0f7190269d43ec39c74574ad5d8aed89db679b87c35cdeec35bc3088ea4cdf787e
SSDEEP 6144:E9slR05GqR03Z03h03gmFf0FzW1a1VaPmgiiJyiEsHB03f03soD9tMxX6kpK03Vw:N0gFf0FzW1a1VRUw6kpZ6H6zBhev
TLSH
T11C75FA806536E3CFC1FA5032073A5B8D77B4EC46B7496F26B3C84439D86AA15A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5626f29e71aa6c17855cbfaac9add4be60be76a3cb52bd79e6d6341077ed874f
MD5 ee9ec3922ba8d1fd746693e1fa8325bf
SHA1 8c6b64f849a3756836cae05ff20b3c352156ae80
SHA512 121264cb1661a19cee7734aa0e9e1646cbe53bde014f2b00511095131d7c39fd8403293b84668c4b342632d22ee77180c4363ad4fb6993b2ebe1f14429169437
SSDEEP 12288:LM7mDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:QmEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T17FD4230141992DE5ED720230D46B90B7697C7C999F90F497AB41A24F913AFA18E3EF0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2e0313b518999900011d0234c6423ec0a1d94754018c71d81a9fef8e935b747d
MD5 23a9189c1b44e6b38855a4a8b38d1f89
SHA1 fb6447be4e3551d358660e28b2dc82e639bed853
SHA512 923f3515d60cb16718318b1537520ae65d9f93b78ba46c15e2df5bf58f0d076a9f1052743e4d413f6ec3bcece6c5f9ea81e287ec468b70cd257b066caa008e4e
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYMEk962hZqDfX0Fiz9DV854P7JQEtK:1gb4mBIBhGF3EkoiZqDfEFiJJ854TJQX
TLSH
T19C65AE1E22EC02F5E0F6D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ef7b8df2475b33036dc2ef1bdd3f405efd66a40f20ff824bba31f8e714c1956f
MD5 92eb3a2d97a5cc632bdf204cf079912a
SHA1 44b2718424b54fa30b4dc7b2da04e6a6eecca05c
SHA512 5054b075bb79952391321e737037ddcf9339e260042690303d1d8d336d9a826aeb2ddf97ded576584107d6e0712dd7b4c42c946a8b286a4b5192f93e76629826
SSDEEP 24576:nG88u8FpJqH1Wzria7/mHEk962hZqDfX0Fiz9DV854P7JQEtK:G7ZFPqVha7/0EkoiZqDfEFiJJ854TJQX
TLSH
T1F135F16566E101F0D877D138C98646A3F6B1B8250360FBDF07A88A561F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 91a05369b559fed53f3d99e07dab8f0f91852563779db15c83c0842c9912b446
MD5 ae60e9e72d0a695b9a12e0f3fa0d7976
SHA1 a7cb9950589f684521492df97940ddcb047252b7
SHA512 5016c8f8d5f60eae05b28fe914451a7c5f0ce104547176eaa4e16f7a6b877dc66b0793bb453c7767c694ada001e8d68d956b91a29319e019e19d26cf6adb0154
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbEkoiZqDfEFiJJ85V:BG05lO43bgousfEkW54NQX
TLSH
T1B2D5CF6A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 208c64d294108b59c762fd8809ab36b435c9ffa8e461670f17cf9519e8e73930
MD5 61f884d5094010f03732fa8184bd301a
SHA1 efca05016389b653baef7e4a62e7fc16646dd133
SHA512 7aacba3f1341dd89548824a09762b68a45bfae44f1c10602cd88de8fe160ab8d2747a45ed37d5eeb7c7a3cc63426e891ce3943526335261eaa9d22a0a6b007ba
SSDEEP 24576:ifa5POZ3dpqWVM50JicR2hG0lasx2+47eidnREk962hZqDfX0Fiz9DV854P7JQE0:qa5POZ39Jt2pasx2+mzEkoiZqDfEFiJC
TLSH
T14665BF5EA6FC01D5D5B9D17CC583861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 84fe36b18e25c781a3e27541992c2248a4f437cd7c78ba8a6f850c38cba06704
MD5 c61e57c1f86f5062cc06e983eb5b5dbe
SHA1 0afefaf23dd7626c1a73f1b6fb3c8570ec745de3
SHA512 b1cef4ea97a43f1680b573ae158fc5e1af6198ca4af311146925560dac3b869c564e49aada92d4012dc0419ab155d1da6f1814898ba16e346b1befc8b0e9aa9a
SSDEEP 49152:8Nc/zEOVHFUEkoiZqDfEFiJJ854TJQE0:dIAEousfEkW54NQX
TLSH
T166858B1622E901E4F5BBE1BE89779546FA71786917308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1a64a7aae3737da49524c1c879a61b75315e6e1aabf7c2525800271dc9914534
MD5 e29c00d933ee3288bbdd958a9717e416
SHA1 2125794b557cd468f341eebef7d7cbbe53620d9f
SHA512 fcd8d0806b2731b03826dbabb0ef58960395565e5699375a9f8c495357ef72ad3198992af1e0b4c7d6da646d6f217ce2d2ed15b2ce4009cff07dc07b3dd25aef
SSDEEP 24576:6tkNvNnaFeYhJNtmZBmvEk962hZqDfX0Fiz9DV854P7JQEtK:6tMwBtOmvEkoiZqDfEFiJJ854TJQE0
TLSH
T12655AF6EA6B806E4D1FAC6B4CD238512FA727461073293CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 34f936b250962c5a5f2b4d2da1feb92d60f1776f03a6b8727840a3e0b7e4f367
MD5 dee048f464b61c7330849527b1369935
SHA1 b2a815693d8302c5d975ae9b97f4fad9e9369c11
SHA512 530804efd9330e2141801a79bd9cd63a367ef6e7600509f778ac44d943efd73558c23230c53a83fd65b940d3184ddc5845757db401bcaee5514565babcf432dc
SSDEEP 24576:7PUr+NQLEk962hZqDfX0Fiz9DV854P7JQEtK:7JQLEkoiZqDfEFiJJ854TJQE0
TLSH
T17C05E11E22A91CE5E676A17CC582861AF77178621711E2CF02D0817E4F37EE8BD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 f22a857d22537400f49fa6e47a4c4bcc7e1da05f4997ad92c77d34c358acf34e
MD5 05f795d7ab554ea2fd0e906413e9d3b7
SHA1 c10bd2f9dd032a1f7f75d9dcc9571401c597f64c
SHA512 0760f9e4d1bfa91dd520f5ddb241947174b4e3922bb56a8aed068e5376539ccab2fdafe42a3a7fa6aad7572c2b195021f9b3a1b667a60f62b91f6a94c6313242
SSDEEP 24576:UD3FHshBIYQgAiEk962hZqDfX0Fiz9DV854P7JQEtK:UDVHeBIAAiEkoiZqDfEFiJJ854TJQE0
TLSH
T18025E12DE69C04E4E57BC2BCD6638907E67138A9072265DB02D0C1BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/404-14-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/404-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/404-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/404-22-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/908-310-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/908-77-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/908-71-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/908-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1380-315-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1380-124-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1380-116-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2216-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2216-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2216-65-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2216-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2216-50-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2216-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2400-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2400-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2400-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2400-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2656-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2656-241-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2656-52-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2656-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3364-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3364-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3364-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3364-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3728-129-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3728-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3728-135-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3728-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3728-137-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3888-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3888-8-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/3888-40-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/3888-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4336-99-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4336-93-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4336-334-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4336-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4336-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4336-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4852-111-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4852-317-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4852-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4852-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4852-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4852-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5532-312-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5532-87-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/5532-82-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/5532-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5752-330-0x000002934C120000-0x000002934C3AB000-memory.dmp

Download

memory/5752-408-0x000002934C3B0000-0x000002934C533000-memory.dmp

Download

memory/5752-331-0x000002934C3B0000-0x000002934C533000-memory.dmp

Download