41e0cc9912bafe43ad75327c484b96d8f2be8e2b6ba6cf6e8a995cd6f7b5aacd

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260807-vsctcazfmf
SHA256 41e0cc9912bafe43ad75327c484b96d8f2be8e2b6ba6cf6e8a995cd6f7b5aacd
MD5 a5dd8e3bfdcd7bbcf706ebe20dd90d4f
SHA1 3a90890e43766c1ca119ce577236e155e761819d
SHA512 bb5155369c110779adcb8b3dfbb6103fb97cd779666aad0bd36d6e5abeba7c62ba237cc7ab1674f27e5868531a62a2e8073248ea36efd25eaf2a4545deec6777
SSDEEP 49152:A+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755qm:9/PvOIjcXvvOOc5WD527BWG
TLSH
T1E2165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3396	elevation_service.exe
4476	elevation_service.exe
4692	maintenanceservice.exe
4200	OSE.EXE
5012	PerceptionSimulationService.exe
4572	perfhost.exe
5148	ReFsDedupSvc.exe
2824	SensorDataService.exe
4660	ssh-agent.exe
996	AgentService.exe
1732	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\669b548fd744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005966e54c9026dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a038a4d9026dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bedfdc8b9026dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001420ee8b9026dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3432	2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3396	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	996	AgentService.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5148	ReFsDedupSvc.exe
Token: 33	1732	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeDebugPrivilege	3396	elevation_service.exe
Token: SeDebugPrivilege	4476	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 5172	1732	SearchIndexer.exe	103
PID 1732 wrote to memory of 5564	1732	SearchIndexer.exe	104
PID 1732 wrote to memory of 6140	1732	SearchIndexer.exe	105
PID 1732 wrote to memory of 5792	1732	SearchIndexer.exe	106
PID 1732 wrote to memory of 4452	1732	SearchIndexer.exe	110
PID 1732 wrote to memory of 4428	1732	SearchIndexer.exe	111
PID 1732 wrote to memory of 1832	1732	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_a5dd8e3bfdcd7bbcf706ebe20dd90d4f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4200

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 29f8c4e6809b19a6dcca43807f2f2b455231703ed815a6c22c4ca0edaf00e462
MD5 9d3934eae1dc819da5e01540d11103dc
SHA1 03435808ae52614041e597836e9362e6a91faf88
SHA512 f98a3b158d9a3fcf697f398f163e449f761be5b13310717a7c334dd5eb780103819197a921245dcceeee0a9aa15744d91d1b1b290a8e35dbcab4ca5e5438318d
SSDEEP 49152:zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnjDmg27RnWGj:R3q6sjBgD527BWG
TLSH
T1C7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e4bc7a8e13c3889427e8a7aa4020787a86c4e6d85a1d7a175082285c12aef83f
MD5 732ecd9d8598c635a7e07a8fdf9acbf6
SHA1 8324e2fae2fd59e9569ed26e4d77a77f32be7570
SHA512 3547dcaf56cac3a90d5bd9357fa54f2ff77ebd1ff8faed206bdc21fd56fbf761f23a41b8702aaed93c5797b6e88fc523bf450c0b72e2abad68c36f66bc39fdf5
SSDEEP 24576:uXYfDtczAgsqjnhMgeiCl7G0nehbGZpbD:ttclDmg27RnWGj
TLSH
T15F05F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b833a7fdd58fd5ddf48bcdab9afbd26f23af3ba62e174b0ac7a6b161e6f71571
MD5 684c8ef374d9b56a73046a9a69f6edb9
SHA1 0ff59f4a7bd7dd2311bdd0ef3ec486c56f455390
SHA512 acdc737105b824d8db352caa8f5ab4370e7aa4f94b5d2aeb070c6ec9a4c32650e5b979df8f018be0813f5a5696e94e11f34e3e92c352cc533270cbf56cd18b9a
SSDEEP 24576:d0Le5ji0hmxxrMHsqjnhMgeiCl7G0nehbGZpbD:dPji0AjCDmg27RnWGj
TLSH
T1C1359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 714359b0e56d4865800af3481dea0a5912f19b4c6e81fe8c53050a5aa26da968
MD5 802eb6a4eff89088a17c84b7a4fbb33d
SHA1 417c1b74ea4f1e23b9cd70311f022f98c3b27dd3
SHA512 a25971a48d3ae62a2351b1b296f5b3b3c20f1571199ea82c6a7111bb4daf898fc2455049db206a793c95b204123f25236b5f712a8ce1bd994d7d68f597ced00d
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyu5sqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPveHjyWDmg27RnWGj
TLSH
T1A8755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b852bb378269993b10e27b7478c3897f1493174f269627f1ea3299b5ae19f5f8
MD5 e03a0d5f0cec238b9c671d9dc3777d1d
SHA1 5f2811eee6d47168bb8eb54f7068ef363246cbb2
SHA512 ab37875db420cb660a0328a40b12b9eda1f7ce03b25d09b0a0e353e8e37a08ccbac8c68ce52197978e880ffb9f7746da812bf459213c91a2b1fec6ab6b52ada0
SSDEEP 24576:0VbqPb88hv/l+Y0sqjnhMgeiCl7G0nehbGZpbD:0VO88hXl+lDmg27RnWGj
TLSH
T1D1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 322e3bda0b60411d453c5a74a11ef5eca386e1db3673c407688ed9111c80b382
MD5 2d3a52c7d0bce1bedde76ab3e10aec99
SHA1 991b59b233f8a2756da6420fc6e80fa966b06be3
SHA512 39c57928955ee2d0335e39efe839ecce5b21007a089958f907d3db269d69799798105751a818a73bd379555253a64fc5cae67265f0a62bf363c2012e5b2b61d9
SSDEEP 12288:2LzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2LzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16EC423BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 93c07c2dbc5f0f071f414af862d2acbfc1e4952442668c6dc67da302e35a5237
MD5 81c04fc85193c7979e1c440ca2b2007e
SHA1 3f879d8edaf6ee03c447b730e9853983cd6b4750
SHA512 d1f13846eff32cd46d359a8dcbeca49263bc2cb482ff270a223f68aac5b9f6ce5f22b06941e95c7cf6cfe2e3cc7dcc8d26375b219a06da7dda98e368ce2502c7
SSDEEP 12288:9eBNUbTVO86U8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:9JIU8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF05CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cc3ec5f3f20be5b81e2fdbd4d917e763c6de02d6760f298f257f715b861d2baf
MD5 5b9df62afe3fbb9522ab59acb0d7db67
SHA1 9efdbf1804887a20cb1a119ffe7bcb801975f58b
SHA512 88b5bf6665f6823621c8106ac87b46552d2392ec724c17d549f6dcad3da42ed7ff09a61b21350c86e26d60c573379a6d82a5d2a3e2af51e57e59e1caf373a816
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:gQvGAdlCEL8c/DRNw5CtD527BWG
TLSH
T176266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7902cb3ef4e3c667f884767f988f31cddc3edddc11ce0a75f4544e8625d2dbb4
MD5 938eef7953ee0cae5809b9b4a51081c2
SHA1 0ac7001aa60a755b9e79e5ea6698d22b1db50df3
SHA512 cd94d0a9adb7f186064c35a14b37cb4678a95a50c45e9b9b7875cd1873c8339f0e1e3018d88696b116b58cdc9aa71e425e2faf3c781f5ebe105489f594ecf681
SSDEEP 12288:6AwSfxL/2Dc3RDLLmt0LDQewsAjeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:P0ewsAjesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E515E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e6e16dd5ee4afba18f3922b0d99cb56ed8055350e24bec4b3cc0d55173447981
MD5 3e953a406de365eb8e5e0b1f17235ef3
SHA1 33f7d2c5e1673a32f4276583c8c9d797e6ace5c5
SHA512 ab10d0b7c3f263a6473fa4bb9a0900dcbed4f09f326ca216788a6448be8a6c677e656fe4a0c552a65c5f8eaa6106741e9354438becc192aff5e1fffc1c090722
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHaVQBWG:SUEtQevvqc2W1cpV2tI32tB
TLSH
T1ED474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f7d7647bae1fbc2bbb32a7fe6f3b0a50451a97d5d79c6e26c3b38cdc87f7fdbd
MD5 af1fe6e5067f3510816eaca8bb7711a5
SHA1 2fffa9a71e295c193ffba5418ddcb690c930073c
SHA512 d094b34f4added95a1da5eb7036c3ca484b83b6701779c9caca154721c2126970f3cd0763de3f95644fa81f2d0d17344613ba5a1075bad5406b09ca02e4ffc8a
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/zSDmg27RnWGj:+oquVjnmRD527BWG
TLSH
T137D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 914b1d387a6c478532e29e281eba144c0e1aff31ed25e9702cae658cceae90ee
MD5 b93a2f45f59871e75b6afe62c4822712
SHA1 7b2846b1836d7cdce58976398dcbf6b52e27887a
SHA512 91100ca8375787f03dadd6eeee6bf855c0b35774d6c9e102dfa20e64461fd56c20ba80aee3d0ea1febaff29428613cbe292f8637f6aa0be10e13283400b06da1
SSDEEP 24576:4AhGL3IFoiwtA5l7S53NsqjnhMgeiCl7G0nehbGZpbD:4AMUFoiq5BDmg27RnWGj
TLSH
T131359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4c17acd0def6de7ae8923b0276da49bda7bf2961a85e1863e99a38bcaefc1d33
MD5 a6305ebaeb0c7ca2aa5329d61b3fa95f
SHA1 3b34550dbeec9e842782a814a9c3caba1a228a2f
SHA512 09cf071f36cecdc1f4c1f4f204f6f8ee1247bb176e604c4b6b3b3d030cafbd0c27f5632d9a4a22b8f7dcc8ecb1c81bf018d47b0d1f6bd459fdb0448fd16d4e5a
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+CZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:awu4OWysqjnhMgeiCl7G0nehbGZpbD
TLSH
T18205F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 89758909b5af0bdc41df48b8679e185d0fa83a89488daed06833a6d3401a46a1
MD5 d6cdd182a76778ad12851dd4d43740f4
SHA1 12ce6f2f9a7aeed7b481dd15022010f3de4c3b2f
SHA512 2c7767566e60dd292250f6554f33be8d68a65e44ca3d59c3866a6d187df9c56f0e64d4293428edd3cbfc02c4d6105ef00366e9068b9ee102d59735afe124521a
SSDEEP 12288:XeZ1IyOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uZuvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T173E412AA239820FAE163417CC5E5D609E7337C62673003CF166656AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 99a43059be46a5a165888a74607eab172bcefc8be0781f212a2553af4d8929d8
MD5 9a29038ac1ba16f48668cc104c8a7957
SHA1 e4e0c088d49176ab747b3858c894dadf6d3753f2
SHA512 c00c901219bcffcc31ff27f89ef49a74bd163b7d7bf1137dc181cd820c711a94f0caa9b2644324fbaece4a39a344258731a896c4b90f16637154cf6f756726b3
SSDEEP 98304:ZQRQyi36YOcPbLvw2gAf+PN3MD527BWG:QQyiKa/X+PNcVQBWG
TLSH
T1EE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2f4b02db2146e5cc963e79480558474f3b400e3f66795f6cc2b5b6b4f0525e35
MD5 af7d905173dc362f4dd3305a78c62a33
SHA1 72713070574e9ad601fc6d68b1b2577b69df0516
SHA512 913236456a3806e4f15498297530e3ae34dce022dfe65bd47ff426b5badb01776b6680e7212f37b76c6cef422e7293d1f83e8b2652aafdcd49dd1c41b820a9a6
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3MD527BWG:pQyiKa/X+PNcVQBWG
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ecd514a8f4eded26f1e578ae4be80afea6ae80c72e5ba3e08e55e0baeaccfef3
MD5 c9dae9446f8018e021753376e1bb2afc
SHA1 889cca4802fd29c3c2a34972f5ee807cbed19ce1
SHA512 f5d692609b7d51258a83c45c98ff25f42b57124c618fbc7b4973802a021f76133ff62d359260eda62862e8e50e6c6a66ce81ab22c99b9dd2252fe47254ddcea1
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0/sqjnhMgeiCl7Ge:l68Qg55nhceWu7PNU3/CDmg27RnWGj
TLSH
T17BB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c16d930a8b506f4879df69df9f9cefaecb691b7d98a401311c7ec48df072d236
MD5 968868ca554d0cc457ac6ecbde53ffbb
SHA1 c24522b26100d323778e28860919a1e1f6ae24a3
SHA512 ecdd104ceace4861444f6700b9181da183634ad36e6b3d3d00fa8aca1ebee46024cfcb1f72cdd75d66897fb7be2c95abb5b86125625ed4d565d4e2a6c3e7f875
SSDEEP 98304:Dy5112gYy5azzVvt69nLKnhZ3D527BWG:eLIHEWh5VQBWG
TLSH
T136167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 54800dc40dbca2d168cbbcbfdb152c487770d2719e819160ab2287d7d07d126e
MD5 5ab1ba81a07db36863396f49684e43af
SHA1 d2f287a9c1ea6dac813d831d6919ec505b5ee505
SHA512 129040c33bbc7703d8c0e3a330858d64efe62aaca51181097dd02980637bb94dac3cbb7a353953ec9dce2c9367c34f51588ffe9f3ff8528a6c2aa9972b6063cf
SSDEEP 49152:uB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glMDmg27RnWGj:8u6Jmdxd2dMD527BWG
TLSH
T173D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 14f7a60ef6d2de343c3879207e116d3550a2aaaeb57d05e79a55f2cdfaf3ebb9
MD5 b6af9b786751d200691dc82b34416c63
SHA1 a5ec683fbe401f6c72ae3db312b2b454cb0ffae9
SHA512 b1d9fc0f8cb5356bca8ef3584d70da75a95130728aadcfba81abec68eed61c648bf4b746da65739096aed203bd62c3daa77f350e0ec2b67da5e971449f8b62b4
SSDEEP 49152:j1hpsNoJpF1A63U44CwH7R4xIDmg27RnWGji:jmifPWRRD527BWG
TLSH
T1C0B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b8bb7fefb490d19028b224ef7ea92e1541c7a9952cc7a8a1df94c00eecfbd571
MD5 515ed48923accae119a98b0f4246c52e
SHA1 5758267b86d87c8193c7dbc854da291f1569da7a
SHA512 4103feb5d0890a0a4fa7b66a0661d0b0b2be0477bd1e9edf4634f5381d34eb82ddc87fea155912e727718704cb551b9b14de1c7cdd95c4db668dd82a8c1d3d6e
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqTDmg27RnWGj:Z5dKii61TD527BWG
TLSH
T1A2C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a885c1546d18a49d10c6113d45df7cb756e80be5e878189cf04d45773dadba04
MD5 bd16d24a1ca7c969d63eb9a1cee92f1d
SHA1 3c73ef1dddc6a6c034cc9dab08c1f8a665a4f6ce
SHA512 b6ed4bde792884db9b06c8a9432af0f3d94e9ff0eb53a2f582b1cd089a2b53d764bd2740f06d815e65c06ac65c79fcceef9d91e5b568b94ae2078cfc2000da17
SSDEEP 49152:dhtSn8EApI0fig3giDn0AP5wUDmg27RnWGj:MX2imphVD527BWG
TLSH
T1D895BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ce3c3bde1ec9bc19496ae377fa2072adacfd9ceafccc98d646132c7ece930a7c
MD5 31c4a274843546556ae98da417da1a42
SHA1 0af5e8768ec7146f08bed6793323d7b5d339c261
SHA512 7c308a821023287c25bdce47042bdbf9b06dac31e804c6af45c946a6eac625b6bd226e9c92e9d5868f13144dc5d3bf38b7ac450ead74f5524e9d8f79213ebf24
SSDEEP 12288:ZbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T167C423BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A577CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 42d6fe40560f43df43ec78870ed8ccfbc8673aac8b6c6ca2c029493fedb3229d
MD5 aade47a1f5c1e55b0674a35d1b4b2cf8
SHA1 e6b35c1261a202d44631401eaab8253dc7aa6f5a
SHA512 40516bb086ccdef0ab8f3d30cf03d7dd4e8faf81b41323702c2ccabb28720734ef0e51c735106ffd7062f4530d2ca301b2c667b15cd9c40c5ff66c26d6ac4c72
SSDEEP 12288:sqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ECC423BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 65936c4d8e3ddc0ceee174a7ce86a9f0e9a524de88ce2aa4be2302a5422ddafb
MD5 c4afab0a043a43501c3947ac75215193
SHA1 f9564156608bcf27025d2f902eafa4fb2e7ec0c7
SHA512 b1eb1609a41740c1fb8865d2584cf12795500d5083b5a50e72a495944554756d55772316d1ba78018772c609af464311087af1c7579f8d9d09548703e86402b5
SSDEEP 12288:WEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10DC423BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 382768e497b8c20f1e5b56051f558de6e651e0c9ebf63177ea8450865e4ecc85
MD5 6dea99bd4d3d9fc0ea1ceee5f892621e
SHA1 b25550372a56dec33bac680c4d06ac5f1e0e69bd
SHA512 8f28a78cb25bafa4b50db7916b481e5f2e6bffd4384405b2d36fb5717bcd4432c8a6b5b47a6b7f0296b5f3eeda5a12da7693face117f99099aeff38909fe0b91
SSDEEP 12288:cVtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T132D4236F675C00C6D83285B4C2F5E11DE8277D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c7a56b7118cb4842c48e12956d6fe35b93548d69e120e848fc2bfa76b18775d0
MD5 dc7d316b0bb3a1196ef423a2a96721b5
SHA1 08517fa47b70a89e2e58cc0a5ff0b73329873082
SHA512 51dfe81d07ace2354e17f919d5ee989687bed76c71b1eeeba9489cc4b63d2ad42a2944337667e8cac26742b5b8e0d413e9dc53e4fb8f2b3bc3814b59e99f1eca
SSDEEP 12288:klXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:klsqjnhMgeiCl7G0nehbGZpbD
TLSH
T159C423BE965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9196bda531416cd1b2d7a4d19200e689e338518129b688cf1159da2ab9894a9f
MD5 8f8481de864c5a73e1641c724525fe44
SHA1 b7cb22c9edf70005bb4f52bb47e93ca2f64dc2c9
SHA512 5203527c7591b4f7b76f805882c1331ee34bb644758a2ec69efa634c92bb034b61acc78c7186e1bfe968072690420ec7451efb4dbf65cbb41038ec20f7abf10d
SSDEEP 12288:tGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B6C423BE965C41CBE52608B5C3E5F14DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a6f572785305df5e9a220818791abbc37a0937d501f53ae0fb77b3f2cfbb0b96
MD5 0db53be7db061f5d6980cb4e8418ccd3
SHA1 43a9d8565eceabaa2e0d39c901e878c7ddde05c1
SHA512 06120935212c964c55a21485c840e8812d49c7229138b9f3562abf1e91898de83493b34571cc2b4da55bfa67830b19d3c8c538ab301b5c8b180dd3ac44b6b386
SSDEEP 12288:ICXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ICsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FFC423BE965C41CBE52604B5C3E5F11DAC073E6BE9200493BA57BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a126be2d824a850adc2f89aee1567c179af6b174cbf42eae87c4f54b75af958b
MD5 3aec00e9b1c0d346f53dff0ecdee4137
SHA1 49b7d8e4f1d9c1aa5de18f56ff9aed7e1ca3b550
SHA512 f684f9f307f3476f0881c3178d7a9fcad9d8a8a14a0ff346064e24244c1123a29d2cbd78c5e539f294aeae64fb2d71eefaa4132e406f5abc2c9e6ece5bad89b7
SSDEEP 24576:FZMRzFVSOKsqjnhMgeiCl7G0nehbGZpbD:FZMRzf6Dmg27RnWGj
TLSH
T1580501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 919b00c8af543f0c80109098ef49714a9ff419129786d938fa13d79d9fffe000
MD5 94680c1ce3c68c17501d9edd144e75ad
SHA1 1a690391b39cd4ca46c62ae1e014963f985ddfc1
SHA512 44de452690c83c3279e6d948febcf7317eb8ce0b47164de88d023663b6d27f7095ea2596b3581266cf771d5c2543b0e4ae2261d5cc4495281ce991c47e028a7e
SSDEEP 12288:KfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12EC423BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d52e1ca2d4213112eafe2591ceba060a1a97d53324397486d970624c464e66a8
MD5 b16901dc00dfadbfff98f9e4a4d7ff8d
SHA1 2ffc44ec2480a0978e709974f858559fe612e0f1
SHA512 4cf3850cdcf96b8ca9e58a0a0fef31700deef0fa29ef7b3fc13434363fb1c75645eee135cdf8ac266c44432899d1ac1941356c62fa73f9459803934103e3e918
SSDEEP 12288:2jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A3C423BFA65C41CAE52604B5C3E5F14DAC173E5BE9200483BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b29c9725662745980c7f0c136eed3b2fbca4ff0c77be95399a6436e9b640d60f
MD5 3bea21bef97b3e8aba9d594e04a6ed55
SHA1 f2bc02e70113b187e438073b8ff7c9edadcfb8e3
SHA512 8572c20413b814c17dba97cf90fbe57b9a19acbf6f7b2fa5644544583206bd3774b17bd3310f520cccd875b47c3eb95d780eeed546b07553cf8cd4dd650f3388
SSDEEP 12288:ZyPz5L8OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YzyOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D4F4125B73A530F9D1368178C5A29A06F7337C3647204AAF17A016BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 901746a784511e0488368cf7270d15372c3b43e0054f41a7c0f3b1ea66fc65fe
MD5 e6ecdbf64b7996c96064919bf69c0347
SHA1 5832df1d47f0672fd2742ff864aed1675c6c766c
SHA512 888bf59880a46bddec000ae2d5586783c7560d5935edfd632463c879021508a4ac393a3dad3a5792333df18dd3a4bf4f261ed68130723327f3e1b34407cd8b3b
SSDEEP 12288:5fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E0C423BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 381c6775f69a7fc40c81444e6867ef995a9417fe57952a5a18b2fe409102ec09
MD5 ce1e2fddfaf049501e1b354c17e1c5f5
SHA1 9204d8f71a8f3c1c70e7f702f01ca5b9f5cb6c99
SHA512 3e2b0a269e3f39ae0b7c6feaf7f0c866de6195655837932c66f610ad01f51486a44644b73f45d2b88dd8423bd9fa564c9bba379aa97e838cd0128f18da6e3032
SSDEEP 12288:NfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E4C423BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c410d77931f351cbacad7af846b1e92cc365b301b219420fd5190dc27f3c82fe
MD5 1fb09097f8fb45eba22b8c01a8217c55
SHA1 db15034f38fa343206f13efe309d562ea53cff35
SHA512 401cda6785ea93a7f83d9478dabe6e89737f5e414ebd05649c7b5e6f37f6fa573f829b562963681718eaad497bb3cf5007fe248f953446af7bb8153d1ecddf07
SSDEEP 12288:YyPz5L8OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5zyOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D0F4125B73A530F9D1368178C5A29A06F7337C3647204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9c9a006cfe2cd929120605445b3a9bdbd71b39aa5650294c57c4ad6c1d800ac6
MD5 5ec7a82d57ef2c353d5ba1c8fbb17a14
SHA1 b23775693360e1741a760bf6d91bf6524f8bd575
SHA512 aa35bfb4de245cd99b3216f756dfa49024291f2799aa26cd9b0474570c364ee3d1d20289f5eb78f27cfc28d6db88cece70f519f855a102d53c38d4857f06ba12
SSDEEP 24576:KTDaLl3z0zDUsqjnhMgeiCl7G0nehbGZpbD:KTuLlj9Dmg27RnWGj
TLSH
T1DF0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1c9131df7589254bff6086e1800fcf70b6ba3a2f514e47774364f6ca4c3eef43
MD5 b6d4ae9e851344da0226efa9214702a1
SHA1 0dff156334d7a602586c673a55d5c0f3603efa85
SHA512 40627d4f873f4d27fe456eb45c49ee44ff85bfd23859b5a0ad7f3c13a2ef4b522ea71769c3ffd0b643525d7b5dea657a6a3c61f82bb6faca537c54b5d2b5d6fb
SSDEEP 24576:U3vd9CHKy7GZwsqjnhMgeiCl7G0nehbGZpbD:evd9CHKya6Dmg27RnWGj
TLSH
T1BC25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 84303e2e879dcc6d735dc529f61ed3cffab1a1889d97db5584d5e2c821f4425f
MD5 b699a403867a1a43ed0989cd0a7e37a6
SHA1 2d7821c79507fd9996f21bdf6fec114cf9d7c68d
SHA512 762101c078bfbf757579f9a97295f9aebd12a62a0d37049871818302d1089450c9ffae69145616f8425a4b4b6437d3cb32a60313173abd1842f105bd0cdc88da
SSDEEP 12288:QkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B6C423BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA577CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b1a441dfdd94cf10ee34cd2b65ea0a9d393f62c01e6d47d8ed3376da1e32c0ae
MD5 5e1c958bcf94cf10d082292252e0c625
SHA1 9047ee19248cfc5ab4c80ba5672d6eef063cef7b
SHA512 2cf17c06f7cf7b10c53f1b21307e5cf2b597d39e8e769090db11afcb08b10ef725d358b8939598a7e9ccdfb167253d505622491acf2e6cca7cc27f424bcbe79d
SSDEEP 12288:luXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lusqjnhMgeiCl7G0nehbGZpbD
TLSH
T16BC423BE965C41CBE52644F5C3E9F10DAC073E5BE92004937A977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 15e629d84951f7729f7097f2d87761a08a6d46c160694ac0e4599757a623bcca
MD5 130e6d0a57f4906d2f8bba181a341ba2
SHA1 e6b8662a5007864641ebecbfe4cd96cf59e4394d
SHA512 29eb2c79aa6dd197ad6512c75012ef21fb5c5cbf194966f436b880c88abd6f11603daa6d4b7431489f2f423a8431d18096470f633c2a569229ea04b482a07068
SSDEEP 12288:TxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D6C423BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 9ecede9ed0586b7625cf1240d1698ddd24ce6ac184c00ceaa26f731ef503bc5e
MD5 02617befd1d848d49e8f2dd21aaac67e
SHA1 10bbb70209f0119f1cb9287cb054594d13cafdf1
SHA512 33b26f411535c418633b1f4f25228b7f2e22abbacac50cb8ba5ebeb8090481ba387edae39261100f1d064a06db31a6ae8c3d6567daf531115f98f64754d32556
SSDEEP 12288:nfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CEC423BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 7ce65bd4854f07af053d0f7b7cc954e054c136d2ab2c9e54d359e34b4a075b2f
MD5 c1bb66944c1c57dacbf8af4f4e37d9d5
SHA1 66f684b19de1b4540feda937ccaa4e8339d7f371
SHA512 7d76b40f1d87b2211ea90f265587c6be92373c7a192408f2a60ec6d45ae6e5bda54d1023c05713de8720164d29184d3b5846b8d7a40d31424b9b60f8ec0fef42
SSDEEP 12288:LkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LksqjnhMgeiCl7G0nehbGZpbD
TLSH
T14BC423BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 546d5bf6e1e2b28e1929b30e61e0755cf4c26100b11b14ab7f4e92f3a823513e
MD5 1bec131a0ac792f9e4ef9be0935bcc73
SHA1 f011389dd72bef24114fbf477d7ac6a91a02a00e
SHA512 21198df69e033d2ea58310295fcbaf8acbdc17d97638c346a4e9ee2fa8f1a11cfdb558b70a52fcfee86e2b085fb78c0412f322c7b8858653e23ecc88ac68dede
SSDEEP 12288:sXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T113C423BE965C41CAE52648F5C3E5F11DAC0B3E5BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 903ff9dc6bd616142552777f0e63dcbb917542130449785f9604f1962729a380
MD5 1239172ccacde10f85f84d1eef972e07
SHA1 e92850b4573bd2b59fcd9b9ddb348b22590cfecf
SHA512 fa4e8a7729a02be5696e916b18bde271438e25543f6ddc86f36da7d911e102969d89ddf3cdb20376a34997c54a3f62d05c88e88888dc1a3ad10221ee285c422c
SSDEEP 12288:hlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D8C423BE955C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 5f69804103b35257ac75053ed8ca09183fd915ba5e5d0aed4549cd8d1235b189
MD5 62a3ca88e03c18c4150222b369184c5c
SHA1 d6d871757a1d9c0f37edc911b6665d46703ca92c
SHA512 99208ec0c81409a9059f1df07ccbb7567f7bcab396a2e121c88024baf864768fd945be5c0c679b605869228d618ed726eb493c746fe988b713436d70229d9cc2
SSDEEP 24576:ZfwvUk9RX6wkyAITsqjnhMgeiCl7G0nehbGZpbD:zMnYIXDmg27RnWGj
TLSH
T15935D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9ec9e6384e1783c9936302f03c7a300e1809613be988ab5d0eb9c0d484bd1d6c
MD5 330f73dc3ab0a851bd7b7d5196c4bb72
SHA1 1fd18363be2037ee977898e712d5020ac32bec32
SHA512 4356db5e4796cb26a5dcb0c4d0ca99e65f9fd4f1a824595cf2c2f37b3fe1853f8fd215412d90a8d210dea5892b645a2406c13bd1168a97bcb389954204922954
SSDEEP 49152:LYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Dmg27RnWGj:OySzPsD527BWG
TLSH
T10D066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f5eb1d5f157f8cfd59659dcdc6e7558ad06dcc81a20e4ef804f3683682c98e13
MD5 110eb148253a206c39696ac94634df46
SHA1 89a3f2986289124bb20ae22e03aace47e13a6969
SHA512 bdfbacb65c23bf1ac3d2a5d567999db16516cfbbf93da2348e787154661119a188e1540ec6aac5133a3dc291759f6b57430a7e29992a5259a5a72920ad07235c
SSDEEP 24576:347Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY6sqjnhMgeiCl7G0nehbGZpbD:347JUQjTirIhCnDHUPfF/kDmg27RnWGj
TLSH
T11C65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 11ba912c9a1dc4f978f34c43403d98e7ee00f012531fbd6e7b4371bd89182ba2
MD5 6b1ef980348084ee534c919f49d31b98
SHA1 b1c5cd390f8ff64363b629a569acc533c2078b36
SHA512 a7f48c11dc4e6cb3d6f299749ade9c3518344a9d48290194e2352857fc7b4805dc817cbe46c59a06f059f4a3686a8b52ac5c420f9ef23eb80b905e6cadf8950c
SSDEEP 12288:XbsfvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T107E4015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e61a85029fabbf04cd0bcc162fdf37217d479f7bdd4054c1504f5617ba69e588
MD5 e72c864ae9c3a62e2b706f9a6ca02a6b
SHA1 7dbf0e3d8ddddfd660fef4a5c11878c93a0ad625
SHA512 065c354d1afbe6ce9b9a69ffbca4f722c4a817c7ea24e1420ea47f61520a2cda37cf367359729863813bce78ad7f004accb621416cf7d320d31d7acfa42d1dac
SSDEEP 12288:ecd+eclU3f/t/R5M5laOy7sqCKd9bN9+nJRMlJfF9nsP5:ecEe4UPFR5PsqC+JH+nJRMlJd9ns
TLSH
T12B351811766AD75FC6A940321E72D2CCA7707D42EE446F0773C8873FD476668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 27babee1245fb1fa1f849cfe8bfd68fb2e095abf241d41fc1afe9a63f45527c6
MD5 038b4a62ae2dd5c271f196a479f457b0
SHA1 d64c1fd1c246f30d32473b7cea51aac4d44b8c6f
SHA512 f5a759eee8e67d60c49cb65241a5b18f162a56ca8ea00207a5cc4aeaa102b2e177224d5a61b7a7b903401a2ab2e9c5efc17f22ce3ccf80827430562f2e8d32ce
SSDEEP 12288:7m2DfU+dAKKifoVPDAE8FjZqoFWcQjrjOggFqI3Ov:7m2DFdAKK5VPzrjOXqeOv
TLSH
T1C065E8819137A38FD0FB607207296B4CA7B8EC46B7055F26B3C8453ED866725B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2eaa14fb4c9b7ecf29261ebfa27533fbd1afdbf6d01969ed87960acd3b6cf84b
MD5 454d3848512f3f6213001dcb241189bb
SHA1 c466b561f72042768cbdce6cf7cb644184ac3744
SHA512 062ad2825ea9f7bcf9222e745b4346fae05e99b15d1655e0c709c4b5a827d896cb192af1127974f8588cdd8b0ed026ab77bfed51bb4086460ee1c3d335d16f9a
SSDEEP 12288:D07nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:onsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DAD4237B935C518AF83609B482EAE12D681B7E669F1044C3B90778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c5fd1a815d32eaab73808e9a42f4bc03b8a03c5664c993a1b01025001d5f0d3a
MD5 211ace4aee098f12561199e340776fb0
SHA1 09e6c69a2db5bb60c533e540283027880e70816e
SHA512 0f649f5aae515317ca29f1c4f78b0bb38ed4fa32d337e537e422f2e1fa107aafa4d883331f9984c65120b59b2ff3b366301ed7b5707ce1b122367134cc59f9a1
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bY5sqjnhMgeiCl7G0nehbGZpbD:Agb4mBIBhGFODmg27RnWGj
TLSH
T1F1659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8e2222a641f496811e4b31a70899cf53dc9360393c2c4d6261d2e9ab6b230baa
MD5 9e8590ca8bcef58b3117e3deff02af36
SHA1 5555d4b696c1289114f25fcae1342b5ae0d03427
SHA512 caf42bc710b85b512010cbbb0e4dc2776dd15e288b06a4e4ee23d6d9ed7dbe246a7e15536729418fcba0384686955dbd81325de7346666c1b145a90ac577afd2
SSDEEP 24576:UG88u8FpJqH1bzria7/mKsqjnhMgeiCl7G0nehbGZpbD:n7ZFPqVea7/lDmg27RnWGj
TLSH
T17735016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 17ae17d01c3cf4b58875dcba7b552e8fe2c5971a5fdaa3cdc970b1bd4c59583c
MD5 0a73cf787c15529dbfbbea5ab64977cf
SHA1 822f8ad24ded7a6d8892be4886671f2f46a98b61
SHA512 bd596298d23ae50db67952cd78b3670c16376471c0e7672d52fa3d0635ea65037ffa0cf3ccd8b34f37f8ea4f2c1f3119fa66e8d4fe258d4433455fe96d70ecbb
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKDmg27RnWGj:nG05lO43b/D527BWG
TLSH
T15BD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0d7542eecb36039d78bffb9b9f6232d22c018b2e53caf84a0f58cc3293eca5f0
MD5 ec8626594cae88664975eff603d5d03e
SHA1 8332cd69507d23d08d95a4813d1ca05d6816c1c7
SHA512 762af93c8799618ab5aef0f8781182f29d6358872c003b381f8faaa44da2762cce3c53de96fe58cecd933de9a8b55a649ba60b457e157c3c61e8b8bb0af4cb44
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnIsqjnhMgeiCl7G0nehbGZpbD:3a5POZ3BJt2pasx2+mCDmg27RnWGj
TLSH
T11D65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 53eeb04e4fb08f83b5a0d02a826a4ddb994f45e22268436ba19fce6db0a58b4c
MD5 c8cbdcb2139d0155bb003cb6cc799e93
SHA1 e5a68abf8adcfb5f90234cfe9340786a57cd77e1
SHA512 54a62b1c76cbe7da1d0710944400582840f2f5364a7d5ba74bf9c4a96b1eb2756450039ab28cc2f40bcab0cf6f57602bde4f9cc1af77ad4a47e22f0e88c4e113
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FkSsqjnhMgeiCl7G0nehbGZpbD:yNc/zEOVHFFDmg27RnWGj
TLSH
T1EF857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6cd189458c953a84f1f6eb1c93ccf512737e74d2416b810802d4941243f3616b
MD5 a5a54cac2deb52a122d440afdb2b22e9
SHA1 a3f36c42fd518bfca6f236cfaccc0f2b1d1e42c6
SHA512 489476e07fcdc2f2fd2c8468c7c37bc63e0fd994e37bb19a05d7c2363b58ae33a3b9ed7595768715417cad04cff0d39313a0c60ec83ceef44783fc3c45e97a27
SSDEEP 24576:/TkNvNnaFeYhJNtmZBmMsqjnhMgeiCl7G0nehbGZpbD:/TMwBtOm4Dmg27RnWGj
TLSH
T13255AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 fd1d9134be902dcaf45128e8dd58ee7661413899f3f100b3681f6fbed62fee4c
MD5 eabcbc87d4dfecf7d468825dbc94ef0f
SHA1 908fc1e856b1bc091f93e2d899709c4b7200a83e
SHA512 36b09dc8c6d7b21877f8d0bc2e8777d19fc8f9108c44f9b9b5bb26d83ddc2cbfaecd89d600d8ef2ac8a4ffb2a8a1ca5cd4d55d4567b6b0fab542c594ecbd418d
SSDEEP 12288:yHvUrBFrEjwaQ2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:yPUr+NQ2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD05F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4fe819eb6834159a4333f39e12fa00ade73527884317fc8f4c6cb97b6c7d2d21
MD5 d29ea2385954d92d6e23cece2d06a8b5
SHA1 bb430bb3ba57251d447b5e3406447d2f93ed45b4
SHA512 95ac5cbb037b1217dc290f04a1df37d403d37ec5048d66d48eb1b03ce904c0ff71b15cab6cd3058fb1c89e91ed54e64967928783661cd7f0f51be4e7accbce18
SSDEEP 24576:lD3FHshBIYQgA7sqjnhMgeiCl7G0nehbGZpbD:lDVHeBIAAvDmg27RnWGj
TLSH
T16E25E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/996-122-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/996-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/996-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/996-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1732-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1732-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1732-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1732-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2824-103-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2824-308-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2824-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2824-97-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2824-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2824-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3396-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3396-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3396-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3396-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3432-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/3432-8-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/3432-50-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/3432-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/3432-7-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4200-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4200-64-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4200-288-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4200-58-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4476-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4476-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4476-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4476-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4476-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4572-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4572-304-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4660-116-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4660-110-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4660-307-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4660-108-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4692-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4692-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4692-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4692-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4692-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5012-76-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5012-70-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5012-303-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5012-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5148-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5148-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5148-84-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5148-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5148-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5148-323-0x0000000000730000-0x0000000000790000-memory.dmp

Download