b67aba54cecb83eddea21d569b6f97cec4da72b32aa680ec9c0c1d529247751a

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260807-w23a2a1fqa
SHA256 b67aba54cecb83eddea21d569b6f97cec4da72b32aa680ec9c0c1d529247751a
MD5 7a7109b721a1169b347f875b4c1a4240
SHA1 4ef6fa51ea11ac8d14800903383a0184ccf3654f
SHA512 79d34c8e125367f6161d8c4ceae102351e9caf393f0344c3516a031ad9ab516e8e0267b25b34599985ed427a5e239e1b26a9b5bf1bafd3195dca8bfcc9fcacf2
SSDEEP 49152:U+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755/Y:5/PvOIjcXvvOOc5RiBSTZL+ld
TLSH
T1F2165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4204	elevation_service.exe
1588	elevation_service.exe
5748	maintenanceservice.exe
2936	OSE.EXE
2636	PerceptionSimulationService.exe
752	perfhost.exe
3000	ReFsDedupSvc.exe
1764	SensorDataService.exe
3764	ssh-agent.exe
1512	AgentService.exe
2952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b2519cca238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdf2243f9a26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6e5e53c9a26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006878137d9a26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c98fd07c9a26dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
1588	elevation_service.exe
1588	elevation_service.exe
1588	elevation_service.exe
1588	elevation_service.exe
1588	elevation_service.exe
1588	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5048	2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3000	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1512	AgentService.exe
Token: SeTakeOwnershipPrivilege	4204	elevation_service.exe
Token: 33	2952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeDebugPrivilege	4204	elevation_service.exe
Token: SeDebugPrivilege	1588	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 996	2952	SearchIndexer.exe	103
PID 2952 wrote to memory of 5900	2952	SearchIndexer.exe	104
PID 2952 wrote to memory of 2908	2952	SearchIndexer.exe	105
PID 2952 wrote to memory of 4652	2952	SearchIndexer.exe	106
PID 2952 wrote to memory of 3080	2952	SearchIndexer.exe	108
PID 2952 wrote to memory of 5892	2952	SearchIndexer.exe	109
PID 2952 wrote to memory of 2300	2952	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_7a7109b721a1169b347f875b4c1a4240_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 592b6d53208e03d163cc0d7f97afbce21fb3b43d2f0946a448c4f5783fb38731
MD5 3608b742e60cc3bea24d45a64fbe5b5a
SHA1 a9f3f8a3f0b850105e25923e3b52522e6e53f89f
SHA512 8fe1ee97d623c5281b6af8b5672745680c207b6bdfdc83b686e22be9303977612b637f56813faa3ee4200f5cc1bb81c0ad8f78dd3d820aecc0794ff1789437b2
SSDEEP 49152:xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnyiLlBUKubZrX+ld:33q6sjBLiBSTZL+ld
TLSH
T1A2D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 85210950326d8a88a45ac39006106718fb05c9616d8ecb45742e31c1227fb704
MD5 0dbd7ddf68afb4aecc2c7e6690f9b38e
SHA1 452751d5ff306f54bae96e90de6f2b775f4a4313
SHA512 273e1d937ce54e933c507ef434f74722b04e641d6d42295a70e4df627fc544df03f328b989cd707bf932de2f1dec0c8021e2f9f73a78dd1a5f7cd55e62341a65
SSDEEP 24576:KXYfDtczAnxVirnlBUKZ408vTZrX+lgdW:RtcAiLlBUKubZrX+ld
TLSH
T12865F11973D508F9EC6B827DC8A18501E6737C9247A0E79B03F09A661F336D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2e8329836618c6cf5391133254df50c456c6a902788bf95da7543cc450bc7a7c
MD5 4dc3d288edba7b9bab1b230dccc1f19b
SHA1 e6968aa37ea3783e4878a0a2d66f2da24df2a8a6
SHA512 4dad9eccf267eb2df34834252eadac59776590855d23d1327b52a3667e58609ad62f6d5db505f914206ed65c8c40fae16e6ece9a9bd9a0b00f48b45db78c1f4d
SSDEEP 24576:G0Le5ji0hmxxrMwxVirnlBUKZ408vTZrX+lgdW:GPji0AjZiLlBUKubZrX+ld
TLSH
T17E85AE16F6748735D073C0B9C5D2A68EE97230825B308ACB4296D77C3F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1504476c24b5d65ac953495359899a3048e15f71b96e7d151addbedac6ccaec5
MD5 f2c53c498a851584993ce887ecc9dc84
SHA1 e91755d4cd93118cabf84e82b0875093bd0f66f3
SHA512 e28ee71ce198225fa6ed473300984aaf499cd4c38e78581c466c35de35a1c6c5e29027cabe5ce0b1e56074badac52b827724d9f512947ba9c8813c755fd13229
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWn6q8wyu+xVirnlBUKZ408vTZrX+lgdW:m/ezSC6vUzPveHjy1iLlBUKubZrX+ld
TLSH
T19F756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 63b85c0a6b6675eefc5dc4f23e589aa999295c66b5a8850ef82061dd53e871b1
MD5 8fb0eba7a39f31c1b466baa6e62828d6
SHA1 c88ba78bff28461e551c62332456c7033d1916ef
SHA512 25d39bebe2faec4f9c9a3482c3ae986255ae61f2b01d2ce3c363dac8636047cebfa0f221c8f292deb795bc0dc9a37e9298fd430eda5089c417207b7fb6aad49a
SSDEEP 24576:iVbqPb88hv/l+YfxVirnlBUKZ408vTZrX+lgdW:iVO88hXl+giLlBUKubZrX+ld
TLSH
T126559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e3bb4c0bdca0fe68525813ea7bf10ae462b9159fb357642b808ced2b9e7a5c9e
MD5 84071aaaede286b3351f74167b7b3b19
SHA1 4ed1240b95104527f199b5ba1c96d0541a980a23
SHA512 da7c3c2207bc7d1cda614b0c5a8ba8f181837adb606d287c78c45a21117d304b0d3919ef029993021470804ac8f2ab959b2fd8fac447ff497f14cfb1a5349c56
SSDEEP 12288:SLcxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:SLcxVirnlBUKZ408vTZrX+lgdW
TLSH
T139452346214518B7F13F0BF1B0B49901F2EF3C97E8A9692763B237460D368E9F8166E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f980fd33be67f37fe4d7d7d95fbba66057fd02d45ab20bbf3dcddfefc0421ada
MD5 f6b319bcaccfb11b8f66b7b3bd86933e
SHA1 fcc23a29a64dab96e7d769e5ebeb02ac911b5e62
SHA512 94982e9b70dbe265daff89b7431db039969b3c134aec7a836b8a76aafab9dc52d8632400483835a368a23841097a340c20487e8274de463d8fd4056c71c55e7c
SSDEEP 12288:UeBNUbTVO86U3xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:UJIU3xVirnlBUKZ408vTZrX+lgdW
TLSH
T1C365D02BAE28FCE2C27E4DB856918600E7B278714F61A3CBD275830EDE235E45D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7b406c44e78ecb48335f7a9c2a9930e0bcc2b00fda6724631a04d099dc622b8e
MD5 1d5b13db743956559d38575a749633ad
SHA1 c179888c3942b61ce1d5744462d9839071a0ecf5
SHA512 2b0de11afd85154827618d49691f4d8f5755ca24dc4406ca46c38546f35a3436cbbb058aed0bbdad52e68e66166d286eff7f12828d61258f100e203b85c82a9e
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THw:eQvGAdlCEL8c/DRNw5CIiBSTZL+ld
TLSH
T1E5266C656BF880F5E0A7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 948246e2c264f5af68e119a6be7589c4b0ee67beb98ea1437952828478df94d9
MD5 4ce043722ee37ce63c6d3b5049f81f15
SHA1 7018c3a7746c5be2bbabbeca5e09f04b795e3cb1
SHA512 9bc15489f07440df4183add0ca8b37d0f0dfe73e4d5c612fce7722e498eafbc8094cbb60ee4cae53a9020af452c1b8ea9e8bdd25fdede6de3dcf831cc275f06e
SSDEEP 12288:bAwSfxL/2Dc3RDLLmt0LDQewsAjdxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:E0ewsAjdxVirnlBUKZ408vTZrX+lgdW
TLSH
T1E375E021FA75E436C27F0DB21B35C706647D79604BA12AC3E3F85E8E59302D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c16f4779ba54704eeb80afd849c5e42bc680633998346b3735497f03b1ca5477
MD5 14cc9189211cdd591f0512a2757c01e2
SHA1 91cf393a9ef00e93c8e154a63b987f646b951832
SHA512 733af8f0de735d7d1468cb01bcc9e6b5c7b6db1647fa8718650786fa5947d61194cb135e8091e80d6b7ca9df257f53b59aa8e65d2b97bb395a4e53e732ba3af1
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfZLud:8UEtQevvqc2W1cpV2tI321u
TLSH
T1DD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5ecb7ebcf0c2592734b19dd491eb1ef4a2605331f6d69b3e4362636737291ddd
MD5 09b9a90c43e3da9a45835b1e6295e2c1
SHA1 16bc17abc93bc02314d7291eab82c44cdd0df268
SHA512 76e6d3bfc57c7a441422e1d0c9d5198415cc9958cf5350700598e1e5e7bfd36f3fc79cdf5628cd6834352d1200ea291f08b0752abc14cb7c5fd5950cdb13ef9b
SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/zpiLlBUKubZrX+ld:BoquVjnmUiBSTZL+ld
TLSH
T183D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 811b57ae58aff0263318adb0092c91dd824020c0a3bc6933bde65dd01eb774be
MD5 afa8c768f6159b37be1c4597297c6fb9
SHA1 51851c631a40629ac051b0577def636dbb03edb3
SHA512 829ad6f682266b9a80ac0d50b9c48136a28fab23029cf3cb63a188968aa7f574be1a65b3fea4e509d6269e14e93280a8f5a109b99d3b066f386adcc29e472804
SSDEEP 24576:hAhGL3IFoiwtA5l7S53SxVirnlBUKZ408vTZrX+lgdW:hAMUFoiq5EiLlBUKubZrX+ld
TLSH
T18035AE81E7F955D4F5B3AAB899B58570EA76BCA65E31C20F2260D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8dd248d8f1ff3d873197f76e514c424e3ef64406e9a6352b8fd6f5796a5e2ffe
MD5 534c3c55b1353bbe3dd4fe05f45e0e6f
SHA1 020e10e9bb3e37649da06d1abf96d65952e91201
SHA512 d31bdfca7f379dcc87fdd08ac5602d755aeef9f175d4fb222c84e5c1f86b2caf3c78bb36b60b499ce888192b498c714536fa1de609818da3d95eaea0c534b07e
SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+CWxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:4wu4OWBxVirnlBUKZ408vTZrX+lgdW
TLSH
T1BC65F14A32A50CF9E57782398597C536F7F2BC022A25DB1F1370C65B5F33261AD2AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 229e0b0766bd32e47ad1cc14ab73ed09f7ec848a8be91afffd3fd09f3211eeca
MD5 870817d8ed1492eae52f4bd1c9dc9616
SHA1 edaf1ef190510486917d3a8022b2a97f0efba8cc
SHA512 8f61d02d3cac35ed2ba18cc70632edbf9cb41fe9b709569518abc065f644ec4f94e1b7d13409d07354e1e401503313874b93eb6135b97070946f1f19f4656709
SSDEEP 12288:9eZ1IyNxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:4ZuIxVirnlBUKZ408vTZrX+lgdW
TLSH
T17455128A32D420FAE17B42B9D8F04A05E3B63893677653CF237112561F33AD66D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3e94b4298d9150abb152572e7fc26199a4986131d33ed874bf2e597fe65f95e1
MD5 61f6ebb8d0178257d71407aeb058f6a3
SHA1 3826d0f4ca78570afd06058e7852f43374b1833a
SHA512 0462963964adfb2b978d56bc5b28b5d1484f52b8da1c59bd21c6483058e4f8b2007efc7f1a441ae9a7fd9856f9546d7f944338b4582aa403dbe02d80f603a917
SSDEEP 98304:pQRQyi36YOcPbLvw2gAf+PN3jiBSTZL+ld:AQyiKa/X+PN9ZLud
TLSH
T135667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d6fb71bfe620e9efbcbb74a6a3767104ba29db395a7be52bc5105106d10fca7f
MD5 2e3cc21ac2913d2d8767e0461637ce84
SHA1 97fa244bc17ebc3ddc8acfea45de1f24e6380170
SHA512 b58421291bca1ba9792529af1299a2e917c3fc371ff771c2bc4f296688c89f0e1be47c54621c8d0d163dc15f060968b9a0064296baad1bb2ccdfd863bf8c664a
SSDEEP 98304:1QRQyi36YOcPbLvw2gAf+PN3jiBSTZL+ld:MQyiKa/X+PN9ZLud
TLSH
T1EB667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fa520734979f9d4621cda040fff4724b838afc7261f959e67aab12ef5c847490
MD5 58756be41322d9df4559fde2792bda9b
SHA1 a46030072ca1097055d21638d2774b151dc7f084
SHA512 44d9c03155578b6814f5b977602d3ab42e636c3c62aef303ecb8e64358dcf419cb1dbd17d27d2af643374040f1ace2def8e42afb088206e19b1f1e8feefeee06
SSDEEP 49152:L68Qg55nhceWu7PNU3/ZiLlBUKubZrX+ld:VthLRc/ZiBSTZL+ld
TLSH
T162B54A33B2F600A9C05DE1769F4A872196D27C758FE1E3DB815172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 417b6bf62ab061f669264d98bdb88e6fa7ba51af3fd35238e0f0cc145040101e
MD5 a3fde8f7aeed0ab5005f170b9a8bdd2b
SHA1 3d4d39c388d1b0017cadf678d5cc21fdf83c753e
SHA512 2910d29ab983d3842b8d6b07bfbf78a37be074e3752697761d00a32626e1f99cfed868fcde7c54e53ad346f469350d1e474a52656212fee9b23887593cb32e0e
SSDEEP 98304:Sy5112gYy5azzVvt69nLKnhZSiBSTZL+ld:bLIHEWhYZLud
TLSH
T1F4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c31deb2b2b32fd0cf301b4c683b72ae2786fe54af69c4943e29d15394fa825df
MD5 de694691f91c4c9c8bda03938105f681
SHA1 7b3e87078991fb5bfed5702fbb7915cb537c9212
SHA512 788def877eae0bd86186ddc2b251ff21799643ec330b959765d083a025a8617e88102a86610343cea961936e086aa7ab632fd63555a1f2e3273a4259cfe28333
SSDEEP 49152:xB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glXiLlBUKubZrX+ld:nu6Jmdxd2dXiBSTZL+ld
TLSH
T1A0D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a8be7dd793138e74fdb974745cb243f76089b27fe01dab4a1cfbee3cf2faefed
MD5 ee313b191597ce202b2cc4190f88103f
SHA1 39be1f3da7e2252784d426c4cfd149724bf64f60
SHA512 5ecf4184b8ba032ba6cbff25012a197c3a0372a625f055c699ee78c75173f4157096959fa5d386f0ae060f114a2cd12c5790538ba862a0b88254f311552b0dd7
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xXiLlBUKubZrX+ld:smifPWRUiBSTZL+ld
TLSH
T102B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e3589a9d05da9c1fe31eb7cb1b8c8c7fe7d4e361367b2db52b5dc6e228bfc2cc
MD5 aff72d18093d1eed2b02531a8c0d02c7
SHA1 e2ad424e5921f73e933f7a62b11f643534bad9f1
SHA512 820a7243f58a2d8140a5da2f3f82c39c56f3e8c73ee088043f25c33686d2f7393c635fbe8485fe123408d018a778879a088f25ba9697cc7d3b1290caa0a9dd47
SSDEEP 49152:bSuZQIY0Be2KcRVtOnks6NMHqGiLlBUKubZrX+ld:J5dKii61GiBSTZL+ld
TLSH
T130C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 898ae74cb2376d6ec0beef561d0ceb520d05edc4d2d97fa590cb16d4ad7d79b0
MD5 84af1f970b7ef13662190ba14f115027
SHA1 9b532e947f57ef027e9762a0545ca0ef27ab8eb2
SHA512 0918be7d91e634a6c2a3c3b4faa4ea4ec9002a1d063b63334f6223eb0dc11c1a8c30a2be3e2a322de7970cf9a094313a8b757c8cd64c71b67f59a7483e0aa3fb
SSDEEP 49152:hhtSn8EApI0fig3giDn0AP5wLiLlBUKubZrX+ld:wX2imphQiBSTZL+ld
TLSH
T19F95BE03F2D900E8D06ED174C7568632EA62BC160B35AAEF0A9077561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 08fa780c0754b941fdcf5bcd567b9eb62c94f18520f2b5518353bad09e1a8906
MD5 f74635e8438533c42644060f57a3bf8c
SHA1 165bcd259d766791343c4753ed27dc5d6fa9dae6
SHA512 ecdbda8dec987da57ee7d67c39d7e2b90351dd37923f362d2bd0f42aafdd2cb4bbef906fe19a2fa612227773219f4b1e757f95e319d7a65b082d2ca46819c7b7
SSDEEP 12288:YUxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:YUxVirnlBUKZ408vTZrX+lgdW
TLSH
T17D452346318608A7F03E4BF1E0B45905F2EF3C97F8A6656773B232015E72DE97816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 318d1e237dee817791679cf72dd7d252fa6d084dcc82ba1ddbbd92a798f42849
MD5 62150fa704b0172921ca91a8fb44f965
SHA1 1a13710a3884d63c732fbb93fe85f6281521c834
SHA512 6cacc607f6db9e6a5577a817185a6f83ee69d459e36fb73610789536fd4e69772f9e43515db73b0ee7cf0d9087e5cf0a20b4e648641890de1e5a139039062840
SSDEEP 12288:95xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:95xVirnlBUKZ408vTZrX+lgdW
TLSH
T17845234631860867F03E4BF1A0B45505F2EF3C97F866656773B232421E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3ebac5606b8abc17c3d6eeae04ab349cd6e381be921a64bce8d21cd7dd083a74
MD5 8b2d1d26787449d215b1a97dd4c70c0e
SHA1 67e3ace406573f54dda2226614a13562cda38d08
SHA512 a6e71b3e1311b716e451158743ecdc490119f85f0fe2401e6c29d06d1834321736c17757ce12a9813c5b11b1b3ad5eea45adf45676cf10acf05c4244745ab732
SSDEEP 12288:AvxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:AvxVirnlBUKZ408vTZrX+lgdW
TLSH
T1CA452346318608A7F03E4BF1A0B45905F2EF3C97F8A6656773B232411E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4ace0c8ac5426868be125c5821c6929ac9f1a533af5629b36d545dac87ed25f4
MD5 7aa3278330f3902f4c65ba4bc79779e8
SHA1 f1d8b78e27712bba192ec05ad3000d75c0fd54d7
SHA512 1d9acc6c2dbf20436f7477d8e6f7b80843b2e28dc1a7ec7354a5ff5fa024a54189ffafc988eb2c5f9e62bb4b897f5f14b11dfd74c15d416a86d3d0b33b674dd1
SSDEEP 12288:DVyxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:QxVirnlBUKZ408vTZrX+lgdW
TLSH
T170452346329604E7E03A87F5D0B08501F3FB7C97E876666F637126460E72AE87835FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ea660ee4f47283a09b9bd33de5fccb1edef1409273f839d38afe752cc08905ad
MD5 5aaadf8688ea6f988dec3cb6334f6bf7
SHA1 2db12ec3ca63e668dc628f9cbc1789a7c0271d2b
SHA512 be9312239a8b4904448ae8ae1b2c4395991785b769df3771c2e228ce3b64a0dba6d6cb477f58fbbe8da9b819698c99f5836836c13615f7db493904a15ee9a309
SSDEEP 12288:qaxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:qaxVirnlBUKZ408vTZrX+lgdW
TLSH
T1CD452346318608A7F03E4BF1A0B45905F2EF3C97F8A6656773B232411E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 61b35732ce08e780ff2d29dad3c2ec697c1eef9c21220df275e26962fe667e7d
MD5 d999e4274d8fc238fbb78c7359b86283
SHA1 dc4cdfa3081d2d4f4aa08033b1880792e7316969
SHA512 283ed424049b167820ab92a5c71e91f68498704a66281b0358b0f206819d0dbea559e94178a987c5fa4a69f5072ca05fcb0531acc0d10942386f8714c1a3b0f3
SSDEEP 12288:DVxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:DVxVirnlBUKZ408vTZrX+lgdW
TLSH
T17445234631860867F03E4BF1A0B45905F2EF3C97F8A6656773B232421E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1bcf6e96076d536b1064be53eaf79df2ab7fea236c0c4140fdb77beaf4563214
MD5 9ad259d4fe14e3f8e1113071579c49db
SHA1 689a3d88074762e2e04047faf60bbe6fe6617615
SHA512 d8b102ea10e7efa16806b61531aa4fcb6fc217eb4a6ef572e674a2bdc037066fb03542b7f9f50a219231a1c41a9847d8d0469279991f155ea9d24ddc710762ac
SSDEEP 12288:LBxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:LBxVirnlBUKZ408vTZrX+lgdW
TLSH
T13445234A31860867F03E47F1E0B45905F2EF3C97F8A6656773B222421E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d9705b2ec6fa3e7404ed3cacfbd3a46665f6e0cd5cbf3314f97fe32d2e2125df
MD5 b4e32b547317cd6e45ccc701ef2ae3bd
SHA1 5a746f38e0686493d780ad4f61a53bd8746330a6
SHA512 d6d51b70a9f06a74a06d0c19129976cb31ca6505f72d06084d69d9c32e431461e2f9ad558506eed7eecd376f89df627aa1f5ac95a338c12371189feafd9bd336
SSDEEP 24576:NZMRzFVSOZxVirnlBUKZ408vTZrX+lgdW:NZMRzfxiLlBUKubZrX+ld
TLSH
T1B465F185739018F9EC77827EC8658906E2B27C5A5A70C61F13B436671F337A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5dae62448ba6dbc7f155da0605d58b7f21e83b3a419ff66c3dda5bae11acc233
MD5 74cc1a4670a73d95a8d2f1db6e26f105
SHA1 ac3903de259f2acf2aea8f3190eaefd4821b14aa
SHA512 1d37097662201e2565825da2a55652bca9e78bc7abd5fc1a65a304f32085f88cae97f095fadd195d13fa423d8bd6c7541b77fe41184fedcde1ee6a86fc6e72c1
SSDEEP 12288:D4xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:D4xVirnlBUKZ408vTZrX+lgdW
TLSH
T12745234A31860867F03E4BF5A0B45905F2EF3C97F8A6656773B232411E72CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 68afb02ae386cb8ebaefa1c6df4776b941cdb5e9bf6ff19e1fbe60e9f6ff1b6c
MD5 4f9e45034ebdc58e07842168bdbab7b9
SHA1 5b256582312c3d5ab31a47bfb4423ddd148b68aa
SHA512 73eee6cfe8b9495bbb59f3a4b36946fb3e3e5dff1350de6f6f0bb22ed83608fb07c3d2f8dbf05b2f53630aece1de3cf41cb22426d8bb8dd415b5e51a5a169f58
SSDEEP 12288:7MxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:7MxVirnlBUKZ408vTZrX+lgdW
TLSH
T10445234A318608A7F03E47F1A0B45905F2EE3C97F8A6656773B237411E72CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 63a5a4054d729f01bdc457b8b8c78bb7db2a0b909d99e706d953091d28121f7b
MD5 f36067b8a1c6d784a499dab0f55f6229
SHA1 b821abe869cb065146ec3f6b0e976993036739cc
SHA512 c4a17b5709d6dd0bc5400535eb89ce68d51a7e06ca903df005935d01335674e48477420165344a2ce925bdf6f4c1154af715c9bec52cd7049acac127910fc3a9
SSDEEP 12288:ByPz5L8NxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:QzyNxVirnlBUKZ408vTZrX+lgdW
TLSH
T1DC550247329120F9E13A8275C8A11A01F3B67C775B649AAF13B017761F336E5AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f720e6571d0683235168e321b27429dbd1d56342a04abceec7b0e08f3a611865
MD5 ca359b22ed618e021dc643e2454f3a0b
SHA1 d23d380a93f1f8fc8c2aa7bc4fa9d8d0b13275f1
SHA512 a5a2e7be2c395e73dc7a47919ecf36a43d346e43c7cb567985e98443e99aedfce80079ec237d80f91de71d5cbbdfff0defe7233f45a5dabc57d1cd598cadec78
SSDEEP 12288:64xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:64xVirnlBUKZ408vTZrX+lgdW
TLSH
T16945234A31860867F03E4BF5A0B45905F2EF3C97F8A6656773B232411E72CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bb1fde01cfb5a44c328a9b632d014081d02d118942e6a6eda6cad20f506af4fe
MD5 cbb97461986ce8b80fa78a0224dbb91e
SHA1 70ee3b9f3a6ac48d44c3bb7b81023e5d2c7cb54f
SHA512 01b1c6a59e5ee1a3cdfd6f2ba66389247a15c1adc9e70d64292c9a23c2bce9db7d542d5d0a8c4602e50e92980720fe24c0083c845393983a5a736b6f4b217a55
SSDEEP 12288:b4xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:b4xVirnlBUKZ408vTZrX+lgdW
TLSH
T1EA45234A31860867F03E4BF5A0B45905F2EF3C97F8A6656773B232411E72CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 55d047ddd13386a3494d07235a56d38151ec168d9c27f6486be2df8f6bc64483
MD5 3d0aa2080c4f8ed57dfb8959ea83cffb
SHA1 1c9f60630c82f9f9591dcc45ec5379fd3012b262
SHA512 16f32235458d2881603988364ecb673050c7e8a8e6b76b3de282822cef52b409080335e69ddb9577523dc751ccc4063587080011901d7080fb7621f9c2d45dc4
SSDEEP 12288:/yPz5L8NxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:yzyNxVirnlBUKZ408vTZrX+lgdW
TLSH
T188550247329120F9E13A8275C8A11A01F3B67C775B649AAF13B017761F336E5AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 cdda28a4fbfa188ce9862a4ae14ed3211f075e1f5dc44a18ad27b70ad0ea0400
MD5 5820478fffe29a207ba68409a00174fe
SHA1 b1b32fa857faebdf168cbeea86a16f5af06c65cd
SHA512 8d2b32897cd2d8866e092e19844d45e0ee1b4483ef28d1067f638055363c015c545a7c825b99f51ae73ec8012153e77768b7b8bae48364013159afed6da534e5
SSDEEP 24576:8TDaLl3z0zD/xVirnlBUKZ408vTZrX+lgdW:8TuLljYiLlBUKubZrX+ld
TLSH
T16065F185739018F9EC77827EC8658906E2F27C5A4A70CA1F13B436575F337A11C2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 70417119058ec3b52b6268d664aef600d0052d51dbe5fdfe491233734af6d340
MD5 eed433a676a7bbec3057f9b15271fea5
SHA1 7531e43ca428b49cae324d647d8a04c9bdb75dab
SHA512 60865c42f33527cc840d1aeb371edd2f3b7cd72eac113a674db43fa004dc23a6047b4b09e73d75928f08f2d0970bc7e3c897deed86fce367940b7b5f91f745b0
SSDEEP 24576:F3vd9CHKy7GZ7xVirnlBUKZ408vTZrX+lgdW:lvd9CHKyaxiLlBUKubZrX+ld
TLSH
T12F75CF80F3E414E9F0B79A75C9764501DAB67C9A5B31DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b82ee1665afc146c15d44e23b958959ee5eca26cc6d208664f964e0e36fcaf2b
MD5 e80b5ada9fe70e1aa1532525a67252bd
SHA1 890ac8121daed4ca9c20516626d4d137741486f1
SHA512 8f030bf234d97ba06bb886e0b9409122e20355555e608f546f3913ac9940994806b6e43188af4081b86e1ccdab96ca70bd3b858b8263acd194444a8cd11bc2cf
SSDEEP 12288:FPxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:FPxVirnlBUKZ408vTZrX+lgdW
TLSH
T1E5452346318608A7F03E4BF1A0B45905F2EF3C97F8A6656773B232411E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 00551a6f49b1a68012358462fa9b297b50373681f3d965d905ce96c363b1fcf4
MD5 9b71b76dd3817933315bcfd3b46364b5
SHA1 96827fae43274bde60f8d7a1ef53c636ecff5395
SHA512 bc7ca7da26da101f234f6bf61575608e7aba831ea7f3779b23c3ee4c1a6d36d07c7070b81e7d8943e40e7dfdecdbeb5eb8fdaa7c7d37c60cadc7cf499321a50a
SSDEEP 12288:NtxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:NtxVirnlBUKZ408vTZrX+lgdW
TLSH
T1BD452346318608B7F03E47F1A0B45905F2EE3C97F8A6656773B236021E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6b52652767791f3404d1581e96bd6cf1c5bce4df43c8b74f69c57530cd6d9d0b
MD5 a66bdadaafe00e6fad7bdac2044efbc1
SHA1 2f9170a4f59711fa1aee06212d3739de48aec73b
SHA512 6565604be31424f4588704f41ae8db93954610f1fabf7180ab2b7922edf9c5972d9f8a38fbec2d31f2eabea4dea612e12f15e88b8b05d9c684434196f94485ad
SSDEEP 12288:cmxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:cmxVirnlBUKZ408vTZrX+lgdW
TLSH
T17845238631860867F03E4BF5A0B45905F6EF3C97F8A6656773B232011E72CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f4965aa5aa46d3273b98d133b0cb60f1e1a90a487b0e141cd017d1b2f8b4a438
MD5 674867d14390dd305fbf6c6b1e67fc94
SHA1 a86280d15e16abe6f469eedd9c498fc112af3876
SHA512 c7760057819a25292b4d88b40d1c8e0919e94a38371f45ff4940ac8102a5dbac34943594ee8b4ff9f7e0722b5c8ec60f3aa0e3346fb0dbb8be1dcedb81827b56
SSDEEP 12288:y4xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:y4xVirnlBUKZ408vTZrX+lgdW
TLSH
T16045234A31860867F03E4BF5A0B45905F2EF3C97F8A6656773B232011E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8e7b0c9c58c762a19c9acbdce858dac7cb2ffae8b75ae09dc63a6fe311ed6ed0
MD5 4c94cb6c9def3d93b98e612c157e2765
SHA1 b1080a8fd24729f03dff7375149e8e5abbc09c42
SHA512 17389bfab3e7a474d10bcc970adf80e235f548491f71e369ccdefedf9ec8dc7fd2cbe618d4bb87b1f1b99f2edc28b70ce902d8df434d04694fc8eaa5e1c82110
SSDEEP 12288:OPxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:OPxVirnlBUKZ408vTZrX+lgdW
TLSH
T122452346318608A7F03E4BF1A0B45905F2EF3C97F8A6656773B232011E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7d92058e6cad2701d1ed537052056b947e35429e8c709513eea615527d3c26ca
MD5 d360a61b125d0d31943dea03256e09a4
SHA1 cc3242b613146701f39d9b6e6949a73f727a0c48
SHA512 d8b01208c57408d49ad3eeb72de8285a0ca8728fea141f3715deac5d56447a1ea1478cd52d8775aea8fb7c92d64e27df94b05ecf6bac6cb02afba7c24f827102
SSDEEP 12288:aAxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:aAxVirnlBUKZ408vTZrX+lgdW
TLSH
T189452346318608A7F03E4BF1A0B45905F6EE3C97F8A6656773B233011E728ED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5c0d6dc431ba759d62e7d145bfcc267010fed72c249e7002ae1ceea86fdf8ca2
MD5 b967d53fd27b5f8b36b696f01464e838
SHA1 9a06c992904fbccdee1aa6b2e2a25a19dfda91b2
SHA512 476147a3b6d0fc923ab64884cb8d8e99714d2fe998c771d3464219a883913b66a76adcf577d214c2f008de8af5310d4f4925feb7fb51ea64c76bd97e1d7aa9eb
SSDEEP 12288:paxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:paxVirnlBUKZ408vTZrX+lgdW
TLSH
T16745238631860867F03E4BF1A0B45905F6EF3C97F8A6656773B232011E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 529782040b5f6ab787f5a37394a9ab3b03d19ecc94e4337dcb07bc9966f356b8
MD5 f0cb1e89d53e886bb6e37a9030c236ab
SHA1 539d3e77b886167c87608253385cfce58ed166e4
SHA512 9dd0b9c012ba534780154afe21dc1614fc6725d5dadc9c6b5221d844ff83806b79845846c371fb6d24518ba8c744e0609b35a9aff7ae671943e12677be479962
SSDEEP 24576:HfwvUk9RX6wkyAIgxVirnlBUKZ408vTZrX+lgdW:VMnYIeiLlBUKubZrX+ld
TLSH
T1CD85D029EBDC04E5E177927C99B3460AF2B178691B31C6CF12A6536D0E33ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 823b120f420a11cea7d2007f420be4f513df189de0f24fffe6f42aba750b4535
MD5 f261b95527a7adb8c6231287dc0e98db
SHA1 2268a3854c646f3abc10bc2d5831cad2a1223762
SHA512 8607e88701296c0d8fecb2aec9f603714c9ee4d75957bd71cfabc3ba73e49ad1b9cbf35393247660235beee8d38bbe06462d240e4240007779f13f5ba8426515
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0riLlBUKubZrXw:tySzPDiBSTZL+ld
TLSH
T13B066C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 629d35139b6b1437e639b54760e441d2589a29d902f34e395b538215d4f073b5
MD5 5659206c35e8f4ce3983ef6b4125be3d
SHA1 02e5a2fd8bfa3915ca917d925af3673eb108c777
SHA512 7a39d5e76e56f0027ec13200f5ff1b74fce9f629854e5ba2603c7bc92418dfbfccf85073e201d3c25ac3487dbfc7bfcfa2bc8159bb5c52fbead0e1a67e89f0e1
SSDEEP 24576:M47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYJxVirnlBUKZ408vTZrX+lgdW:M47JUQjTirIhCnDHUPfF/biLlBUKubZs
TLSH
T1AA65AE1EA3EC01E5E1BA927885154A1AEA71782E5F31CACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e9049993dbf7ff2230eb5d97ea25926904a84c5b72bdeb543d690e79fac577b0
MD5 5c2b0f3ae78a9bd02ea4762cc057a9ce
SHA1 3e90fe9c50892a86976b6346292e1b7d77aeaac7
SHA512 de62ef8572fc9413f7d3c7002b5451cdd522813d628e915ce6b5657614f6de1257231be02d25daa137c2796d7d3a7bd08bf270645b9cf8328df70259da2f0bf1
SSDEEP 12288:UbsfIxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:LIxVirnlBUKZ408vTZrX+lgdW
TLSH
T1A555F00AE28801E9D06E52B5C7554A00F3773C6696E193CB63E0F53E0F366D4ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7f4bcc382a8896c3c923e51e59c86a63c950686e85333e18a3e21157331ffe36
MD5 4439e35a70bc348577fa3e79d594b043
SHA1 eefbada2c05cf3c9b7a8ae80d6dda6a1ac7458e1
SHA512 d9e9d411fefa90c3f4a4929bc509ccfd75535b9169d545cbdac62c46a4ad8033a34edfd585203462482bfe481a63da8b06427818bae3083aea9d9c6af6baa075
SSDEEP 6144:psBC2na2jmwqrER+fKDexH6W4By5OAajIdmCQUikbIOL+iwy1/at6re+N21O:+jzICy5WUooikXL+i+t6re+N2I
TLSH
T14E351851762AC75FC6A940325E33D1CCAB707D41EE05AB0772C88B3FC576668BAF2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7abdb7cfe62a66ac3b869fd44cdf14fe7dcf1163168ed40aabbb747e6759ef7e
MD5 eee329c0479c359d1f1b9b191ed488e8
SHA1 071943bcc24e1cf407c5097dd5cb4c67b08c6b59
SHA512 69621ae61efdf4ebc2024fb5c3c7ad7d20884c36b0fce35dc25ce1bfd5795ac27dfa0f243955f376600183d665ee8dbeba1ef3b92a546487da4102abaa01ce9c
SSDEEP 6144:2pFulEN0lhdwIbdwIedwI2zhAmGcvrKDexHaTBlS7YJRuU4IrKDexH+V4ock5aCR:c0l7r4O9vkTBlS7YJRuUtAVQNeHaVHI
TLSH
T1E865E7416137E38FD0F76032473A9B4CEB74AC4277096F2663C8453AD86A766B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 11cdc886ce258756bd031758dba1ec243f5f8be6b4a051d0356dd72e87f04c26
MD5 cf7bec5a498dc9f2a95f55890c03b3bd
SHA1 f206fc7a9262487d87f3b556af17b67b19448a11
SHA512 93291f521da100532e89c447972bcc1f0f87fc7323a2383969afeee3a7df102aa7e5ce103efcbefc9a4937d3d84635e65071578340ef2f88558d6c50dff5dbce
SSDEEP 12288:V07kxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:+kxVirnlBUKZ408vTZrX+lgdW
TLSH
T18E45234622891C67F03E57F0A0B88510F2AF7CA7EE55A4E7B37123451D32CD9AC36BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8e3d70524c62bf0b951d37e8d576cc0f634c02a26e448967e6a8820fb75162d0
MD5 f35a3251af5ae022b368053a80260197
SHA1 7027e683cb6454f272db73edee2f1058ddf181c2
SHA512 d8a7c3bccc6c157d6022ec86cfa6eaa5e7a17e255442a22b5a96a7a51c802bac6b6360e0cc1277b0a223d73f1e0c56e1e4b44f800ac8ffdd4d03c3785ec18613
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bY2xVirnlBUKZ408vTZrX+lgdW:Dgb4mBIBhGFtiLlBUKubZrX+ld
TLSH
T10365AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e753086bbb850aea26272d11a827b1a38fabe6329c369e36808b50d01d194790
MD5 b73502016079628b0ac16d3630f2ab92
SHA1 bd42e52e694451766c7765cfb0624f4da155ff38
SHA512 1912161cf9678014148fda09f3e51cac619677765384f1d2b8e7c43a9cf59f3f648b5440f6d611b536067c9b1cdc3f8062559f0f2615d302168c6b54d162751f
SSDEEP 24576:uG88u8FpJqH1bzria7/m5xVirnlBUKZ408vTZrX+lgdW:l7ZFPqVea7/oiLlBUKubZrX+ld
TLSH
T17485F15572E101F1D07BD13889964663F6B2B8261364EFDF07A88B511F33AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a7ae25e6689a4faf33377c1e12a94f0e1186c80665fbd285cdcbad4646073eb1
MD5 1f26f28386e411b3b05e77c9a6ef1971
SHA1 421c570f0cc9ac3d9d00f2d67d9f7e5d67f74cdf
SHA512 5fd772ea1acec1b47cc0c2394b6fda68eeaf0048d06954232bfa239a36340985646d53e43ce2a8e5e8ce6841a416c8074d6611805ce82e70596570f242487974
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRiLlBUKubZrX+ld:YG05lO43b2iBSTZL+ld
TLSH
T171D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ef7ba0f020b6f4002d95031ee204966a5275c118fc23fb775ef6eece3118f2b1
MD5 dd20ed5556d16f6c57a22401082ea10d
SHA1 c97c8eee90afbd256471184a16146d9b9446e119
SHA512 1d188674424e173672e47afa26ca0e781ec19ccd4805d4b7ae85534b9700de9db85d8cfdb8491bc0f46d08f3096127bd1a2c1800810cc733b3e36d3f65cf50eb
SSDEEP 24576:7fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnjxVirnlBUKZ408vTZrX+lgdW:ja5POZ3BJt2pasx2+mZiLlBUKubZrX+v
TLSH
T1C965AF4EA6FC01D5E179D17DC583861AF5B1342653329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60bc11055d8865b8ce9f2dcda62b8f524df24e0d61d35bd2af7e2d5ebd02c7a5
MD5 242d3384a8178036bd6bdd8f24272ab1
SHA1 329dc8983109c9881593d7236a25895cac43d038
SHA512 be758cf287b3c1a5f4356e0e2778c6d6b63fdc7b3a3935029b7b9fd47936bf13695017faad302c991f82e487cb0f39f6ce18eaef9bcdbdc352c78877edf35045
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FkhxVirnlBUKZ408vTZrX+lgdW:XNc/zEOVHFIiLlBUKubZrX+ld
TLSH
T180858C1623E901E4F1BBE1BE89779546FAB1786557308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 12b345103943ebbc151de5a54d129cff2104be74e5694171b6512bc0b70440b4
MD5 c30f74b360d9336dfb9552b36cb0a13f
SHA1 8031b68d65874edf266a0586832b0858402c1870
SHA512 892bdf6b7f3e612f7315b9c21377673116ab684644706859cde350731880395481f18ac954a50f2bc11edf8c4442de64ef8323fced576d204bced5be172014f9
SSDEEP 24576:tTkNvNnaFeYhJNtmZBmLxVirnlBUKZ408vTZrX+lgdW:tTMwBtOmTiLlBUKubZrX+ld
TLSH
T1B355AF6EB6B805E4E1FEC6B5CD238512F6727861173292CB5390C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 953dec2442e809a67afb9c55e36faafaecfdbcf51da03912ba6c0c646b24d63c
MD5 e8b623809216e1cf8b6a577e4c38f726
SHA1 a8bc3b139180f700b8538f6ba97d775a7b10b0f9
SHA512 e0dc4d4d63bb60e3ca8b97770fd2d18c531e7f9c31dc6a399e3ae420b0ec74a13ea21e5ca085ee3ea64c1b3c5dd8d2ad59280577727a385e0180074477267438
SSDEEP 12288:eHvUrBFrEjwaQ1xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:ePUr+NQ1xVirnlBUKZ408vTZrX+lgdW
TLSH
T10865E11F22991CE5E67AA17D85928609F7727862171292DF03E1417E4F73DE8BC3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 061a34abac34ab94a648302a84c1a6294bf8a64c455cb04653341860b4f4edf0
MD5 4fb8c98d28e509a25b370b4c656b9415
SHA1 b4426eb5851ff3064c059d442b2c5179c7491a09
SHA512 9681adf26881ff22e85999192e4d5bd9f6d84771f5b527425c3e62adf3d8a637a1201ebfd146a28b8fd1ad9cca84396c3b5268b0c262de3c195d7eda1dd2d712
SSDEEP 24576:0D3FHshBIYQgAIxVirnlBUKZ408vTZrX+lgdW:0DVHeBIAAGiLlBUKubZrX+ld
TLSH
T17C75E16EE69C04E4E47BC1BCD6638906F7B138A9032265DB12D081B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/752-296-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1512-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1512-137-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1512-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1512-131-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1512-125-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1588-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1588-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1588-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1588-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1588-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1764-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1764-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1764-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1764-313-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1764-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2636-282-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2636-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2636-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2636-69-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2908-327-0x000001999C4B0000-0x000001999C68B000-memory.dmp

Download

memory/2936-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2936-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2936-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2936-271-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2952-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2952-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2952-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3000-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3000-328-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3000-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3000-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3000-84-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3000-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3764-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3764-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3764-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4204-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4204-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4204-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4204-14-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4204-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-9-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5048-0-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5048-66-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5048-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5748-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5748-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5748-47-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5748-51-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5748-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5748-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download