71afc59e6c8307c02eb75b844034a8f090ca0a5e3083b91ff3f241878fe81cf5

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Size 12.3MB
Sample260808-qlaces1ybz
SHA256 71afc59e6c8307c02eb75b844034a8f090ca0a5e3083b91ff3f241878fe81cf5
MD5 f77798f13934e2d8697e77cabf2801a9
SHA1 dc9103a37d10bf7aa8893c0c1ba6eb31c4741cf2
SHA512 f200ef005aea5355bd6ddedff9eea1d2fee8ca8f8cb48fb57b8f467914f36af51ee514bea0ce7bfcc84cf7aa88d48b7f22418d3a0b3542ba3c1b1f6e751ad702
SSDEEP 196608:dhr1I2Wcqcjj7UlG8drCeqBvKCzcLdnW9:dhr1tqcP7UlZdrWlDzcLd
TLSH
T1B7D65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4768	elevation_service.exe
3112	elevation_service.exe
4696	maintenanceservice.exe
2612	OSE.EXE
4652	PerceptionSimulationService.exe
2780	perfhost.exe
396	ReFsDedupSvc.exe
4760	SensorDataService.exe
1204	ssh-agent.exe
5344	AgentService.exe
5336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\246b027ce05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\ExportRequest.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000364528be3827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004930b4be3827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f207f1fd3827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d3516fe3827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa4186be3827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc6024c03827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000634d8bbe3827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
3112	elevation_service.exe
3112	elevation_service.exe
3112	elevation_service.exe
3112	elevation_service.exe
3112	elevation_service.exe
3112	elevation_service.exe
3112	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4448	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	4768	elevation_service.exe
Token: SeBackupPrivilege	396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	396	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5344	AgentService.exe
Token: SeBackupPrivilege	396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	396	ReFsDedupSvc.exe
Token: 33	5336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5336	SearchIndexer.exe
Token: SeDebugPrivilege	4768	elevation_service.exe
Token: SeDebugPrivilege	3112	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4448	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4448	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5996	4448	2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe	88
PID 5336 wrote to memory of 3784	5336	SearchIndexer.exe	101
PID 5336 wrote to memory of 5208	5336	SearchIndexer.exe	102
PID 5336 wrote to memory of 3244	5336	SearchIndexer.exe	103
PID 5336 wrote to memory of 5904	5336	SearchIndexer.exe	104
PID 5336 wrote to memory of 3664	5336	SearchIndexer.exe	106
PID 5336 wrote to memory of 1064	5336	SearchIndexer.exe	107
PID 5336 wrote to memory of 1184	5336	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_f77798f13934e2d8697e77cabf2801a9_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe" --type=collab-renderer --proc=4448
  2⤵
  PID:5996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4696

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2612

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4760

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2632 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2632 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7164d580f671504d6d19f9e0616ddca7e6c427a69ab85988f0e607d9a22a4558
MD5 c9f4aec7865af2cf56d575bf46a21155
SHA1 80f0fee4abace148dd6f79731c9c6a3d043894a0
SHA512 5d803a29f1d6a6f1db8ce6957fbe2986b36501cfbe2d5c4c92e9ff48d49c24e9d56e33891630612631896816af69872ef85816757a5ed52cfc996e8da66de382
SSDEEP 49152:qb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnq/snji6attJM:c3q60jB9EnW6at
TLSH
T18DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 1a85f5c1a40eb0e1644eba10e1557dd07ef46399946fdafa2b052b59d9ca6e94
MD5 0e9c50aa42f131a70b7fc5d32d0f8b55
SHA1 51f1abe10a55aaf9c44abed6e7d4569555e3a352
SHA512 ef649e184a6259322c159c60e731e5b026dd6b2ca483447911ecd437ef9fde8da5d62b98bfdba19b823039a884e4829cb8ee8e93d5f3f9c044a975ee5f8dd3d4
SSDEEP 24576:lXYfDtczAzt/sBlDqgZQd6XKtiMJYiPU:wtcI/snji6attJM
TLSH
T1B905012977D108F9ED6B823DCDA28501EA7378548760F6CB03E499691F332D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e733e9ee521c03b0026a172a2f5d7f59117f640fb7f132f58f4956a1278fe0d3
MD5 0009409cce1daed66da30b927043e8a3
SHA1 147b11f2b649f69da00516a4458d0afb7c96d560
SHA512 61b8cd5075659a05cb141b9b7fdf4f09649d9c85e2d603e725e981105afa8b53b9443251881b667ed2151cb6785f9eaac72c8bf43cde1954de55afef85900459
SSDEEP 24576:v0Le5ji0hmxNrMWt/sBlDqgZQd6XKtiMJYiPU:vPji0A7F/snji6attJM
TLSH
T1FA359E16F5B48335D073C0B9C5D2A68EE97230865B308ACB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5c1b36c1ad0a374dd43824beb521e7b49c3b742035b8820535034224ff1f5ea7
MD5 727d673516036368a757a8f6cc610d67
SHA1 0e84c82e0525afbafa0ff7b71301e24be777933e
SHA512 04552121c225491d9755b3e6934107584b2df4bdd3255a9b87cb12f5fa0a8b5d23190f65e62daefeac87149828b3916f01bb5009262558a272c6cc7491c9ef96
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWr6q8wyuYt/sBlDqgZQd6XKtiMJYiPU:a/ezSC6vUzPviHjyR/snji6attJM
TLSH
T1E6755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a6730ae5b542614cefde238dd529acda197c4f0633097a963cdc461adba4b95b
MD5 92507cd22e27b99da8d763bb546e1110
SHA1 b359b52d2b715f53eaa41b809f3b30c8531e7612
SHA512 940150fee588721fdaf573b7aa1462db871969494c60f2f64619ed1c89a83a2dc2718fe593a30c2e4568927aef84a0425c048e83f309fadfb0d9926aacdd830c
SSDEEP 24576:TVbqPb88hv/l+b1t/sBlDqgZQd6XKtiMJYiPU:TVO88hXl+r/snji6attJM
TLSH
T1FA559E66F5B48331D073C0BAC5D2AA9AEE3230415B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 fb0ffa369249d6c6044a71fcec528d62b5a805efc9b509e96ccdce9781122045
MD5 934ca03afc45595bc7b637a7791c4550
SHA1 e18a8c50b6ffcf631d9dff4c12e1e0c33cada6c7
SHA512 31ff18941e6a3ea4f1fa737adc2188e58a908712d817abc9d679da566a306614879bb2e69aad133a077f73890407a468952b8bd36e49e3f7e3a32969baee8716
SSDEEP 12288:5jLGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:5jat/sBlDqgZQd6XKtiMJYiPU
TLSH
T13FC4231F58C390D6DBBF5A363EA87800B5B33A1CAE49709B95D2B59C5D3C01389BD227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0f9380947de188fc7f7bf74041c0879b92727902c5ab80b6b002112b224b465e
MD5 862108a9bbd1909d0db2cbfd7e05f0f3
SHA1 0608de30ae9517190a91117e2561dba1b09c6820
SHA512 e6bff6e8398c6947a8540d8982752a0c624d79b82a0fc713652fd78237f244a66f94a45d8642bb11fcf244a9a85139a599a7ea9ca785f991ef69361def4aaca9
SSDEEP 12288:8eBNUbTVO86U6Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPha:8JIUdt/sBlDqgZQd6XKtiMJYiPUa
TLSH
T16205CF3BAE28FCD2C27E8DB95A918600E77274304F52A3CBD165C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 86e5eb2590fa6150be70e5f73a965fe44c8f8976e49282e917e07d92302495ed
MD5 0c2a9e33938eb1a604e2118257bf7aab
SHA1 3548f533a1b8a486cc1457ab9d00506273c41b62
SHA512 b0b2ab2037c287d28b79743851211082dd4da925bc608406b4eea1243218c9c2b92eb7e08b2d968a2e710f24b2071d7aeb19a7e3fceed778319a61fba0a17e5f
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THa:XQvGAdlCEL8c/RRNw5CiEnW6at
TLSH
T143266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e6fb6a1a4fd9ee5a40b91497d69983de471af2d0629ad35c59d419846a46e3ba
MD5 c9f464073ab788b8b5fae6524c7edb46
SHA1 2096012c5f9e2bf4e082bfa4e9c979ab409cb33d
SHA512 454bda7d0eec4b034e5d212d4608238b67a0062b8e195e10509b24f3dc4f9d173e2a1a87cc76774a2426deb73d8761911492f88a021e1877794d496ad7e8cc72
SSDEEP 12288:MAwSfxL/2Dc3DDLLmt0LDQewsAj4Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5+:xSewsAj/t/sBlDqgZQd6XKtiMJYiPU
TLSH
T10915E031FAB5E036C3BF0DB21B26D706643D7A204F5129C3E3E8999D59341D2277AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6d9f469913232da238049a85a15cdf3ac8aa929bcedea581a18ee0bc6d1fd387
MD5 ba4fa552bcf1196065a4e353f86ff9d3
SHA1 6c9fd8b2734baf35cdef4886cdeba81ab4c5d312
SHA512 3caa880d1b0a81d8918c8a68629b0c3cea2ca9b180016fc6529c98a6de1b1d04db622c69d877439058a592df24baecbffbae536439cfb73279918ee391096bca
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHCnW9:/UEtQevvqc2W1cpV2RI32C
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8b40f93e70732a3e675afe97f85fe56478351a1dd2e2c8fb55e5d78a5f9aed88
MD5 00436e9bcfea7d78fd3694ad9be49c82
SHA1 6c375f38c47906467b92dfa1f9c50bc9cef61dea
SHA512 2cf474e349c1a73f373fcb085f7358f8e82d81975a0718baeda257593f664560eceb565f6c3fcf0f77c84699a2ac688d0cf90a740b4a609a2a8f5a3c7d1cec80
SSDEEP 49152:qCbRquA/m2yL5zifFiV+XenmE3/z1/snji6attJM:foqHVjnmOEnW6at
TLSH
T17ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b109e576b4755c20f2b6fab02934ba56c557c35d1aae75800ee7aa7a6efcffc3
MD5 62d4e2a497fb06b7e225b9d33389af08
SHA1 b62ade6a6f3b427c80e4620e89e09a7583c0e83c
SHA512 67c32c8d4df6e1f6f88d213d5499f5bb25c2202d4332defb91e3ff43ac3e3434914c9ef7edec229446cce899512f6a70f9e548af4aa1cc8cf463d3261be439ef
SSDEEP 24576:hAhGL2IFoiwtA5l7S53Ut/sBlDqgZQd6XKtiMJYiPU:hAM1Foiq5e/snji6attJM
TLSH
T18D35AD81EBF955D4F5B3AAB89DB69170EA72BCA95E31D20F2150D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 055ba55c7a44f20466a923c838dd02ea7f9d07e0cedd9a2ba3173cabaafe5d53
MD5 1e36bf705537feb4726dd7e66590020c
SHA1 9411291c3c9016aa213fee9977f0375e1db2f6a1
SHA512 b3ef0999006e850d37f6054e94995247d1fa54ab06b9f8eb9d4caaa19c09a8797d26cfed7f8dc14d837951cc1c0baec9232dde7d8056ef8cdf1b021d9ced214e
SSDEEP 12288:umw5HEjsChNSBFgl0WDm+CVGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNA1:nwuXOW7t/sBlDqgZQd6XKtiMJYiPU
TLSH
T17805014A36D50CF9EAA786398597D132F7F3B8052A25D71F03A0C65B6F37221AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 60534170c905a282dc6a7c56a34f3d5b3cdd96a2d78475d89cf63ac1036a1ff1
MD5 99b2d7d5d13adb18c47637757910661b
SHA1 2332bb95c060fa826eadddcf65dfe90ca43d300f
SHA512 e3f7f72105c951f4d7c68a8c48d3ccd887bf3381da6cc3e7e8fe2338e3167c1005efc1620d5a4941a42982596a1d1f31e383462aa0aa2ea200efc6e2b57f8507
SSDEEP 12288:Q/Z1IyIGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:UZu+t/sBlDqgZQd6XKtiMJYiPU
TLSH
T132E4121E32D160FAD2AB523D9DE56500E3B334596B3663CF12A192A92F3B5C25D3D332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6fda2933baf9bc450dc3213863023712887ae0ce1438a9fa4237532a527e4241
MD5 fe2a10a93e9efb2b568c255459a38400
SHA1 996b91d35028495766326b35449e52b8fa74d279
SHA512 5a5ba17f97d1ac697e6d252fb54a9f542722adaafba8abaa8bcc4faead9b07c52c7be1cadb16e131376fc6edae5bf84f48842d9cc6eb3cce203330e034ddec22
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U2:8QRQyi36YOcPhLvw2gAf+PN37EnW6at
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9b559b6bfce72f9580f0a8f9613f274be885810393b93d8c6d1bf023f6cec864
MD5 d91aafe1762d9bebf41e6935954df299
SHA1 47fa614d12c368e05bbefd50a52e06d468e91786
SHA512 9f4a45eee49510d6c1e46c93d5f1dea5a4fbd6b2bf0571aa32724106c4f37d3f9c7b54c47da3a7817041eb5c51e3236a7f3d4720b88f83c0e2c839479ade6993
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U2:8QRQyi36YOcPhLvw2gAf+PN37EnW6at
TLSH
T11F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4bb41d7fc8915f5f7c623e54893b72405cf00f007838c7ebdbba5a7140dc5595
MD5 e7a7c90829e75d6ff43a35dda74d74e7
SHA1 03dc6caee937954361697bb6cb1d4ba00f5cac4a
SHA512 723a3fb64d4399222ab533f6fba8d38eb37dffd38aca95e647dfdb4485a852c07fccba2744ee1c934d55acf7352245510a285906adbbff9948ac1662478fc729
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0Ot/sBlDqgZQd6XR:g68Qg55nhceWu7PNU3/F/snji6attJM
TLSH
T104B54A33B2F20099C44DE1769F4A972196D27C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c7110c7980f317b4a76a687bfcc3afb7c22a982415276f02fd892fa0fd034627
MD5 097794eb5f0be587ef1119edcbd65065
SHA1 651296a49f565aa733d42ecb7ec82064fc1462de
SHA512 0ffafee91594fcc07ab0cb0be3c6f8a38f3117c6219d3ba8b8e18422198e624f0d9646d0aff69e9d0ad9e70e36f00aaeda6e84e967d2a50a888dab68e5b8a440
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99k:vy5112gYy5azzVva69nLKnhZgEnW6at
TLSH
T1FA167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 931e72b90d6cd29a988953a5d8e3e945d465ac92eba0f30c37f28d61a87f3243
MD5 f41bfbfc75060b629af050b099883cfd
SHA1 98e641cd4db85401a8406c775d2187710d474731
SHA512 6393a74ba5d1562a67a159b92aeb9c634d52d8bcf7512e9f4cca421789ce925d87de5da5ebb51b58129eafc740e882ddf11f9ae386e4be47b27148689fc60954
SSDEEP 49152:XB+taZ3usBWOBr4tEG20bqx0z+n217aau1glp/snji6attJM:5u6JmUxd2dpEnW6at
TLSH
T139D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 48c083d14f13b4e8bbb17ffd72acd634a4f3f3b7026b1b664d7991124683a993
MD5 40e01c751bdace122643d377c5447452
SHA1 07060593ff1519717690768fa8469748f2e213b4
SHA512 529f8eea5c88966fc573b31c88637b7b183251b1a73907741f2cbe41def59e750530daa161c48d917e38fe6979a9b1c0e67626759a3d4ec54eb005db897b51e5
SSDEEP 49152:x1hpsNoJpF1A6BU44CwH7R4xP/snji6attJM:xmifPkROEnW6at
TLSH
T1E1B5BE13F2D900E8D06ED17887569232EA72BC450B34B6DF0A90B7962F7BAE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d003b3820a26d4d6c4d2097aa552d1ec7b7b483f23cac443a94c591a31bf7bc0
MD5 a7f4390a923b492ca86132974103e288
SHA1 7830387e2a8ad73c587f73165c1d1f0321c11587
SHA512 a50404799b6483e0bf2eb486a2f2729e624b6247bac58d8b6ab408f27ba70585ca24d49609169a45e3c88ff4e5b14eaef90a49b7223a25e7ff9dbf59f8ce71ff
SSDEEP 49152:uSuZQIY0Be2KNRVtOnks6NMHqU/snji6attJM:g5dKvi61UEnW6at
TLSH
T1CEC5BF13F2E940E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 31d40b26a770d45e65bc32d6238ec96f8a0d761a1d5cdc3915d8f2e116b70b9d
MD5 1a41eb1563e04eb848212fee65b1cf19
SHA1 21a8372b04329d77c5e1af42ff2c14300a45042b
SHA512 40152a60e5d742ebb4abbe1c9b94d9874c11f697fef633cd063972ac997f8e3646c90e558e3e3fa15bf0b290b14a82b837b98748175cc4e66ed9ffb858d63a37
SSDEEP 49152:PhtSn8EApI0figXgiDn0AP5wj/snji6attJM:eX2iyphqEnW6at
TLSH
T13695BE13F2D900E8D06ED178C7568632E962BC150B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f0a7b4830427a6425f46551369963dcb41017f3233d7e47f4b607669f4b2de38
MD5 38d1c4ab633f3fac813beabc1a9fd3e4
SHA1 d4951c7f766e513e5cefc64128eb73b40cf7ba1c
SHA512 f237df2d1c7767f54f8cc8b1e539981eed5bb8ddba4e59641dd0502ef2fae9d0af1bb189733f36d2af651c592f0d9017d21df3995b573169efc77aa8b8335dc4
SSDEEP 12288:fTGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:fit/sBlDqgZQd6XKtiMJYiPU
TLSH
T10FC4231F68C394DBD76E5A762EA83400F473325CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b6b41dc66a8a775bd14def5a00293cc79fad911146feaedb62d491c2955fbca1
MD5 3a21c2a5f9b87e090720d468c10cd95f
SHA1 1a7ba46cafff5f79cd062516425d298cb4b92c96
SHA512 31824bf87c8223ef0597d0e133001773b013cf429931223bd1f3cab504fd21b712f05fd0d8e776590f264e203db47819558be37b8aa9907ccda04da5fb8cf40d
SSDEEP 12288:GsGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Gzt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1ADC4231F68C384D7D76E5A762EA87400F473325CFE4A30DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 c2535f5277b33a5f7b1d1590fd48be181ac60a9741e907b0e29cca9d7644c1a0
MD5 1fd738f06d6c2dfdc9dad387e6c71882
SHA1 c80ffb6c680a2a2dfbc839a16e25a2fe1a763763
SHA512 b14e92d6b142d3fee2b6ad984999c90ef12d2222b2feeabb93e31ba1302137f616d7477175c8ce8ab3e96f5d4befb992ab644a3825a85df158d7fbd3e22dcb85
SSDEEP 12288:TCGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:TFt/sBlDqgZQd6XKtiMJYiPU
TLSH
T182C4231F68C394DBD76E5A762EA93400F473324CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c95f699e887605557f9548bdcf9487c57389c684a5eaa4aa2832d715650a5635
MD5 6dd6b46b8c7fd255b9fcff228a102f59
SHA1 833bf8cff1c7657fb23ebcaf0ad7f9039f7e9252
SHA512 65d447ecb8b6bc048a6a048377eb0a056c9c1f55b988c5f99a8e10627493e85acc722afc91ea91b583267922fda09cd33642d05c4bf70d4f81ae8007422721b6
SSDEEP 12288:JVxGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:gt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1DFD4231F29C380C6DABBD63A5EA56400F2B33A5CEB2671DF96C1744C1E392525C7CB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7bbdd0c40de6f1e163ecdabb8192eac9bd3f0fe52775d872e146e3944224092d
MD5 e45837e4d5cbe589062e6c5d492fec34
SHA1 b6b266fa36088d79b21762ea91170fa7d0458608
SHA512 64eaf342f52a8fc444e5cd7547487389bf8abfcd0860cf1bb38a13c6dec43d8a9253ec493f3a863e899a8cc4b7dc78c35e68febc9f869689dc17b11c4c7561d7
SSDEEP 12288:kJGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:kst/sBlDqgZQd6XKtiMJYiPU
TLSH
T142C4231F68C390DBD76E5A762EA93400F473325CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 0bd7d1decc62520d42b34caf2c384b7e13fdae4b4b04c1bd67ee2053df26f3e6
MD5 c3829ba07940b423c5b9763a7415c6a1
SHA1 e1bb6b02e26433c31ad87ace0dc30ff02a490d83
SHA512 0d7ac58bc8e5fb012ed759e07fcff084b122c364ee53101b93257b807a86032318f6d6423306138175359fa83ca62235202b6755fc629922bf37bc9cf98e243e
SSDEEP 12288:YgGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:YHt/sBlDqgZQd6XKtiMJYiPU
TLSH
T106C4231F68C3849BD76E5A762EA43400F473325CFE4970DBA6CAB0586E3D01319BD66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c416b5ac0b03cdc8d4ce885c65adf14e21c7988fad161bef33cb04501e50bdde
MD5 5055663169f3e65448643b5b14f10b38
SHA1 edf472db0e3a9553b82f8234f7fb4dd01dab3f07
SHA512 598e7913bac2ca295956283cb14a72d6e381badca7b5338cb76d437f68d2de5457706dbd53ebc9336c10b8b1ea85f5b61d9501703a4701d7dd185681542e951b
SSDEEP 12288:MEGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:MLt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1F6C4231F68C3849BD76E5A762EA83400E473335CFE49709BA6CAB0586F3D01319BD676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cecbb17bcf806171bfef0aa366c4681ec57b8786507f6317ee25a50aafc4f350
MD5 581c7b3f2c2c298eca522c580cf3d0f6
SHA1 1b4cdd8525fb065040a5bad07f708685e16fe7e4
SHA512 1ddc8d70b49060e10ed44b85546ac1266ccad046a26d2079bee8daa2946cf9618ecda2f683e8b74af5b578654d7a93d5ddb677d87466d68995dd83c38ea0acd3
SSDEEP 24576:rZMMzFVSOTt/sBlDqgZQd6XKtiMJYiPU:rZMMzfd/snji6attJM
TLSH
T1EA050259B39118F8ED77823ECD659905E2B27C190B60C65F03E4366A1F373A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 bd42d0df58b65ffbd426acdd8a11110da8348666dac2bb889d90c9b0f8545f74
MD5 20248b1f036e5c4f8ab670db43121331
SHA1 5e39e78382b969538fb227536ba9e455b4c9c72c
SHA512 a30e98701901066b3e486e0ea65c14ec5b6488604dbf80a63b4fd84cffc56db502578365f44a3a7330e1723eaf6d616d36c074f4c8050ab0c0917c5af45b51a2
SSDEEP 12288:TPGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Tut/sBlDqgZQd6XKtiMJYiPU
TLSH
T1B2C4231F68C394DBD76E5A762EA83400E473325CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 dafae46885e0411c5e71ccc7419ed35284389fcf932b46b4fc6f24ea6468a7f3
MD5 e8ea16fd8261e08bb66f4e9732409bb6
SHA1 e36ded9ab377db01678a3ad30a50ebbd35d36d39
SHA512 137f6b6d42889b12ff0428024af9a20d5e866a136673b5d615956fd3de117c06f64a7396aeb3975d1b1a6944e27d977e19c124ebb129f490f328e4103ded16f2
SSDEEP 12288:cbGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:cKt/sBlDqgZQd6XKtiMJYiPU
TLSH
T179C4231F68C3849BD76E5A762EA43404E473335CFE4A30DBA6CAB0586F3D01319AD676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ea2a7ba2e8d44db3c9b7ce5742cf909635301464c804dd16afded7f595e3e884
MD5 07140dceff390bbf03ff30550c979dbd
SHA1 f7ce366305bbd319351115be8733264b5d389fe7
SHA512 bd6d3e967cc76c4eb733166e642d8d044d112a9ce6358214bdc47d9382139d110cd039259a6169e6f4abe63c880e0e58da4ab785a502416d2dda441ec0e8ba5c
SSDEEP 12288:cyPz5L8IGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Fzyvt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1D3F4120B72D230F9D27B92398DA11901F37274395B249AEF53A4567A2F372915E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 541ef2532060d4ec00778efccd523e08ddfe480eb45f3eeaf87f35c5436aefcb
MD5 ac9e4e06baf7696a0e45d8ad9937ea2d
SHA1 af87661fe3260b12dfa2788a03ec652bb1ee5b4e
SHA512 8fd9c69b7b49c92bd14d2c9650f47c697bc9b680ffbf1b2d5fb0ae1dc65192d5ae55b83d56b4131c51ceaf0d4e4be531fc355d7b4241421103334795b8c894c9
SSDEEP 12288:mPGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:mut/sBlDqgZQd6XKtiMJYiPU
TLSH
T1ABC4231F68C394DBD76E5A762EA83400E473325CFE4930DBA6CAB0586F3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 edc4de0cd01538ae8b8c980e433367e70f629b6075c17ba94d9018ff1e6b9a89
MD5 3427ff98324cc32a3312f7fd4c4e72f4
SHA1 7fcecb99dac4cbdb9a457ca392b8958d8767e8cb
SHA512 b0c35d757b154eec509d056cabe6d31a8081e219d943fa59486587a615204eded0c98e4a98de7bf50d2cd0793591c50d48cfd5dd02c3195e77efde5501501176
SSDEEP 12288:9PGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9ut/sBlDqgZQd6XKtiMJYiPU
TLSH
T179C4231F68C394DBD76E5A762EA83400E473325CFE4930DBA6CAB0586F3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e992ac23507fc2e69d59814f4aadd318556113295ab1bdd5550802abc3753f18
MD5 6984b7de674f09d9d65078ac9c40aa0b
SHA1 ca0c5f246fa6014b046c35048afb03db5af6be56
SHA512 e4089fa82d3f542ec8dcbe504f3835017ec39539e1ff3858a7b36879bdeab7bed0cb3b28578d45d2dae6ff3bd30244eabfa40ec61344353405cd9451e0ea163d
SSDEEP 12288:pyPz5L8IGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Izyvt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1D7F4120B72D230F9D27B92398DA11901F37274395B249AEF53A4567A2F372915E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a9a869c3d675aef3d38295e72557597544d668c5c73e3731a1471c82fe491a76
MD5 f9fddf5212907cb49e7e45222137fef7
SHA1 5050ceeb90ad61a8427f43a38468886e7c44599f
SHA512 8a8756abd68dfddd1afe256cfadac71837503784e27eda2e1109fa53b6637adab7bbc1aba178a5035b7ec48d12ba657d2beaff8c01d8c2b86e0d1306c560bfeb
SSDEEP 24576:wT9aLl3z0zDVt/sBlDqgZQd6XKtiMJYiPU:wTQLljS/snji6attJM
TLSH
T159050269B39018F8ED67823ECD659906D2B37C190B60C65F03E4366A5F373611C3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 6054b2598986ee6459ffb3f5b350a526866a0ee606409c9a6a8808005f84d6d8
MD5 f4f2bc56b3982ff48c78f6592f76cee6
SHA1 3cd04a4d38fa803858aa6ab99ae245e721e42049
SHA512 c200eb11a73dbe165dcec0eeb66d6d59bfd02a3e7f3b86df03ab8c71398eb97687590eb70f22027af26f54438aed8ce1392b9c48082dd44009ef208519d179e7
SSDEEP 24576:Z3td9CHKy7GZZt/sBlDqgZQd6XKtiMJYiPU:ptd9CHKyad/snji6attJM
TLSH
T1D625CF90F3E410E8F1B79A358D765501DAB67C9A5B31DA8F03A8661A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e87342d5daa12a39d2639060849752e5f186e172640e7b89e58c9031891ad705
MD5 291c916275859425825c51cc1f889b53
SHA1 70f5a0868c75a6140b4e5efc09caf8987bf1d082
SHA512 f95547271981e105f194b8c29b9fb93326e41f43a42c99b39c5a9a130420e395b86c33f29add1974be67ea6e4b97264d945db6152259c3ce0fbcff665361aa2c
SSDEEP 12288:FiGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Flt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1A9C4231F68C380DBD76E5A762EA93400F473325CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 999e24f9568a3e7487d76d7d511f21612eb46e3b52c5719a1a277511e2d017d0
MD5 2e9a6417811268f219c1a36a86856034
SHA1 898d0765d088011e34f14697c7f231a66bd5d4a0
SHA512 54faea9b3dc7f4077effc75333141db901499299d4ba7ab273a1c96a797bad140145dedae63ddfefaa757e05e18b0d01dc19307e7831c47119e9850c05692356
SSDEEP 12288:9oGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9Pt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1F4C4231E68C384DBD76E5A762EA93500F473331CFE4A30DBA6C6B0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ffc44efb6e4d4a41935678bf150d8bd6eed701559ca6dc125fee11faa9e5732e
MD5 745474e4acc9f85eb0fb8597ceea71d9
SHA1 6fb63ecc35ce786da32ce8137587525eaa80cf42
SHA512 5b9982c2ef5f094c07b5826e4b67926799d4fdaa476156fb81eb2893b11ce45b91f4e08dfdaa1478222e175cdd609427b3c080f3c925423b4c926568b546ee6f
SSDEEP 12288:LNGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Lwt/sBlDqgZQd6XKtiMJYiPU
TLSH
T147C4231F68C394DBD76E5A762EA43400F4B3324CFE4A70DBA6CAB0586E3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 78f4d3a810b5c04201b8f109fc7a4b11a9b028f32c939eed6d59e489f89c47d1
MD5 5034409436dac4a2513a34b06c4a4a4e
SHA1 1f60f3eb377d8c7b7139cc932b8965117e58c00c
SHA512 c02eebb72ee984ebdf32d49194e1f96033414a1802002270106487b0f98124a2950ebdcd02265a67e85e9adffd0fc3e21367f66c4d68e940501b4acbc41fa6a8
SSDEEP 12288:hPGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:hut/sBlDqgZQd6XKtiMJYiPU
TLSH
T1ACC4231F68C394DBD76E5A762EA43400E4B3325CFE4A30DBE6CAB0586E3D013197D666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 928531aeb6b5d539337b764a648aae98910c8b9713a4775a9320049209d92673
MD5 af25735c19ad24b87daa19855ab13dfe
SHA1 336b8e7008f1d1db1a9f44868cd4a65bf4c520ae
SHA512 720f1f77287281af07e8726b4bdcbf2c6497fbe650f1cc8b35c343c3d9faeb3403641152a2dd8f9da7431d769108efc9c88e70a2d69ea9f90827177361e8283b
SSDEEP 12288:PiGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Plt/sBlDqgZQd6XKtiMJYiPU
TLSH
T1AAC4231F68C390D7D76E5A762EA53400F4B3325CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 dd6d4e75ec9f4db04520f017f4591a588843d25d390423f3ccc02d2d87bb41a5
MD5 5ff02232a65f97cf37465dddd00ab880
SHA1 148b2ead7313bc07068d695e1c0c46897666b565
SHA512 4bc08cd07426cb045e25ccd2947eac208ee46484db598364e447d4e71647d0b1b15ab5f2efdb5bc01d3ba49ec43aa62ccf3f30d24217930dd6f61d9e1dae6f97
SSDEEP 12288:9HGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9mt/sBlDqgZQd6XKtiMJYiPU
TLSH
T183C4231F68C384DBD76E5A762EA43400E4B3375CFE4A30DBA6C6B0586F3D013096D66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 7517f11d02b7ff14fdebc709afabed90d62106565d3c331e7f33c1daeb28758a
MD5 ee11ccccbaf0a6fb825144bdbb2103f9
SHA1 46f0e9ecfacfcce07eb84acb9494afbc18cf5cc9
SHA512 010be8092b47c5b3af7af56832c02908e566c0a2ab98dfba15afe35036b12e7fa690eee4a05b19a3aeefbdc1e829b9efb34e602886f85bf0367045181b254506
SSDEEP 12288:cJGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:cst/sBlDqgZQd6XKtiMJYiPU
TLSH
T159C4231F68C390DBD76E5A762EA53400F4B3325CFE4930DBA6CAB0586E3D01319BD666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 1965720af54248e4c1846630ff7573f3d41daaeaab63d2d54d5dd7e1b02bfacd
MD5 3400ce23a586901cb880768b980ed8a7
SHA1 1dcd03d4e28e7a6a72a9de05cbfbe956d705024e
SHA512 b6321d1824c95b634e589b8241aa366521f5fdcfc64c80645ce31d00c7c594d6507f2a5986f8fbf28032b404a0e37b3f7662d20d935d7d8efc60dea4c1557642
SSDEEP 24576:Ufwvok9RX6wkyAI6t/sBlDqgZQd6XKtiMJYiPU:kMnYIA/snji6attJM
TLSH
T1B335DF2DEBD844E5E1B7923C99B7460AF6B178681B31D2CF029A53AD0E37ED05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 089dbfee2111e563f2dba27c87e60f88edefa98f4e73cce9e6314b9baecf9052
MD5 74cedc0a1fdd313845703df695b411c8
SHA1 bf58c222e7368140f9b6c725da6db36c0c95b3b2
SHA512 500a67501dfaaee58c72d22fde374c4b3b379509678199de691ef29f56888d433283ac79ab7efd0bdc6f9b9c4ea9c64edce0f9e30ce7756ff2325704e6fe2ad3
SSDEEP 49152:nYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0D/snji6attJM:xySzPbEnW6at
TLSH
T12C066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6f3b11c2bfa43415d3f0104a58890bb3be69f0ec1b15f960616eb0046fd92486
MD5 d97d3f7ad43932e1e1db081cb08b6618
SHA1 3752dc6c54cc71359b91f298c402b3608c8d00c5
SHA512 8d63e9b99fdadb5f5daa74780266e9a7bd1b0cda8a7fafb4785bb9bc54b3995e9d2576001bbf07e902854a9267187589f126dfdef5468a034532e281153278d5
SSDEEP 24576:A47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYDt/sBlDqgZQd6XKtiMJYiPU:A47JUQj4irIhCnDHUPfF/T/snji6att+
TLSH
T1E065AE1EA3EC01E5E1BA927885154A1AEA71742D1F31DACF12B0837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c3d5465d02021eb81fa1c4ad92daaf63eeb7b3e9182ad30b39ac11b779e2e9e8
MD5 dbdd5b92b1a0230730cf819f767876c7
SHA1 02456510a7362b030749cea1c7ffbb1601693981
SHA512 d8edf61a5bd9c829a38c8664e59a8caabf41c7db26390ffc16fe6e73c915f93c34cd8a891033ccc8647f15d9cdb96b77bc87ac43bf97b9fbd39f4a32b1e7a6b8
SSDEEP 12288:/Gsf/Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:N+t/sBlDqgZQd6XKtiMJYiPU
TLSH
T1A8E4F11AD28542E9C16E627ACB565A40F3733C2897E1E3CB52C0F53E1F3A1915DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 a2f1ad187ec48062ff34183c1893d03b5467078788e236bfac69575fc202d21c
MD5 88dc28bfd84bb8b922cfd07725dd3c15
SHA1 6df452a4cceb8336805cc6a1793b8512217d426c
SHA512 dd381f18addfda4f13d66f7233dd850dbef8c796a06705586cd4992aa9af70c743cd30e92144d5ba9f770e7e12dd8b5bb5bb1fd87502587b29a1f98181308133
SSDEEP 12288:/gi1+2U3fFgdRUyvGaC5shtaZ+7pYEGJ0yBFAHOZ25e:/gQlUPtNcaZOYjJZBFAHc2I
TLSH
T19E253950766AD75FC5AD40321E33C2CCAB707D01EE45AB0372C8972FC576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 12334ed6a247171d6dc082e7c81fe85fb8840eac4dde03415483829579766a6e
MD5 39842df76b99b279b48adb599973c29e
SHA1 29660a43b61de4fd0c30819bf30d57f61a857f1c
SHA512 796515d1b03a327e0671fcb911ee3ca193cd8f2d56f38fc48c608e79803788863d606d6c65ed9945e1fafb3ea2f95419c37e7877f694370dc70037319061ca48
SSDEEP 24576:FbU2gXBtgMp2PF4ZOaaHNMEETT8tjB6eyZWLf8s6L:FbU2gXBtgMp2PF4ZOaaHNMEETT8tjB63
TLSH
T1AA55D781A437A3CFD1F66032076A5B4CA764EC0773096F2663C8553ED81BB66A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d026752bb6fc43e92cbb64796fce59cd130b61db90033bd21311d7568c0afff5
MD5 e6d851e1a7cf6dd192dc8f41cfd0a799
SHA1 cb58ec6fe886026a5604b1467a4d286b7088563b
SHA512 93d3c2f33e3312d9ea1fb72b57a8d8dbd0c34b7bb2280992f6e264a0048ca1bbc98e353151d560ca8472b3818cc1a08c9302587aac43266771c63aeaf4f6ce26
SSDEEP 12288:Iz73Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:22t/sBlDqgZQd6XKtiMJYiPU
TLSH
T16AD4231F65C79487EABE5A752DA97400B137322CAF08B0D7E5C5B1986E3D0824DBC72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 df70e80b4ccbf7ba0432024e8cd901d8e9387b5ff993dc09eadf49ff0898c8ef
MD5 268d83488a43fa41f6fd152558afa70d
SHA1 ea57ca955c82f15196f16fb5af4e0c2fcc66707c
SHA512 1a9c3a63ee430514dca61282b4285e28ef0ec505b057b4ee5bea1dd3407e6de0295570a6c1625f505fc36d343fac145193db8daa3a4a82e7bc632c1b91b03e44
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYYt/sBlDqgZQd6XKtiMJYiPU:Fgb4mBIBhGFJ/snji6attJM
TLSH
T16C65AE1E22E802F5E1FAD2B89DAA4417D6B378160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 1d684404fd0eaaa1a5ac846740e54c4e3142d08eaa1481c479bfd5488ce70e09
MD5 de7665d1db64ead116956f262c2ffa77
SHA1 97887743d16b8cc834f9d2374b1f08bcc8ab56f5
SHA512 67a020a61fb5cc4286aa89b4fb7014d2cbf27a796763daf9fbc1c7038351e5afa1e10cefd8f0b359c2942d67004dc454af579edd2ede23af00d5c110cd8b496b
SSDEEP 24576:aG88u8FpJqH1Wzria7/mTt/sBlDqgZQd6XKtiMJYiPU:h7ZFPqVha7/a/snji6attJM
TLSH
T1F535012976E101F1D47BD1388A864663F6B2B4251364FBDF07E88B551F23AE10B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c410fc28467f47d1a4c570d1ca58b16b625197b581fa37e30107fa70edd637cb
MD5 f93a5e9e3ead056b3b6710b443488380
SHA1 a8884bd18e188823c7a688d2ebdd6a0163505235
SHA512 6779ac565440a96e16a4fc1c94d9ceb0072e315701e15141d399e9ac078b39385439b8ae1cd5f740144ecd5a16cd0672c71884d2aaadc66037f11e1313d9d891
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjN/snji6attJM:xG05lO43boEnW6at
TLSH
T18BD5CF6E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 879bd79ff97ef1a8d5109b17ca4910bc54a35efcbb177f70455985ac34e84598
MD5 fb1e8ab9a5976d673f55c000b14af80e
SHA1 3553cb1ee81cc84c0b49cb2998f7e16e5e70cdbc
SHA512 2f24d60145cabf317818464d5145af9c85b2347f540027d7857949975a63fbe129282d4264751be838267b0f0ba183779d13b72532794c46460443a79d4ae006
SSDEEP 24576:efa5POZ3dpqWVM50JicR2hG0lasx2+47eidnxt/sBlDqgZQd6XKtiMJYiPU:Ga5POZ39Jt2pasx2+mF/snji6attJM
TLSH
T10365BF5EA6FC01D5D5B9D17DC583460AF5B2342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 331c423e7c8165c8a1084dd4317df91660fd507877528142369b18ab376ef9cf
MD5 ee9a83b388275eafee83ebcf8a751544
SHA1 030f3ef3950b4788d812d10b4ff1547c603d74c3
SHA512 2b4cefe821ecfb393edd51f37223a422805a820171e1fbc6bd0fabf555d025184fb2c8a19383a3367fa726db5f0ea204b3f4a795e28eed90efabfbb3b263ae01
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7Fkbt/sBlDqgZQd6XKtiMJYiPU:1Nc/zEOVHF6/snji6attJM
TLSH
T155858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b66cfcc14f1de56523d88907593746251796715be7da965a61dde10e466d64b9
MD5 e179a499ff4bedd8f79c57b7dd0b2d41
SHA1 44bbffacb40e431723cbe0fbfc179875272ab307
SHA512 34d75df2960b081f54ef5446e415b41876c556f76c4a36e8aafff5d2627d7935761caf3187e5c96f6307de75ec191a142dc80556eab925788385d25b1bcafc07
SSDEEP 24576:6tkNvNnaFeYhJNtmZBmvt/sBlDqgZQd6XKtiMJYiPU:6tMwBtOml/snji6attJM
TLSH
T1C355AF2EBAF846E4D1FEC6B58D238512F6727461173292CB5290C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 26acdc83ccf4a2ed94eba4dd9bdb7f77f20c7846d76af89024425109fcba0f0d
MD5 ec5915ce2011e338af9291e48ec47bf0
SHA1 7e3f203f263a7934d298f1d3cfff1dcbcf979496
SHA512 0784c123bce60eb36d7d06174b679227a721d7551cb493bda820ab5bccb3a7cf4d32a02b554132c3dc4d9a028434b659ab1d1c46fafa251c17189d2909e07378
SSDEEP 12288:5HvUrBFrEjwaQwGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:5PUr+NQ3t/sBlDqgZQd6XKtiMJYiPU
TLSH
T13A05F12F22D918E5E67AE17D89828709F77274651712E2CF02D1817E4F279E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 608ebbb93e16038cbe3ddcbf46283cc2dd5426011b5b3207ad60b3424ac2d783
MD5 de4ca0bae1376494bb428723d8f6c5e5
SHA1 dbf44b07bc54f6c5a2673b83d6e617104a78e84d
SHA512 a7419920d2bcd8716530b48a7465689e81c21beac3057941a8bb2a173e0935db39f6959340c75a1c99e9ffb06ae68f466a0d71aff2b7052a90ee6b18db0fe184
SSDEEP 24576:xD3FHshBIYQgACt/sBlDqgZQd6XKtiMJYiPU:xDVHeBIAA4/snji6attJM
TLSH
T1C525E13EE69904E4D57BD1BC9A638A06E77234AC072265CB02D4D1B91F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-107-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/396-101-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/396-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/396-339-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/396-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/396-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1204-132-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1204-126-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1204-124-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1204-326-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2612-305-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2612-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2612-67-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2612-73-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2780-89-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2780-96-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/2780-321-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2780-90-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/3112-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3112-251-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3112-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3112-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4448-95-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4448-8-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4448-55-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4448-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4448-6-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4652-79-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4652-77-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4652-320-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4652-85-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4696-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4696-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4696-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4696-47-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4696-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4760-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4760-323-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4760-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4760-113-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4760-119-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4768-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4768-22-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4768-152-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4768-28-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5336-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5336-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5336-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5336-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5344-143-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5344-147-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5344-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5344-137-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5344-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5996-54-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5996-18-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5996-11-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5996-20-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5996-33-0x00000000008A0000-0x0000000000900000-memory.dmp

Download