a38337f09c26d3b4ef0680eecd5d62d381155c008531cb314c70e4b093419cf4

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260808-qnsa1sdf69
SHA256 a38337f09c26d3b4ef0680eecd5d62d381155c008531cb314c70e4b093419cf4
MD5 9f1bda0c9de592ccbf95f72ce2680db1
SHA1 e27a7e756afcd194d04a1e9b957a4e29d638ad91
SHA512 ee273f1f2537b23bc98d158bbc53b93c363ca59db641e0e3007a9da1e1c679fc3ca99b3a2c8e8046c8e366e45d3aade914d70bbfccc5d4f63fad35c148a5c8f9
SSDEEP 49152:P+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN75552:G/PvOcjcXvvOOc5nD527BWG
TLSH
T111165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5968	elevation_service.exe
3876	elevation_service.exe
5456	maintenanceservice.exe
5852	OSE.EXE
5984	PerceptionSimulationService.exe
1324	perfhost.exe
3240	ReFsDedupSvc.exe
4532	SensorDataService.exe
4592	ssh-agent.exe
6136	AgentService.exe
768	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e000f71923e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000373fe9583927dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037b7075a3927dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f2d69e593927dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6bb52983927dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fa944983927dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000513006593927dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
3876	elevation_service.exe
3876	elevation_service.exe
3876	elevation_service.exe
3876	elevation_service.exe
3876	elevation_service.exe
3876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4196	2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	5968	elevation_service.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6136	AgentService.exe
Token: 33	768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeDebugPrivilege	5968	elevation_service.exe
Token: SeDebugPrivilege	3876	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4968	768	SearchIndexer.exe	103
PID 768 wrote to memory of 2468	768	SearchIndexer.exe	104
PID 768 wrote to memory of 4136	768	SearchIndexer.exe	105
PID 768 wrote to memory of 5276	768	SearchIndexer.exe	106
PID 768 wrote to memory of 3540	768	SearchIndexer.exe	114
PID 768 wrote to memory of 1504	768	SearchIndexer.exe	115
PID 768 wrote to memory of 4916	768	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9f1bda0c9de592ccbf95f72ce2680db1_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5456

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1324

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b5cbbd5b118815243f8976e536171dc7f4f88fbaec75a3e9d494aa877f84a243
MD5 bae391d37d251ad1a58c8cfbd59541a3
SHA1 e014b7f0ab40b91df549aa9d8cbeb40cc42e1866
SHA512 12651bee58cc157ec065b72954c8fb3ad56981c0e5f344960d6b3bc5b94b368b4bfac05e86617f38d492c346fbacdacaacd636802a699bfe753b2d20fafdc15c
SSDEEP 49152:Db+632BuPkFKRrdE6ohrstBhuXjfS4LWxnvDmg27RnWGj:h3q60jBsD527BWG
TLSH
T102D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 add7ec1e9fde4955d82e40ce83ad8dfe99a44178924510b46d6ccb1b1c57c550
MD5 374c0193684a146bf785102dc180df73
SHA1 9885b7344c7685a109c1bec6495e7ada040b696d
SHA512 5c33aeab48f5a054bc701cbeafd6801dadc97d3b1ac4ea19137f590d0880beaf51582349e077d5c45e803d03f129092a56a2298f9fc19d5afe2598343fb36cb4
SSDEEP 24576:2XYfDtczA5sqjnhMgeiCl7G0nehbGZpbD:1tckDmg27RnWGj
TLSH
T11A65F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5d7cc9526af4553b257208f04906a02e2303358579897357b154a9cf5dbec97a
MD5 c22c552f7a08241ed3a6a2095db969a5
SHA1 219973040b8c2bab83847fb3bd555e60347815ac
SHA512 0b4a4888cf9c94444a9f4ab1282e02c9da186888ce5f1ac12cd7247f9ba5defffcf7534282215511ad863d8ac2fb9c7b685b68ae74398a7f921efc0c69e375ba
SSDEEP 24576:L0Le5ji0hmxNrMysqjnhMgeiCl7G0nehbGZpbD:LPji0A7/Dmg27RnWGj
TLSH
T1FC859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 befccfe276f8732a22e37fcd7b99f324aa7c05c28b33c89f6320fab75098f0f7
MD5 251cd1d059f957c30190b7b8d4d00498
SHA1 a9296c46e8018c38573616b4d60a556eeee03989
SHA512 bdbebe06901c1a8e1885aeb747253fb711dfefa9724e091c57d3ab605d8008edd9b73fb95e79740f8fac7149a790bd3363bce398a4225b2835642400be87c8b5
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWr6q8wyuosqjnhMgeiCl7G0nehbGZpbD:S/ezSC6vUzPviHjyLDmg27RnWGj
TLSH
T168755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a0db3ffd4dc1641ba6f1b6752fe6f1b150adc20c46b5e6cd6963e0b6e9164fc0
MD5 ffca30159e3db36b4f75deadbb1b4359
SHA1 b882ea82533c734eb2da4b2ae7cde4a199cb2faf
SHA512 7e1ddf0a403afadf4c1ed301c6698bdb8f35f3a8c6fca2e1e012e8d7568971b3cc3e94690392bc396e3a560306be79c69dc95b35bef43103de3f664ede49663d
SSDEEP 24576:mVbqPb88hv/l+bNsqjnhMgeiCl7G0nehbGZpbD:mVO88hXl+lDmg27RnWGj
TLSH
T1C9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 489e6cbc1e964d92009402068cbd361d608c8d1dcb657545b0bf28630c7b95ea
MD5 8e9dce9a71c4793bc70ad42339ec0ede
SHA1 fec674d1cc28fbde0ec3341450c35eb7b020aee9
SHA512 8753342087f1fe1e85a77d60a035504a5d5fb514e38049f971ac5306960ed31544026cc7b96d3a669fcb4e27fb88861e5ad60313829722d5d0b21ec4ffbd6cf6
SSDEEP 12288:8jmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8jmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BF964C50CAEB7608B5C3E9F11EAC177E56982008436A637DFEE5B5458CB38023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 015f4c50ff6aad72f7cb3843442ae304b5628373f48971b2a63253245e9367b8
MD5 f731a248e11ebae331272ce1d0884da5
SHA1 741a45d181b7e5e72b006afde467ed3d3cc897e1
SHA512 c573490c5aa967e988b6e699413574afbcd7a405d42f0e45df9d77f8d58f181564e7c2b4fb1dea3d1d360974867ae66e95f99f85aefc5207b932f22ee1cabfd2
SSDEEP 12288:zeBNUbTVO86U1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:zJIU1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9c1510091d50c5f07ceaf0226b44df921cd4ad832f3d527a2de396cdc9e56405
MD5 45ca9cffec21a526218e5da6921deed3
SHA1 4b5fa2d43a534aa885b1a75fdea91cd8e6e17e61
SHA512 718ec522aaab251b29ad8e2b69f63f2288000ae3e18629778dc88eda00d052aa70200a858e8bbd2dc3b25a7de2586f8c4393b0088153eb31592bfc56aecf2872
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH8:oQvGAdlCEL8c/RRNw5CED527BWG
TLSH
T112266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b941b69ac1507c5c8c9ccc9d885cee76cc21219806398c64d329fe228ea60fd7
MD5 fa6e4d58dac5266a910c45b8294450e2
SHA1 2ae39e3235b8890abc7f5cb77769ac384d3e60f5
SHA512 49a0f2cbe84ecde268253cf8ad81a6c80af191c70c965f44ae1058f4c1e1672e8582bb9b7b1066e782ab6986f2fe8aaa60f1d3ef5040ebca51de2deddf01a372
SSDEEP 12288:9AwSfxL/2Dc3DDLLmt0LDQewsAj7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:uSewsAj7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13675E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 84eca39fd64d25aac6378b50cfc285854e970b919017dc253965a67277bf7753
MD5 107a412995da138a81e6282f41855414
SHA1 091065a9764f4677593468a6f5536b648531915b
SHA512 1f5dd214c3bb6d3b3c36773544f5b64c800cb331802f081a81b35e5cf4b6497f59967147ed5737aaa8ae21afa3bd55f91dcb224a3a51cbd044a361520b02ddab
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH3VQBWG:XUEtQevvqc2W1cpV2RI32OB
TLSH
T11D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 50753567d6e111cfcf581dea59ba079f754690891f7e4642810c6c3320584396
MD5 7dbdae1ad2fb4a6f722e8b2c18a9dd2f
SHA1 5de93cdf521b2c1e8a15671f280843e068da6459
SHA512 49386949f95f53ef0ddd65bdb3bd4af5d21d0c1dff4f15e84b7ab95fac93f1727aae35b439d2a8fe8b7a5fb18672f9d6e9bfdd7f76de8d7afeec9471817ce530
SSDEEP 49152:9CbRquA/m2yL5zifFiV+XenmE3/zPDmg27RnWGj:6oqHVjnmAD527BWG
TLSH
T1EDD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b2533cbe920897d2b0cd2ca39ffebbae02647557cdf5792ba67720543850f9e8
MD5 4945134a2fa91243c5dff6672e7e88b0
SHA1 be4884adcf04a01991969506c40d1a61d32628f3
SHA512 a46da9265ba5c641fdbab995209be52b7f0e13c7187f4f8a7ea102ab24fedc58440f0a15b4600486a5c1bf49a35afc3f7167c4c62a0834f919c8b14318977599
SSDEEP 24576:3AhGL2IFoiwtA5l7S53EsqjnhMgeiCl7G0nehbGZpbD:3AM1Foiq5wDmg27RnWGj
TLSH
T14A359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9e4e890b6da8c8ec247fd0f215d49fa975502c79eba933216c4ea3f66bf2d74a
MD5 1c38e76cfda2d8a2f70c0af66e11a181
SHA1 53644dadea2116d21a96d290201f7c7a7c0b846e
SHA512 cbd28609b3a950c6750259b70370f1f94ea88dd634d1ff2211b78095843fbea576fcbac93570fe1fbf5c21ca82a425963fc5c302ee7801432b8cde98042c9271
SSDEEP 12288:mmw5HEjsChNSBFgl0WDm+CIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wuXOWXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C65F14A76A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 de34031aeb1b5c08ba729bd155c1f3238bd0ecb21d9e95e5fe7de18b2d083dc8
MD5 4b4d6ba80a86ac237028f023b2a5d932
SHA1 a1801a5bc70cde0ca197ca310bb39a500981e220
SHA512 e8553dbd0f5d77512398b1cac25a88bcc1e7a5a19ae6d0dd15c7732c2115f8aa46f53d6bd21c8147ee4201dc7307f0a1cdd9510da1a5fa5ffc1729f72a4c09ac
SSDEEP 12288:m/Z1IyrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE6:6Zu6sqjnhMgeiCl7G0nehbGZpbDU
TLSH
T14D5512AE239820FAE163417CC5E5D609E7337C52673003CF16665AAA6F73AC44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 56fffeaddc46787790fffdd9d2bde3b2a737842936160876eb4634627db3325f
MD5 8a36acd27a1537e84e39840e108487e7
SHA1 0b865d26c5af37338258301eec9617246cefcefb
SHA512 96d314bd3e2597e4d364ca559bda29573bae38475401f1a5940e35b292dc7b1ef31b8074c3f054ea79df7b23bfd29ff9597356edef54ce6056a64edd12de7c62
SSDEEP 98304:/QRQyi36YOcPhLvw2gAf+PN3VD527BWG:OQyiKahX+PNlVQBWG
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 35d47b36440d865ca7e2752117801af6040a0268e611725d708e9f9d0f9e8d99
MD5 aad3bdf367d58dd5d05952e2ca9d1515
SHA1 3c5c50d0c258282d1a09af73b41a45905bbd25d7
SHA512 3d13f54572a952b14dbfb9e6c977acdc1afdf56e7e76b4eacd94c1a20291190df29c15223324e56133a8d9f47e780acf2123b234134a59f6ff6a060213dee892
SSDEEP 98304:pQRQyi36YOcPhLvw2gAf+PN3VD527BWG:AQyiKahX+PNlVQBWG
TLSH
T1EC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3e0c31cc27cdd9a8ae021618297eb4061e0ff584bb44bfb50a09af91c4d2d1f7
MD5 1fe014e444d145aead99316233798ae0
SHA1 3b2f58d24c8f841eb62770ae78bada45bf0eaf1c
SHA512 b77d4fa74359f82fca3a4697a770ccd69c68739f77f6102beda826caea61082fb72c1d5542fb363a8816f3e3d41114e17a324c1dc8e4cd8220ae0e527459b8c3
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0KsqjnhMgeiCl7Ge:P68Qg55nhceWu7PNU3//Dmg27RnWGj
TLSH
T18FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5e56f7d074e67b858afe5e231c8cf669c4e04ff92aa47ed586c82bdd7f9d76f1
MD5 c92930fa259944150ef4c0262b7b4748
SHA1 159ce454279ae3eec355bdfcdcdb228fccb8058a
SHA512 3975111d0b57b85bf3b7a553e7e97ca660800a4aec4e73107e5cbe688e6a5f0a2cefcf49fc8d13aaecc21fb95f91be8d920468eeb5588e30bc60dd5d553d7dfc
SSDEEP 98304:cy5112gYy5azzVva69nLKnhZqD527BWG:dLIHjWhoVQBWG
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d8bee9e3b78f7424da7cad33d7ca6cfbec23064ca166250274a4483701809017
MD5 c486a839bb95cbac448b5b438e6f7b15
SHA1 d5a729dc6ac9cd774fcb3fc1a23a0ff9f0948d93
SHA512 81d6c927f5a719b241d001638137ee925922861b95c3de14a0ece7f8391033388b2c3aced05b15684d4501f72ce6d51695987ebfcdb77afbdcaadc86438c1385
SSDEEP 49152:SB+taZ3usBWOBr4tEG20bqx0z+n217aau1glADmg27RnWGj:gu6JmUxd2dAD527BWG
TLSH
T129D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 47b265d8ae24a8500f1305fe08c29e53b2f7950e0f22f54ecb41a2da8dc90318
MD5 27878c7eec64a8f1ba34b3e3b31a956f
SHA1 be6c1b256fa310b770a2a0446a8397f34180969d
SHA512 5aaafe471c56afbc7baf38383a9ef40b6c7e59b344c9859d420d47c6ae7272cb548397310536b8cba3d1fe758df1210068ab5ad4fc98ea748cb3d4fde28b0fda
SSDEEP 49152:U1hpsNoJpF1A6BU44CwH7R4xJDmg27RnWGj:UmifPkRAD527BWG
TLSH
T171B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cc1886e1be20255ac6aa0d8f233246ff7e9638865476f24ada53390d32774a70
MD5 a06bba51d170996f6db608bd5115ef5b
SHA1 509a0edb94d20594611849bb2473f5f33eb7a946
SHA512 7efd8cea3923a9993fa355af745266d3d2ec4e00d3499820720fb2cfd61ea998b3cec9524dccbdbc8619f2381f7429d6ae8df4e065b13fe3a43fbd88ce12066f
SSDEEP 49152:pSuZQIY0Be2KNRVtOnks6NMHqODmg27RnWGj:n5dKvi61OD527BWG
TLSH
T1F7C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b07569a6e8a9ae891e72d3ba7681bbd3ea10f977fc1aa067765b96fdd7530168
MD5 03b64960d94ce72fa7dccc8a6b41d5fe
SHA1 ef8bf9db4bf172be827c6ab1cb1f149469d9ef88
SHA512 3fbdb93113b41f39d4ce0c796d0a64c3f4776a9892827f1eac93695d9739b3582f096ad941f9ac310eae6e388c1195fbfbe47b5754ecf6766586484b45a909c4
SSDEEP 49152:ThtSn8EApI0figXgiDn0AP5w9Dmg27RnWGj:SX2iyphsD527BWG
TLSH
T1E895BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 49cb9c2e748b85542cf7cb249bdcec6b0cd45558275fd5404d8cc664d712a9fa
MD5 607df8854a413c61c5c5400c395d08cd
SHA1 2e1a9eb5d139e44d99a01bf3a1e3c0568fcc37f4
SHA512 d0ae444edf1c505a312964ea0c3515a54f3be21008a05a16cc8a295aabaa9a7aa4562e60fdff40740f973ee451a156eac9f1a330e3106d85b54ab7cda8872f96
SSDEEP 12288:1uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1usqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BE964C51CAE52648B5C3E5F10DAC073E5BE92004937A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1b6f878e3ad088951772133a38809a00c9076ad8787abc9ec57ef775248cff19
MD5 560210b856ef3bdee5d7bc7e9de90b44
SHA1 3528c12587fa1d70b77d574e1cea51ee55becf3e
SHA512 490d2cddd9ea43d98e0c72e9b5629ffecc8268bc09f7741613a90f3558a29ac32724620f48d10655c94ac569290df4de4daead6279e75a95c933b5a39bf8f9f8
SSDEEP 12288:pvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED4523BE964C41CBE52644B5C3E5F14DAC073E5BE92004837AAB7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5ca53b47bca6eaca7172615ec096e1b30dc01ae62ec8eecf57ed71b80fe65bf1
MD5 4edd22ab109c79395f25d601235653c2
SHA1 9e3946e95e2a219fc56cd98464852559cea53c49
SHA512 12eaa618aa2689ea586a53b6e62a907749217324abdb068f26cc11af9521d598a201721f3d38371245f66050331a1d9ac3081aa4eced998a56a10250ea90b954
SSDEEP 12288:KdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1754523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e0afb47068c0d261b11ed0e540765bdda7650193ccd3398e75b4d1b1b191ba7f
MD5 912eb33594fd9df9ea7f2dbbee347daa
SHA1 61e68502eaf33892d5cc83de70699c25fd715c96
SHA512 85a48741d69b81accb146b77b755bb12aefa4f79637c6bd03732f7f8644262f9191d2586d67a01b852a21e9b29ddc7b0da5b2bb9a0f5882247e9f71b65e942af
SSDEEP 12288:jVkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T13345236F675C00CAD83285B4C2F5E11DE8277D56EB3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6a502e2473414254c614181333118545920408cb618f38c2f92315d8b9019a25
MD5 537de5a7adedd3070a6f6875ee95f8e3
SHA1 aed492ffd67dd46dae838cbf4a158a6ede364171
SHA512 e2753885f8f1fa6ce6393fb900d5d1c18d0381cbc12bc76a2650d70c99a386f97657bdd6309290fc13c5b60b16a6c383393f3326bc1617043b0424dc319f1687
SSDEEP 12288:scXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:scsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 08ba9b1c5ab2c6a0f0266932819245426733eee74f717c75c2159dc180a3ea10
MD5 eebdf1711143f8dd40e6323d3d000717
SHA1 2b0add85680f1d3d7838d6b3e2852be328e616df
SHA512 b6d4858235d3cbe7c0d5620906602b49fd23cb8d8dbb77ab3fbc9ebae53f47b45a49ae81f38085d0a3cc39b02cdf031a0796fe47b748bc69dc10d990e5905393
SSDEEP 12288:djXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:djsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE964C41CBE52644B5C3E5F14DAC073E5BE92004937AAB7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 de577495cfcae4b97d7e5c3dbd734e6f96328ab92b89264cf5d6b922cf79fa81
MD5 f1139601f354f29a604d5cbf1bff3e44
SHA1 2f2cfc196ee759ae561196324578a1b44446b151
SHA512 78340aee6e602dd84ab7326749f0fd40de01ff29ae7198a1942ae276217e434bcb9ae4fbc1d113e6219e36da667ee6ff554bce559720db55c98d8d134d633423
SSDEEP 12288:7nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1094523BE964C41CBE52644B5C3E5F11DAC073E5BE9200493BA6B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d4cc08832c0710a7d137353436fe104aa96b88877bc6ca96f367f872d5f41e0e
MD5 291cab9ca709c5ab722e201bd04c36e6
SHA1 8f98a7eb27db160fbcb8adafcd261c1be9527c14
SHA512 08a4f160ba6810648b99c4dc8f4a377c5007043403bbd69d3e8c5e2c31987da64d868e3c4e80d80fdaceddf396dfe04d34b8105c91ab631a4d05f8f6c4494a27
SSDEEP 24576:nZMMzFVSOPsqjnhMgeiCl7G0nehbGZpbD:nZMMzfXDmg27RnWGj
TLSH
T15D6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 47c687c0cbe45132e6fdd7761fe1107d7c86af1fbf61d6406875e5fabeeddf99
MD5 0db6622a594d070824692c497b60c88b
SHA1 5f1237966dadcf39a3e51831ef41f0679102501c
SHA512 65bd9ad32c74e9c6d9cf6ff66ffb09dbaed0342ad93225e88ebae83ed0730907a68c896f519eb3b4fa0ad99488dd0163a9a26b2ffa5979d8ab07c9037a646d76
SSDEEP 12288:jqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A34523BF964C51CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 78e482a7c5fed62c2a1ee87a9ae5fa6fb428e73a44bd1d1067e0a3940f4b9363
MD5 8b79a0412d5688d1398b0eb3b6e99df8
SHA1 f89f3f2a5bb2f60aa572d8f1382019f044459b31
SHA512 eb091a0bd80881a421c181d602965bbbcfcba3cdc4cb78e6681c6edc2c7d8aa04c4321d64df8c9b1895dcb8bd8a09498d73f4289250de37e0fad7e32b887bcdf
SSDEEP 12288:YWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1914523BF964C41CAE92644B5C3E5F15DAC073E5BE9200483BA5B7CBEF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 8115a0222f90b8e5ebac0f6a3873d77e313f6776114aebdf25a4f298c9c7be75
MD5 068801da6cdb65f0b32faaa03227d806
SHA1 aac5f3b3f5cafc32e395764402964a4f0f1c7982
SHA512 684cbfdce6d21c2f281e1d59b1efda3cd069436db79e74152b27f7d90c6a686a707b8a0515d548ebf18b5e89cdd54920f6ec2e1b070bf54fcdfbd17f98ccb5c0
SSDEEP 12288:byPz5L8rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WzyrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c09d8682ad6040795d0e9c18be8706c44b3c0078e23d77e2913355aa6b35a9b4
MD5 894deff89684d331129b0ce59d488dbc
SHA1 23749992e2ade617094fc58aea84dc6eecc222a1
SHA512 b1c3d711265088183e844fc71a403a0d8c8d7c88b443f76a5f90a209536641bb65a1b5fb6cc42d1f25e11b533f56fbbaa3bbcc393853a799fd6227aa813a71ec
SSDEEP 12288:AqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E54523BF964C51CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3be664a1b8f20930d4cfc3cd437aeb78811bdfaf3ca906da0bc1aa21dc873d4e
MD5 6c43583e36ef2e5d6abdb48a96bcf212
SHA1 806a7fe7002d122330aec3c3d286282d60b04120
SHA512 86dd7f633a8b674ce2a9e243fe2e7ec6a2409ca97ba16914e401d8778a2b2f40aa1809f2de5965e336dbd77ed41b022040eb8d2796d75026e736639af2adba7e
SSDEEP 12288:YqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BF964C51CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3f932fb5eb807d8c79632096d64fdfe50ee421c5c2adb1f718cb772a2ad51a61
MD5 d7fe513a5fd6618d16b73faae77f2de5
SHA1 ba55d8e8f025b0a55b0f1692fc3c48f323a1a341
SHA512 0e871d11926de37d711149def1c8d64ee41cb832265bc80f95029e88f6b29d6c730c509b21df3b2e40e057142f6268578568e3ce85cae70fa60b5bccab4f793f
SSDEEP 12288:kyPz5L8rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zyrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C655125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8c7290ac38ad671ce3c7470e86eacbe4593767526846c11b46600c7e8b00add0
MD5 7d60788b7fe34d11fcb958faead6d138
SHA1 c615603c95e5c59795b29b7278a7c37f1865312c
SHA512 11c894e73425af736b1ee0705c26e4d1c483b93bc463ae09beb8d28faa0bec05f5b21e279739c187dca8724c72eb811851ca86d0176e9eb605c2090e950031e1
SSDEEP 24576:LT9aLl3z0zDtsqjnhMgeiCl7G0nehbGZpbD:LTQLljUDmg27RnWGj
TLSH
T1D16501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5e9fdd1bbd28c7f4377268513a53a32f5fd140f89a7c5c8aed187c5e368500aa
MD5 ba0abeaaf68d870fddd2c68e9d150cde
SHA1 3ab957f88ee4944d6097ba9936760da8c97cb0d6
SHA512 5ccd0a02f93d5f8f1ccaf19ad1ba2cf14dcaf31e9411600420872eee8e0bc85d36b0b21978526354e606920c9058adca6b6120f9dbbb2b7393804b44524a9c64
SSDEEP 24576:/3td9CHKy7GZhsqjnhMgeiCl7G0nehbGZpbD:Ptd9CHKyaXDmg27RnWGj
TLSH
T1FC75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9b4e81a3f141d03840a5892fcbe22f6a1eb6b6803e0a76bd466aecb51135f2cd
MD5 719965131e3e643670bddeaacae7b6c0
SHA1 65ef4dca180b4f17129b96da06ed525be15cc694
SHA512 9f7e085e7ffba742fd490cf07cb5dc8f7ff7fb3857c114264b6df291c60ec1a8b6ea01f001c780c5c4f8b2c92e50cd8892081dc8c6adfe6f6616bb10b6039c83
SSDEEP 12288:L9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BE964C51CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6fca263ce2e00aa78cbaf04ef0acb47d7dc3ead5d673303e945db0098ad120e6
MD5 6f03aea97161ffd3c6d5cbe1df75a093
SHA1 ee30590370da22b5d575032e6dc83adc679a5648
SHA512 1bcef15cd13f4f8e1dd5f6ffb9adaa17f3cc72c22472114af64825389e6b5ab88d4fafdee0cc7477074286158e67410f8cc9c094ca97b01504f4cebd05021287
SSDEEP 12288:ILXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ILsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE965C51CBE52644F5C3E9F10DAC073E5BE9200483BA977CBAE7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a4749a12212bc3e75f2bac83eb62f2ce17020c96e992592256ba77beb765c7b4
MD5 0c71e6ca327a36f2c4643d17e2e83caa
SHA1 83e93b239496e0d378eecc0a879bdf1019679216
SHA512 11240227a55b3d324c293b0a3bd91e7d82315a7d64832b71ac60feadfe63cb5ce338c59c7b15b58923a21626b163b3396424f96f6256bb5557e4d6e4b21b0e2d
SSDEEP 12288:VgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D14523BE964C51CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c4f106583c6db881b9c26ef3eba1ae6ae679ef2493f1afb44aeb97ff9b88e6d7
MD5 04fb5081455633fe1803e27e9c5f7d1b
SHA1 e185b2adacdcab8e13f6311f3a05b68514d76956
SHA512 8827a9037c2eefb75d547966e836bb33bd6618fc82ae9ba719d2e636c109f3369b8ac55969af433845e0713e0534a52f8436d9130a294803119246d505da6514
SSDEEP 12288:4qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 233204f8f3da2d3d12a7a7a77fdf7272b0d2065e3ea50b651f04fb442409988d
MD5 6ea04192df5cecb8b8987546c6aab5a5
SHA1 d50044c34ed21f00ca1d18ffd68f35d53413ca57
SHA512 577ef90148392aa4935123c7aee93f8a4d840781faafd1bf6376ca8eb9af0d92852df062299bc0510216d254a086209afb19fd0660a85c9220540c7d9a6701c9
SSDEEP 12288:g9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BE964C51CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 175f73af1ef670edfe8ca6d1d66a111872ee096fd6228e740c368f8800b7d846
MD5 854725dc9550a2c8aaaaa24602efc661
SHA1 5486b7d50f56cf2a0c475c31d2ea76f123f36f9e
SHA512 edf279d2f7e5a816623ab1f1d165f42a19b3cccc5dfb6a2f990731c20eb1d72691e9a017480ce995ac9f8ad66c103a6ec71256d50b701957f112484d66b4ae87
SSDEEP 12288:YCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E04523BE965C41CAE52644F5C3E5F11DAC0B3E5BE9200483BA9B7CBEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5c3dfdaa90deef1d377b1d162cbe4bed7473c3b169517ea691bcd6f25cc6e8fc
MD5 e735242373a66db8c1135f3998dd7a46
SHA1 89eaae6cf6a4eb0da34780cb96fea2c252d45cc0
SHA512 4254a1c547736c1ff409c136cca9f7c4b0076f76f0edf12bb27ad2a2f536e328ee45a4605ad5ac091bb52be94c3845511db5bba80a40b6c3eff6d271d8d22a2b
SSDEEP 12288:rcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 aea68291b88ba1212b718f8972d6d45ba654920ac4e92e1819db8f4124129c67
MD5 0492b7056f891033f4e18ad22b279594
SHA1 da7a34724480bd03f163e3ffacca592cdc88ca8c
SHA512 c5148e9b3deabba7d42944abbda8f21a1c9250539ce91583ab70964d05bd63221cd736a9dd9e41715b1a74dbf1b5f7865e9312d6169e2917a3b24f9d20901e0b
SSDEEP 24576:bfwvok9RX6wkyAIGsqjnhMgeiCl7G0nehbGZpbD:9MnYIKDmg27RnWGj
TLSH
T18585D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3c051f082289785b8d557676da56b9fbf232012fbd522e3fe4870390c4666e58
MD5 663b79348b67b269ef8799fc31312355
SHA1 72bdc48ec72a8ae0b7327d5d17614d69217dceaf
SHA512 fd1dc26a6f0aaaebd20296370dcc60e7459d02b7e1c03776ef68febe5668967d0133a1b781a74856441d94028564b358a8058754d391dee35f65379095eda4e2
SSDEEP 49152:RYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dDmg27RnWGj:vySzP1D527BWG
TLSH
T1D9066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ce6c76b8b0969e68a85d68416be33e3cfc8a4302da6243ed48bf81d1664152d7
MD5 31476764b2f8fb00487b55ea2b3876e2
SHA1 83bf1d7360e0caf16fda64c232f905f32d722cb4
SHA512 48b017205cb92f9a698cf9a796f32d76403a4a267664241ffdaddbc78794dec8d1f86f6d3f3c267ba984f930eb0ec89b88ccf5a3343638d29bb221598459fc8c
SSDEEP 24576:g47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY/sqjnhMgeiCl7G0nehbGZpbD:g47JUQj4irIhCnDHUPfF/NDmg27RnWGj
TLSH
T18D65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3274829280eb3b047d6db9b3985dec583d83d3207e2e6c33a908737f01afaa93
MD5 c8bc712f0a9ff8b5424a054de6b50363
SHA1 8bf61682fecd9981c4c8cb41e833c7c7540272c5
SHA512 b1f282ab18bdd9c701195d13a411043da431671c87656fbd717d6bc6140e6784df1bbc149e6a908b3df8f6daf244aff52cbd1318e366387ce02aeb7bc4839b06
SSDEEP 12288:dGsf6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C355015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1e3693f7441ea3378c638e6d050167a8e47708ad8f440c1eeb21f93eeadb173a
MD5 92afba447ebb6fe61612144ca8f12ba4
SHA1 c37c43a9d8e5de25185a598fe0d9187f6611a5a7
SHA512 06af69315066529ecb0f64defdd0777c5bd16c461a606cd096592c54c4021e87280222b8f47dc6b89d87b54461b7dee6e788e0dcd5b64f7e09728aefe5d25968
SSDEEP 12288:m0WkpU3fZZUTAOCUp6supeHDSnNyDARMYf3VCfLZMKqAS:mZ4UPZIwLcHDSNyDARM+3OLZTq3
TLSH
T173452941762AC74FC66940365E33D2CCAB707C11EE05AF0773C99B3F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a15e6761fe547c67a5c3b5e6ed729b0f3608a613cca308ac22ebd34b59c30ec8
MD5 830364b10011b0f75f995d09cbad292f
SHA1 346da5df50d6e2ccb66eb62d8725084415842f8d
SHA512 2d0c5fd70aaffe8437b3c8574d8989c6a2a3568ce269a7f06d82c41e43616da9ed14926bb4883b984149587f9990f7a66649ae8952635be25486085e355432e6
SSDEEP 6144:tBLbbmBSqm94AVxLCNIYW11vfbLavlD9tMxbD9tMxqZ5pJbHY6B/zFvwlvG4B0gn:tBqbGQ2jPvzFYlv50Y
TLSH
T1E365D940A537A38FC5BA6032073A5B4C7BB4EC12B7456F26B3C8553AD86A715B1F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1fac3f6c0c225dfa7dc8b778f1723db56993eb3e8a0476035ef04cb6341a21ea
MD5 77e533d03743976c49bf7b87ef92aaab
SHA1 e5f976cf576051d6a66d09d6d687609b7228119b
SHA512 6829fa177d1b9e4a273ddb5ea947cceeef2ad5ed5e338c433e2000eefdf4fcae99d1b2258a9b39c7ea6804394dea81473b1370ab234869071306da77d8f6f85f
SSDEEP 12288:Zz7SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F45237B934C518AF83605B482EAE12D680B7E6A9F1044C3B95778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4c8da81fdc12d44dc0a3c6eebeed4ad00e369c342545e657578fefef7cc55292
MD5 7c818e9eaa62bb64cfb70e06bc9b05e8
SHA1 983aa29cffa064ecb5db6d5bbda5188d29ea27b9
SHA512 8f9cf13fb50f2e58b6e1c03cda0a15b304361ff67df78149456dca3c4d24beb0ff21da17236581edc730ee645b2d5864ab831c8e5c852eb372c5697fa98ec8b8
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYosqjnhMgeiCl7G0nehbGZpbD:agb4mBIBhGFjDmg27RnWGj
TLSH
T1F3659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3652319fef57f5c2c91de5f1caa62b86f4fe7664044cad92f3bdafcf72d6a42a
MD5 83a7d2acd0292ef07e147aa5bdbbdc31
SHA1 f9f7151c3463f075a5059158d0b1a21d31bb50b0
SHA512 9ae71c9dcd6368ff7f81adc3cfaca96191dfebd545a8aa8053619080bd6711286e40967df55aed56acca43d9d6478c7bc00b5a94d70130a96a0914a4f9f65947
SSDEEP 24576:BG88u8FpJqH1Wzria7/mPsqjnhMgeiCl7G0nehbGZpbD:E7ZFPqVha7/8Dmg27RnWGj
TLSH
T15785016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3b0155de8f6a519b484559d143c55a909bab48b8846f346c0792626e4daa9896
MD5 cb9067dddf1aec73c489458f114991e2
SHA1 1a2aa33f2dd61b2b24773470b89350d48ec3bc66
SHA512 28c1e154fbf090f9c523dacf4097a985d934eb758133089ca837201d497e66c7edf03e76e28e2da62a92b1e86f41bf19c2e6dbec43f221fdba8fb94c2313c934
SSDEEP 12288:QHvUrBFrEjwaQTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:QPUr+NQTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC65F12F62AC18E5E676E17C8682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bd3d3f1257c5e8137da04b1128f2cdbfc235888e6e4ccdfa2dd1e98829eefb11
MD5 4b2471c6db3a9bdd5077a28f4b667bda
SHA1 4a0c683c8491ab018b42903eea865131e2ac30f2
SHA512 7ce335e58a5ea654e2af8942c8cc9853bb8a991cfa1ba7c7fc1b0ca1e70eec58990eaf89043fccdf8ccbb9316ce59f6a21cbaf579d09b823c501f22c456ccb2f
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnDmg27RnWGj:SG05lO43byD527BWG
TLSH
T1FBD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 14c9704226b4631963af1abe708c0ad9d136117a5b55eead0142f2299e91a4ba
MD5 194305741be99ef1e9ffdf44ecd47c0b
SHA1 900c6945ab427b8d75b53656247aa69d650af166
SHA512 5b1c706a4b6646799dcd124776d64948b9030baa808c72f1f295154e57eb9b5c66abc170b7dfc9d2f5a9d1130de2bc2361949de8f57d73ff55ecfed1a05e18ab
SSDEEP 24576:hfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnZsqjnhMgeiCl7G0nehbGZpbD:ha5POZ39Jt2pasx2+m/Dmg27RnWGj
TLSH
T1E265BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6c06355a0d3c41da49af598b04153ef67ac74a75e332d326a222aa95a9bfdf22
MD5 49ab220e75587952a773a43ab91f984f
SHA1 419c9793485d518be65bb40ffd702e52ae65cb23
SHA512 245b12d808dd521fcc42999ce539419be8511c9f16450600ac9b741be7ad49b265571a66447d080b6888adc0ffc6697b3276c805566d3fe140b68254a3418718
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7Fk3sqjnhMgeiCl7G0nehbGZpbD:vNc/zEOVHFcDmg27RnWGj
TLSH
T1A0857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 876227bfde67705226001f460e034e24c25503bd3c6e132fdc0b0f74c0272ebf
MD5 c41944e06e1b7894ddfda01b0b4c3b3c
SHA1 733b53970561ce063c9ae7653f53b0c6764d914a
SHA512 4df5728275203beb3b1877c2cf4a0b2e9b756e7a55cf936cdb2427d104c1acb7d5ec68a51d14926a28558604eca457d300511c7cac7189ae784cd057b513eaaf
SSDEEP 24576:jtkNvNnaFeYhJNtmZBmIsqjnhMgeiCl7G0nehbGZpbD:jtMwBtOm0Dmg27RnWGj
TLSH
T16855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ca12031a602d1aec5b0c8b11fb7f4c3d2e2557d04a4511c9c79af14a7d2e864d
MD5 7337d2f1df00b14dd5e6af96a23fc5d8
SHA1 adfb3c123ac77d364bdc16bb2d9eb4c84893f261
SHA512 89d596e3783e3e388627d17d3effabc73d87d930850630585dc4d0b2e5de4a076dce185fa1b23e2d824878b845a46fffd4346468c2bae0767a69ab7a51866e3e
SSDEEP 24576:iD3FHshBIYQgAOsqjnhMgeiCl7G0nehbGZpbD:iDVHeBIAAiDmg27RnWGj
TLSH
T18275E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/768-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/768-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/768-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1324-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1324-82-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/1324-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1324-87-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/3240-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3240-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3240-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3240-330-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3240-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3240-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3876-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3876-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3876-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3876-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3876-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4196-39-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4196-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4196-8-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4196-9-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4532-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4532-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4532-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4532-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4532-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4532-317-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4592-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4592-118-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4592-124-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4592-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5456-54-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5456-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5456-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5456-43-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5456-49-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5456-50-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5852-58-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5852-66-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5852-64-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5852-280-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5968-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5968-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5968-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5968-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5984-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5984-71-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5984-77-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5984-297-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6136-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6136-139-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6136-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6136-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6136-130-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download