61c94196c36cdd4ef9f27d061a01f93c2ef0bbab0d8691e8b02494fee44a9ac4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260808-r1plbsgr2s
SHA256 61c94196c36cdd4ef9f27d061a01f93c2ef0bbab0d8691e8b02494fee44a9ac4
MD5 3f583405d60a9736a51e1df869d0e52f
SHA1 bbea040b9165fb2150a9e703b8f916d3a2b714b4
SHA512 931a6fc8f958f4224d0dfa3a0b6d6b40675e099400720ce643714ac839dba33be8eed16adf58af16fbef5db7d0d7056ec673fb4bd658be9b25bf168e910acb33
SSDEEP 49152:m+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN75552:v/PvOcjcXvvOOc5nD527BWG
TLSH
T145165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3644	elevation_service.exe
4692	maintenanceservice.exe
1696	OSE.EXE
2516	PerceptionSimulationService.exe
3656	perfhost.exe
3332	ReFsDedupSvc.exe
1644	SensorDataService.exe
5592	ssh-agent.exe
4588	AgentService.exe
4268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1bf1782bc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011d53fcf4327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da3a83ce4327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078f2cacf4327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cbc16124427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000365c85cf4327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083c3f6cf4327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fabc6ce4327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc73a3124427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
1696	OSE.EXE
1696	OSE.EXE
1696	OSE.EXE
1696	OSE.EXE
1696	OSE.EXE
1696	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5500	2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3644	elevation_service.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3332	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4588	AgentService.exe
Token: 33	4268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4268	SearchIndexer.exe
Token: SeDebugPrivilege	3644	elevation_service.exe
Token: SeDebugPrivilege	1696	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3872	4268	SearchIndexer.exe	103
PID 4268 wrote to memory of 2196	4268	SearchIndexer.exe	104
PID 4268 wrote to memory of 4404	4268	SearchIndexer.exe	105
PID 4268 wrote to memory of 2440	4268	SearchIndexer.exe	106
PID 4268 wrote to memory of 4540	4268	SearchIndexer.exe	108
PID 4268 wrote to memory of 3912	4268	SearchIndexer.exe	109
PID 4268 wrote to memory of 5756	4268	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3f583405d60a9736a51e1df869d0e52f_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2516

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3656

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1644

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1528 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1748 1544 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1528 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1748 1544 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3b5c192af499296207613dce80a4078f74577154b0229f1405bd945e35bcf512
MD5 e28df4c30779cac5db6f9cb8382fcf1d
SHA1 21ac3932e619c93145bc846cf31b596f8e3c524f
SHA512 77130a1d35b5399fa412adbb06947fcaddffa86f30028babe654d0ba8dbd1cef1d34a864317f2707160da2578a3c5baba76c97df6489aff3b689a255ee59261a
SSDEEP 49152:Ub+632BuPkFKRrdE6ohrstBhuXjfS4LWxngDmg27RnWGj:O3q60jBvD527BWG
TLSH
T149D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f055f593c01eaa38d48984cbe20fe127138b39807fb61fc94000196de9f04859
MD5 f1b67c778ae5725cbf064796b0b293ee
SHA1 b8e6f7010b9225db7126e5d0694d6f3925c33db0
SHA512 41b7a6065f0850091c7624873b019d10e92b469515df3d37df3016cce79437442f5ce62e655672bcf73779ae62f4bcb809c22e4b641a3eb8072a935b54afe49c
SSDEEP 24576:3XYfDtczA/sqjnhMgeiCl7G0nehbGZpbD:itc6Dmg27RnWGj
TLSH
T146650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fc8d3b6d67b81b1cb7f6d4f63ddafbfd4871cb808e343281c320582ff5b730dd
MD5 4e93a47a1dd3b7017b1c836f7fbb77cb
SHA1 e4f57b039b58255e37369019fb4c5e360c6a93fd
SHA512 d3423590eb34bc80a57675d4717ba74e83790699dbe34858b17a6b70b435b76c8d909f3f185bef51234ae2e322fd52beb0b9b31da448179641a0abc59b22c315
SSDEEP 24576:p0Le5ji0hmxNrM4sqjnhMgeiCl7G0nehbGZpbDy:pPji0A7BDmg27RnWGj
TLSH
T119859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6825a8cebca3e387e4216a6425496ababe46ca284c36c66f9f74b280a31dc6f8
MD5 6522c97df92ad1148dacac0cb11f2c15
SHA1 078e881b440f4715fa4f88b27d3435a3933db2f3
SHA512 b01764d03ab2eac1bd7a5e1d0de84f7fff9b11171bcf16db3948dbf08798e10e92de3fb1f9f1d868a2a743432db0668605583d8bcbcfe6fb9f20000db0871155
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWr6q8wyu6sqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPviHjydDmg27RnWGj
TLSH
T15F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0ff5aef9c3abcfb24ad2f76044b96448124ee801f41f4c225a45708a14cf372c
MD5 cd83ddd89362a237cf3568d74981ff76
SHA1 6cd523726ae21a1121435d9f47c167060eac4573
SHA512 ff7e0bea85050baf95e5a7e7bfb115848f14e4be521088d40e48dd19192a5aeaa47306412a28d4799c0cd284b73f8c495dc9d8fbac33dbae98860098d0a4af64
SSDEEP 24576:2VbqPb88hv/l+brsqjnhMgeiCl7G0nehbGZpbD:2VO88hXl+DDmg27RnWGj
TLSH
T16C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5f2367ea34d74fb777e29c2a2d0a5dc0b0aff3d0b8bc0ffe0552260dba293cf5
MD5 ba69003d6dee3b062626be3f40af3d0d
SHA1 b90fcf4b1642eefec77e37b4f1fbb8db3fa297e6
SHA512 bd7294010f30d761a18c65e95784f7d71d9cc7a6de86549f9d17a211dd3186bbcf52974c589763118a2e310a6d2a325b2b38ce3abd33f9b3b973816c09d18cd7
SSDEEP 12288:ejsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ejssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BF964C50CAEB7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 685bfedb617c418aadf8bc750e0bbddd955bd6ef1e9cba2e64e2f667603fc678
MD5 0c27749a12ae4c36c5a55fdd21a04985
SHA1 66875a0954cf773f969bc8c7a8df5023a50a35a7
SHA512 2cd7aa2e69ff982e81de21bdfd08ab145fa35576b9fc004379a7265a10df27ffd224f4c9c5825883141230e84dbf33a83fd3028259abf122c7c3822a64c314de
SSDEEP 12288:NeBNUbTVO86UDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:NJIUDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D65CF7BEE28FCD2C27A4DB85791C600E76278314F61A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 85b3cccb5b05cf0ea00ae863a708d0a6d213d70a6a2a43aa69d0acacd5a9cae6
MD5 2c67fafc192573398f2b01c75bc9e8bc
SHA1 25a6d899206f8630d93e17d1365b23e5b8997b51
SHA512 9bfadb746ab66cfc44d2335b949afb37056c200a04a0988a7a83c6a4ad3778c00a81870db693887965d6fe28d99ba6ba909095fb8837b6134dbc4ea7eb53c540
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH+:RQvGAdlCEL8c/RRNw5CeD527BWG
TLSH
T12A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 44aff9b42a940c0ebb2cd708b8c054ded759d19d13264ea40d73727e33ae2c2f
MD5 6092734a51f9896c2dbbc129aea02c44
SHA1 3e231a3b8e4401c429315367ce556bca8f144ac5
SHA512 ecd9711c7b1198fca7b7f92b5d700251cdf57b896eeade82ed9c5473bac645cfe60d5be2e13d988e8bf6f7e48793d5a43e0fda5b08dc87fc3060788af0e1df1c
SSDEEP 12288:FAwSfxL/2Dc3DDLLmt0LDQewsAjtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:mSewsAjtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14075E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 935f805282e6053b9c1be2e434437fe6162b8eeea7c969a20f1faaa08ef4b944
MD5 e8e1a4d16f5927f9cdc055e20c095eb5
SHA1 5c806ef4e9ad1af7d873a0709e3ff0124053e4fa
SHA512 cabdb58cd54941fd2618dbbfcf77c64def3d9c182d7ae54235ec431c0314f12407e857431369529343af3b22656145de5dd7496f331167ae7d2f8260217cd455
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHpVQBWG:vUEtQevvqc2W1cpV2RI320B
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d5eea2e34f61c213d5d16533235a72f4ab322c232396fe581c9e64edc8a4b360
MD5 606c5cab964fd010f0fccdcecb846995
SHA1 f2aa97a7a15290bbcb8774ea69c386c16b78d8a8
SHA512 0c3111c3256f71f27a3fad1344f2bd86485dde7cbe354e3f13f736d0af18a3a9600a602cab932dc5b90e2a51fc20e082281e4f44880b6af71ba570a4cdba3b02
SSDEEP 49152:eCbRquA/m2yL5zifFiV+XenmE3/zxDmg27RnWGj:ToqHVjnmqD527BWG
TLSH
T149D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b1843603d59f4d19082e2aea17541e851caf198cbb782e86ef827960ae81dfe4
MD5 eb39433ce87fca019b788cbfd17a1602
SHA1 f0890b343724ddfae5972d58481089e3f7373af5
SHA512 02ed78bc0cdd1a75f17bf7c1ca946fbea67ee50fc1232d8b95876fe124fc80a6af872f42c1ff7b927657f26dbcc9465409bab6fa7a8639117b374a9aef5cddcd
SSDEEP 24576:2AhGL2IFoiwtA5l7S53GsqjnhMgeiCl7G0nehbGZpbD:2AM1Foiq56Dmg27RnWGj
TLSH
T101359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 18ee50c254e9ba48bb7ae44da939317fca327aa2179180269a91bed9e5105308
MD5 46b47d73e6dee8b1bb5c042afc791517
SHA1 308678e3b35039f20055898926b299fce97ee75f
SHA512 59e8f8c6d08aff1961034bbdca6bfa7b56c46d7842b903a648b9d6a11c8c172217be5c9b6fac14ae3a597fb1cd2816128192fa31e2eaadec08d00fc379863fb9
SSDEEP 12288:nmw5HEjsChNSBFgl0WDm+CmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:mwuXOWpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c1caac3ba38528d03dc5e853029e9bfdfd4e16d509259a0a8d1f6c0eaa3617ec
MD5 c284a3a032a8b88625d651e0b8b299c2
SHA1 6031b998356ac2c0670ef12f17834bb11b5808c0
SHA512 9604b07374732bbb73f59b8fe9abf34f8a6b0a57322fbbf25869e2ed2df5b95a41e6ce5b8c3678dafad6a3fb3f575fb87a06dd9cb073da7bfa60e41b4027b4bb
SSDEEP 12288:Y/Z1Iy9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cZuwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1395512AA239820FAE163417CC5E5D609E7337C66673003CF166659AA6F73AC44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 480b4691bf04f9d20591e93a8b65a0f46e90f0fa2bd0cf62ee53d681c88e84ac
MD5 9f316ccc01e5d3c9d40ca57c2a67ef2d
SHA1 3a0095b3b97954662154220558e8ef7e9e4588c4
SHA512 b7208afb986f27d4eeea4c3f97d464b2ef27f11eb1679bbe4079e937cf109b997d6833895fae6829ee0469dc2f5f1a3a175748839ce725c72593e5fdae4dbbec
SSDEEP 98304:XQRQyi36YOcPhLvw2gAf+PN3TD527BWG:GQyiKahX+PNDVQBWG
TLSH
T123667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 08849519913e92dbae787eb78b7bdb3709b991d54e05077bd44c2379c5b65429
MD5 3611bb74380e6480a9c0aa26ee816f91
SHA1 40a9dc8ddfc4f9ca252fc7477f463e2c1c6cc90a
SHA512 5ec960a4385fed28edf06f77bd0758d78166e8b320e801fbf2377d56f16dd2c3ecabd13a703ec49947ce458c56de65993fe8f33b930f8e41b8fc7a3bb0e19327
SSDEEP 98304:TQRQyi36YOcPhLvw2gAf+PN3TD527BWG:CQyiKahX+PNDVQBWG
TLSH
T1C3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 19c861ca4dfa920ef97d842eedc3dd3ae798c9c367093f3a1df626b96ea5e821
MD5 523bd0d106c524ee2836afaf6add756a
SHA1 b29ee37dd1ae51f975a2cb06b4d06074a5638a26
SHA512 dc4eca5d6f976c2d81a3a2d2898180e92bc403eb6aa1de06285c691aa870b097c0599ece3461bff1a0f2e3454a50f1f7d4ab7d6b113f2c08cece9705255d210b
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0gsqjnhMgeiCl7Ge:y68Qg55nhceWu7PNU3/BDmg27RnWGj
TLSH
T1A0B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7e15b66ca2ea5c7052fba3ce169be844fcaf66d410b43cdc7d8dceca74c16c9a
MD5 8e27b3774f092afe387aeda6457f6f95
SHA1 0e07b85cc2b932aab86c3baf65d96d6ea65dfa5f
SHA512 c0d026b3e0fdd9ff5c41b100543043f7451ad900d6ddfbb0776c808a5e6b15107945088400413ac0d1eba1ae06ea21258b4234b39aa41c475519f33d95c9cb5f
SSDEEP 98304:wy5112gYy5azzVva69nLKnhZYD527BWG:JLIHjWhCVQBWG
TLSH
T117167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f0fd54d088fab427b0bfb3e464f368c5892a4233b3bb79641032574cbc912659
MD5 fbe413def34de5975618c1b735fc9116
SHA1 071e88d27a711310d7e4256d4c4ad65a5414021f
SHA512 ef575e7661a5b8b96b6e192a7776beef9b8688a50401117d0f7c8d2f87292f7cd7e6719ae91f63ffcc7b424d2aee6014fba91bd17ee82af1dc81922add6f82e9
SSDEEP 49152:L1hpsNoJpF1A6BU44CwH7R4xnDmg27RnWGji:LmifPkRqD527BWG
TLSH
T15CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fb194c6c4e857a456ae99d3f61de425bba09edef88d1088837f176f8adcdc750
MD5 98a85174c3d0dda8469fef63b3eb5612
SHA1 dbeb71f2c40c070df1f60c1e26dc8ae6db2fc2fb
SHA512 f5aed06f304c0d03b9b012a3002b1b44bf57d44133588209b658c94791723eb9aa52167ba7cfa04cee9716e3fa36ff0229eeb8c02669b4bb7440ae3bc36ffcd5
SSDEEP 49152:TSuZQIY0Be2KNRVtOnks6NMHqsDmg27RnWGj:R5dKvi61sD527BWG
TLSH
T1A7C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3165933bd88991d07429f21547a466756a8f4929c885c37a61ee1935624fbf1e
MD5 ea8d16c5c9f83d91773a295a252ba019
SHA1 d5e6ad590a71e88c25b5e94234ec64965e549a59
SHA512 5fb18c111a466ba71b8dc4665a6bf9c6ca30d9a306655e23d6e19265c6c9553f0dc8f39f33722cc0da8a711846c78dd96273761b4a76db11054ea1a9dc251af0
SSDEEP 49152:mhtSn8EApI0figXgiDn0AP5wLDmg27RnWGj:nX2iyphWD527BWG
TLSH
T1C795BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 83f6679aef3feb7e23285a325dbce3d7d6bb891c1fb5d4bf415198289cdc0d71
MD5 e5e462af10b44b0d96e09fba36499ea9
SHA1 c1e7a063c09a34ac26c220031a21212afde94a2b
SHA512 ee5e60b8c56045060dd0a5156fc58e57a22fcdac19ba62138e47138b65b0ad9c22f9014e8179e1824954550f318c4789feaae1d9d31c81204c510ebfc1564e17
SSDEEP 12288:8kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1424523BE964C51CAE52648B5C3E9F10DAC073E5BE92004937A5B7CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 952d239726f13898b792c4cde31a56e646e5257c185ae5d4cafcd002fc5cfdf5
MD5 5b8c6e02965c10a092ddffed4d651641
SHA1 785d304c230ef225dddc5de52d519f148102a720
SHA512 cdf548f9c52d0f19ef83928c109194d218830b2996e0936af4e643b7e4b01ba68ad2d44bf931caa48d3cc61faa473050e4e705996fe826e207cfc4f1b673c0d5
SSDEEP 12288:+BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BE964C41CBE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b5d42baa7363759e8fb597f8a1090e11b0a186b48079d1d8805256d8b6e64c48
MD5 fb9997296bf4b31f080d5d826052eb9f
SHA1 b7491b0620bbb79925cd87128d6051b4a15e1426
SHA512 69512e238cf8d0217e2375c0bd6018d83fa4c9485bf562f62d580491473cf6588d559be9d59578de7559e37d56c5216a533b73c27311df42ebf5c2ba99c17696
SSDEEP 12288:7bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BE964C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2cacefeacee9a4daf90c4a58d6b85481d258671ca5bda3da118ae7a6972dbfb2
MD5 bd82df37ed5608fac7c3d89bb6ad4a3f
SHA1 ed8d49c586dc359d556f14e77917817833a587a8
SHA512 c537512082ce13907a488d5808e7f768036bc264b8befd6a3b0c39f8efc5354f3779de7b7d3dc506db2f3ac8d97364bf827af1be20e6dcacfbc260eecca1e541
SSDEEP 12288:xVmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF45237F675C00C6D83285B4C2F5E11DE8277D56EB30059B6B532CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d8b4c92501e676b324ec7b57ede2e84bfe0c2188c8995b0fdec7454e546fee9e
MD5 11df5221c449e086513699b5ad43e42c
SHA1 aa07fd0b6387b77b6892cea090019c5540bf1649
SHA512 470fdb57cc02f4a89daae8e75f6360915458c61ab1e94ecf4b40262a5e6dbf705d690f1c152f159e8c721731ba07b091634b48a32b8ea799853806fde7ce32f2
SSDEEP 12288:kOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BE964C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ba06fa9bef08282ae98670b93f93be2674d218cca38c72b4cf8fa5b363c17617
MD5 8c3e7e4f0629e197d792235d14a7f664
SHA1 11713bc00eb7ab18a947c3a3379922f711b1facd
SHA512 591d28dc44ec1b47a61b92b130d2c7eafeead57e62a8763b906adca6e17dd9d75a94f997ed0cfa83f7e3c448a9d6f34f52724d873dd00e8afad0cc25be76f02d
SSDEEP 12288:jFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1674523BE964C41CBE52648B5C3E5F14DAC073E6BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b76b05cb029b0ff3dbf0d9f544d6790506dd390b5997a0457059686afc3fb1a7
MD5 dd5bf1a0baf719531cef56aa1962a63e
SHA1 1b9cd688e431407fdeb8713e0e923c7b72ba93db
SHA512 63c098f41dfe0494a9a910f80933a071636ced3cc2f002e95fff1f31cfb40af85521df41e935d7cff40716a7c14604c2a71d18fb75e436df9a4026e02a6ac5c3
SSDEEP 12288:gpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE964C41CAE52604B5C3E5F11DAC073E5BE9200493BA6B7CBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 16ae0f282c8a4eb92383518ea2912cb964bd0e357a674d56a81ebb10f3bf50f9
MD5 692eaeac871e0014af113dac4024e9a3
SHA1 f5786d5a850700bf2ed45a46fb88af7b3dc62c3c
SHA512 e94150ba89a622bd4a2ebcceb381fe32a293edfdc1d7daec79a6283fcfe4c35ee33134c4433693340144b7f77e517b1f319e3c5f99e352fde1adf54d0561e7f3
SSDEEP 24576:IZMMzFVSOhsqjnhMgeiCl7G0nehbGZpbD:IZMMzfJDmg27RnWGj
TLSH
T1CC6501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8cd53e8ddaff764fe7378892ff1d13fdf0e1474d42a76182bd26ad1ab77bffb9
MD5 3fee4a3381e76e4b665099694f6e3f42
SHA1 7d544aeeb8f759ca6dbccbda8019670311a18289
SHA512 e564fcba56c837ed584b37c60428a87b13c1070c6522fcd4f583ec345cbe85e2fa2368fed1b554b1968e7a3b5f92be03c33a1fea47af2906596f843de67d0965
SSDEEP 12288:yAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BF964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 712b2b8b7d632ed96d696f6251edb2ba971a720e1610cbaa7cbcf981f5a436ce
MD5 4d9e426297e4b7ceaf5ec6fd352fd7a3
SHA1 3760d85d6e9b5c3a3f949d60e6f5ea9dbdee2a03
SHA512 768b4e839d003e5e056c1f195b76efb44e9f8de5cca43f6b6e9b5577ff0ecbd979dbf4a881f148fa0e823e2dd2ed921d1d53a119273e98ed46a50622435d977d
SSDEEP 12288:A8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1734523BE964C41CAE52648B5C3E5F15DAC073E5BE9200483BA6B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 04040ea66033fc0ac84dd2bdf79d7194236c45735e8c420ae31eceb24553b9f4
MD5 11f8b41446b275191866b157825143a9
SHA1 525a7694bfca3c1ef1d725337173b2f08910caea
SHA512 d3559630084bbaed05f2a88cdae24c72c147e8c58c81826c8b922bd086893e22f8c280786f9c07a196f89e1fbb0422968c934226ebcd29502aef95ee41cbb2e7
SSDEEP 12288:OyPz5L89Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Tzy9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10655125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 17ec36cc0cacb9da7c0b813b5475df6538e2e5d0112aa5b8c1ec59617d9226e4
MD5 e68ec6d0414605b74c72d804726e7066
SHA1 a9071aa81c5dea5762ca9aa0fed1b87baabcfba7
SHA512 aeda02a37a24dd747618475dee7030811a4fa3d0c95c536ce3696ce82ae1f66ff7c1336c66c708af1be2cb7523295ee656e84dcca31046c5aeb20c7eb34aa119
SSDEEP 12288:hAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1734523BF964C51CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2f8a9de0c217ce4d8e3c861e884863df8ce055675510d7cc9813d4f50605bad0
MD5 66701781292c847b6633ad565bef1a78
SHA1 0fdfe50dee42eb9898b0a38282fa8803ab953da4
SHA512 64e51a123f2ececd1077bb82f9af4c828f7325524fd37253114aca32432674c859ccd97e18ea8afaaa7f16f853fc09f333123044768899d9b006aeebc3da393f
SSDEEP 12288:XAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1544523BFA64C51CAE52608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7104ba4c236df8fdaa5fca41901b4a595ce85b2f56cf015e2e4dad2b214be113
MD5 a33fcd9386cdfd637b26babd5b5f2358
SHA1 16c07ed53c97b3a8f3b9c5b8fad8896f17da5b91
SHA512 861942361b48122c4f3f7d07904ff726d5ca95330ade0c15a4522b352c244b309fd22bb684fa8c144a8423503b8deb96eb910cab875bf64843b6b65413e0b560
SSDEEP 12288:XyPz5L89Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azy9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15055125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e0c33a07cf1226ab2bad63bcb974c10ff71a820ea73d81352f3054f3a70ae756
MD5 05f7f5bff2224befff418bfd9a6b1d15
SHA1 4b4fb150f0b4a0ad4c45d3d354e67a9d06ce8c99
SHA512 44bd0ef443f4d424c1742c5f800ce5eae375042dad03999af4fbb6508e9cdddf92afb3f0c9d156900a2c239a052f6d2140b0e4d494694668e7e6eb2ca9bb9094
SSDEEP 24576:zT9aLl3z0zDLsqjnhMgeiCl7G0nehbGZpbD:zTQLljODmg27RnWGj
TLSH
T1BB6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 626d716c6eeaf72321e6e3a9be74d4dc89f2aff7fa710ca81c3d566adb29a4d6
MD5 595f241c11259d4481cc0f0518ce7630
SHA1 ebe3e8d749c3075cd030f0d2af88ff279862fa95
SHA512 e533ae02dbdbe931d16246422434c15b28d765041344ca015c539d8d1e28ec7a83f1f2d62838381a2051b789e29d30da6de089a83ab94844bbe53252e4784024
SSDEEP 24576:53td9CHKy7GZPsqjnhMgeiCl7G0nehbGZpbD:Jtd9CHKyaJDmg27RnWGj
TLSH
T16975CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7a10f971635bc95a36b9955482f5b9e2f9479cd71e586f8f16d272c41eb1ad30
MD5 6321070a64edd959dda5e32740fd7043
SHA1 c386cc2054bb39728e7468a6470e69734dda9859
SHA512 6451ff3ed6fa4722155ed96572651a4369815819382453ef65dde6b0417b01d21c93cd3e298953b66a24e7dc45fe0553d6cc267c536d9ba2d9d1f734428f9a24
SSDEEP 12288:g7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BE964C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6153742f5b28390a8f395b8413d16e0709f516d287c747fcfb60f73b9f872733
MD5 0c225156db9bb0cd61791e39db7cb84a
SHA1 f769780c00676861044fc9d6f9f068f1b5f45f59
SHA512 86e0ea80b78e8fdd8615fd24e222705d86d16703fb01ab7d3a339eafab08c19be4cd6204428dcec091bddb6b43b227a319e88205a0c65c09700faa31ec7a67b1
SSDEEP 12288:mdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE965C41CBE52644B5C3E9E10DAC073E5BE9200493BA977CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c53ac58ad67a2562a9393a7ce183bff4a7b67328aa41983278e1f01d1d9fc985
MD5 edc964967544425b27a99e747a7dc02a
SHA1 7a0450e9b87aae5be20398caea427b667260ba5b
SHA512 39de9828742e6362cd61db5cda2b3478cabc1640ac93d322915c011c7145812198e41310d6f17d6f3f208fb160d534aadc4e565a69fbba9e8365c5d120ece46d
SSDEEP 12288:AiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BE954C51CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e727a40f639e8dc4630c531d8ace6abe45654377fdb4150a4503d0422fb56cf8
MD5 642bbc79b626f14cfebf7c4314b764c6
SHA1 d2823eb97585a721d605384039233a6a060e3778
SHA512 cf58d4e73d3d821c749b06ca02ad3c5cdfed7690fb2982eb795a7093faeba9600904f4064957f62104e482f383b7c2b574706be33893f44a30cf4c23ba8957b5
SSDEEP 12288:YAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD4523BE964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 49c0b24d5c5c6ea8e2f61d99b2d372ca54c2a7324fde9264032f36cd798d9521
MD5 973083aca79419585b6a9ab02ba7a37e
SHA1 11cbd927206203bb7e8adc105b2abfa97708e204
SHA512 2619968a590c3f33a25c7266ef4e32fa527246b3e1640b8938fc8b07e167b3bbb5e4963f5faf547f39d9d1a83ed0f5361251e791efe98af1954d820f3a92e535
SSDEEP 12288:q7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B24523BE954C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 42a14169a9c5f61bb3ba0f2dca4ec9cc0564cd875997ccb61cb133bc2985397e
MD5 cda16802ac2ba3ccb26527ebfcd308c0
SHA1 bfce23610c329afcd2ebb2615f7d26c6184fbb29
SHA512 cd1824c17250d595c5059490c0ded8f2c5baa688c68201b8e71bbe540838e27b5955cb1c0c60eae2f57135c28aed77e83ec1324e6b8a0b0e69cb0147705bdabf
SSDEEP 12288:PoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PosqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BE964C41CAE52648F5C3E5F11DAC073E6BE9200493BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d5dd09190e2580198f34b848469fa69ed977ee11bc0a759daca610ab96341148
MD5 5f57d243086d87bcee5d00694d4ff506
SHA1 a40698977d1b1cc0f696e8c7cb0146e987c43d67
SHA512 15f89333c8fe3e24862d6db1aa9c2a7a76a0263a027de7e758c04c32e55f265440ac70f0edeb98203cf734861e7423dc9bffdd71cc2421ab1b9a8126af59be84
SSDEEP 12288:gOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D4523BE954C41CBE52648B5C3E5F14DAC073E6BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 d766964e583c8553a82c3b9c5e81850492e57dd0c7298416c26c35bb3c4e529e
MD5 c630eec5c4312b4d6945ff779c06f4f4
SHA1 385b2a09fc0b2e7f780552b37d094a4304a050e0
SHA512 e80c027c23b407698d9a39c01efcd9d81797b8aadc8beaf1e9c4dd93e3987887daa963b6c08ac767029e2318474b1859b20dc7774ef122b9471629a98369974c
SSDEEP 12288:STXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:STsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BE964C41CAE52648B5C3E5F11DAC073E5BE9200493BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 01815c736329a74ba91faf4b5ab6127c70db37c208f49e16c6dda52a9e5e87b8
MD5 90a7e9deac7a845ab15ea86865a9578e
SHA1 0d126456264c6dcb077038c6ebc804b4a24acb95
SHA512 51b9085c9a1f2cb85b3e354030aac4e46b939a055c21c4f26c44f078ad7018d1b560a804cc359459c327f86a002866256b599c41b3dc00c9dfebd9c98db801d7
SSDEEP 24576:/fwvok9RX6wkyAIMsqjnhMgeiCl7G0nehbGZpbD:5MnYI4Dmg27RnWGj
TLSH
T13F85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c31e2abc1be5d75f3f43bab255bd7a699485a43e7902edbcb734523fb2f81f48
MD5 d69af5191b6acc838ba08bfd45bfdcfe
SHA1 29c6ef1a5f359132224972275cbb5018c0f2d47a
SHA512 0b1513af16f082e1730541f4288cc1828b26d515a03d9b67d8b7d426983e097ebce0ad34817d62f9604db321d8322aeb8f6de1e3e969ebf456168e6b634ba32f
SSDEEP 49152:iYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rDmg27RnWGj:eySzPzD527BWG
TLSH
T1D1066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 507abca3a05210b8464161c793cf2dc1ec881c525d16049725e664593c2d1bf6
MD5 790d42e1103b157d51b89bc0a95b82f1
SHA1 bf25abb2f1bba9d65013025b7fd60f145abd8c3e
SHA512 735bd8e4782c062adbf8b3d7c60911962e468e4786d932e283a5d7ba5f9a2278bf9e1521787dc5d6126dfd30df3d86ddce41fd66811a915d036279098c071aed
SSDEEP 24576:947Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYxsqjnhMgeiCl7G0nehbGZpbD:947JUQj4irIhCnDHUPfF/7Dmg27RnWGj
TLSH
T1D365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4dfef30f35541d24e88972155a3a756b8157acbe8d0d3871c3cc5eee12774292
MD5 5a9ed7153a0fa5ed7692f9c476f2aa41
SHA1 1af5463c1b76f5c2e56955b19074074668b950b0
SHA512 692916bc0435a2dc34dde08a5e8f797d0f3b08727439385dc3c7f05a115c3b89317c0f279c079d6aceaa3f97988cd1930e9c5df81cae54cc1ff27d7026da1f27
SSDEEP 12288:lGsfwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEf:fwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE55015AD29802D8C06E6179C3969605F7233C2687E093CB67D1F87E1F766908EF9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 956KB
SHA256 69f9e6687b9f92728de17582b10a86dd62abc5600b31a887fc02bdf0326ca1f1
MD5 6ac1cd678b81cb009f7ea7a53ae4c016
SHA1 bc87fb69eebe0f08ada7311bda7396cae0bf9455
SHA512 2d5ccb72f5930b06fc8be7742a60a9374ca6d90a6928f168630137afda478a5d7e9c2b0a6b00a73cc2240be095efabec375ff47aa6c4b637f6ad9a10497e1062
SSDEEP 12288:X48zoU3fxgBH0BmcozI9fJKVsk8jglvlMbm0fqO2AXoBV:X48cUPxgR0BmcozI9ms1gYbNfqgYH
TLSH
T193251750766BDB5FC6A940321E33C2CCA7707D01EE05AB0372C9572FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 987037a14223f119c75a845f17e5c4e54e4789c9c5a13b2911558842cff48579
MD5 cbaa10b6e4caec59c359934de98e24d3
SHA1 ad8fccd6ead4c0723f65e48652f3500b8e471726
SHA512 02a484d443d96dd8793d1360f6043c8d3ee8f52157ec82bc9d5be964ce7e276743e72e42a4f66fb07932be6c7206d89940c004ccc39be0197ec4a9b51b9452ba
SSDEEP 24576:+pbC0BmcozI95LBmcozI9NzI9HHBmcPzI9DfBmc+zI9kBmcZBmcozI9IBmcozI9x:iBmcozI9lBmcozI9NzI9nBmcPzI9bBmU
TLSH
T10E65D6816537E38FD1FB2132076A9B4DA764AC0673095F2673C8493ADC16A66B0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b8a0e860e10eea0762eedb066355f09b8216291ff39ece39ca77dbda59089c7e
MD5 0856e972745052b070984d285f25e073
SHA1 1e9744897eca648dcad69c6d7f4a12dbd992f819
SHA512 08acd2da89d1c8168d4b5cfdc3c5fff47a5ccf18375f6c28e106a7c416f3efe6ec76a135b7e18e539551bcaedbed5983a9a9a432761bdcc3ac949bc14654044e
SSDEEP 12288:Pz7YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15545237B934C518AF93619B482E9E12D680B7E669F1044C3B90778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c7a249770d22ff01f6692e0cce923c96dafa99dec77ddc3142b01767831b6952
MD5 5f171cf1a1bba4b241f41c8f5a147e15
SHA1 2bdc7c5f0966bb622efb63383f6fae6ea1b4c1a8
SHA512 585e16df7c1804a56acdce449b782a5712b3722a2b01efe03961be9beef4bd84c874e80ebf4805c8e74b2886655f92334a4781b749f1bb2d5cbb7e979b95e050
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bY6sqjnhMgeiCl7G0nehbGZpbD:8gb4mBIBhGFFDmg27RnWGj
TLSH
T12A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3a41f28779b3dba9a8b65b09ff669458253b47eb81876148f2fb225806a5a7e9
MD5 a5299f34b739053054dcae74c7da6a19
SHA1 a7f9a7a990c3e0149f3ef08978089f35f0dd35ff
SHA512 c5dbf0a5ac76a3f0483e47761f70aae591d46854bb6368d59169bb59b16ecdff270e52caf39c787d40b42523993612ad49e6190354cb07279e5418269440f3db
SSDEEP 24576:bG88u8FpJqH1Wzria7/mhsqjnhMgeiCl7G0nehbGZpbD:67ZFPqVha7/GDmg27RnWGj
TLSH
T16185016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8320b7f2319ed841eb7f0e05fcc6d041f8ac931ba462ff7f0d55dd1107a7aacf
MD5 7f5d7b9365d1b73fe435c54ea3811739
SHA1 237ee4289a547f6c0518e864b68b722f6b10b189
SHA512 78f421376937960e977842f2ccb286f3ec3c964a881df0740d823f11de8ab3e52bd978546f0320cc868b88dc22d44c0b7a9c7f77e1685b316fb8e308e5dc7688
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5Dmg27RnWGj:iG05lO43bQD527BWG
TLSH
T1B3D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b5a7973bdba44f20466469dcdbbc21c142582e6aab3b1c5351bbf7f2ffc10ace
MD5 21204e6eaa79c01ef901539de30af9a7
SHA1 4f837e85e2a6dad10fcf589b6bdf69ecc5dfb0ec
SHA512 9890555d4ab8b46bae86dc847134c7219fe06db368c18cdcf415ff5ca1be2b861fb080e849ff9308574df25bf229e0c786e7108fe21dfc77cf0751102e3cbea0
SSDEEP 24576:lfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnXsqjnhMgeiCl7G0nehbGZpbD:la5POZ39Jt2pasx2+mBDmg27RnWGj
TLSH
T16B65BF5EA3FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a128afbe4d4cc275170af66ad85058d1e4714a83c160b5a3f03a08c2db521c0f
MD5 ab9ff2beb4e52f2082bc9aa8067b241a
SHA1 e4d0a3ddcdcf39dcfcd6e0476b7e7df414d6b1d9
SHA512 cf1f45238296e0aff485f10d02ea23694e09328e42e5ff9fc32d327336ec3cd37613240acc8a9fa38b798f90ed2954f5e1277cb608d71b53bbf7d8c20e0a8cee
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkZsqjnhMgeiCl7G0nehbGZpbD:hNc/zEOVHFmDmg27RnWGj
TLSH
T121857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3c7a1322a2b5ea8eba15d0b7a4f348eb0ec7db33836e269cdf60d8a52eb540ef
MD5 bf3d90283c83d0f6533352db841f4ef3
SHA1 688ebeeeb4d805ed49015f2ecadda3e46693194c
SHA512 6329874f28250b0a85d5e070e90de9532d50c9be6282728afde25b6e3b59fd83f8829428661b723b522a348b9e6a4550ab2d00baa7ded9f5069f77792138537c
SSDEEP 24576:ntkNvNnaFeYhJNtmZBmzsqjnhMgeiCl7G0nehbGZpbD:ntMwBtOm3Dmg27RnWGj
TLSH
T1F155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f48bd48fa7f00975c5ed30494b663eb92becc94726b84db0bba37d496bfa9664
MD5 1fb753ba12a39e043d38cef032f16ce1
SHA1 a1b79a824a9b38d5d22b3140a747239d83a1e3f5
SHA512 947464c9473083b692c9f6419ad1bb21acd650e89ac3f48deb595a70ae48abc029b4cc839b5c501da321ef99bd45ba8f7f6063ca96016c704e341625865f134a
SSDEEP 12288:gHvUrBFrEjwaQVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:gPUr+NQVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5fdb357c25aaaec74ed2e9be084312c271fc170d4042b2cf336a3b7650a05b4d
MD5 6724e5c0622a6830fa0dc3af0a4fd33f
SHA1 4eb96970926e470e3e5a0e649319d2e90470d3fc
SHA512 66e80608933cfd0d5296130f6c2a75f4fb52067c3207de969a655a253a1d44f7802e1c9f023d85ede7e34979ca1bb8c21ca2db85023833ac54ef75baff42a184
SSDEEP 24576:eD3FHshBIYQgAEsqjnhMgeiCl7G0nehbGZpbD:eDVHeBIAAgDmg27RnWGj
TLSH
T17175E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1644-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1644-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1644-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1644-95-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1644-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1644-304-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1696-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1696-165-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1696-47-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1696-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1696-46-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2516-61-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2516-287-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2516-59-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2516-67-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3332-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3332-323-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3332-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3332-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3332-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3332-82-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3644-93-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3644-14-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3644-15-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3644-22-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3644-21-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3656-72-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/3656-301-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3656-71-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3656-77-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4268-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4268-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4268-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4268-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4588-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4588-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4588-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4588-120-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4588-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4692-35-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4692-27-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4692-28-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4692-38-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4692-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4692-34-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5500-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5500-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5500-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5500-105-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5592-115-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5592-109-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5592-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5592-325-0x0000000000760000-0x0000000000932000-memory.dmp

Download

memory/5592-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5592-308-0x0000000000760000-0x0000000000932000-memory.dmp

Download

memory/5592-399-0x0000000000760000-0x0000000000932000-memory.dmp

Download