8b7bf1e303e9e30ea947e52aedf25c1908d4ecebb6b7c32e36bc13886dc8fa4c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260808-rns3zsdh52
SHA256 8b7bf1e303e9e30ea947e52aedf25c1908d4ecebb6b7c32e36bc13886dc8fa4c
MD5 a5b647fcf929bac613fc3eae23c23f61
SHA1 87ea03060dc8e1f180caa6944545e2fa2e0370fc
SHA512 dbf4c3eae02d27f297b9c58188a96d19c6097cac6c8299caaad0010f3b321c31c35a8313632eb0977387a9ac8358cd617fe7201146df5801ac1bde1e3527be13
SSDEEP 49152:p+/PivcpfQvdaKYXf3C0eyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755/Y:0/PvOIjcXvvOOc5RiBSTZL+ld
TLSH
T10E165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3076	elevation_service.exe
2428	elevation_service.exe
5420	maintenanceservice.exe
2512	OSE.EXE
1760	PerceptionSimulationService.exe
3544	perfhost.exe
3304	ReFsDedupSvc.exe
2380	SensorDataService.exe
1508	ssh-agent.exe
3476	AgentService.exe
5080	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\79fcac51238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004995f92b4127dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002972176a4127dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000397db0264127dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
3076	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
836	Process not Found
836	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2164	2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3076	elevation_service.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3476	AgentService.exe
Token: 33	5080	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeDebugPrivilege	3076	elevation_service.exe
Token: SeDebugPrivilege	2428	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2016	5080	SearchIndexer.exe	103
PID 5080 wrote to memory of 1348	5080	SearchIndexer.exe	104
PID 5080 wrote to memory of 3644	5080	SearchIndexer.exe	105
PID 5080 wrote to memory of 5792	5080	SearchIndexer.exe	106
PID 5080 wrote to memory of 5860	5080	SearchIndexer.exe	108
PID 5080 wrote to memory of 5532	5080	SearchIndexer.exe	109
PID 5080 wrote to memory of 2092	5080	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a5b647fcf929bac613fc3eae23c23f61_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f60c2dee002a4f030ddd3905d448db41d90992050cc6bae30293732493546c3f
MD5 b96db5508a076adfb6f7f40bca031d6b
SHA1 6af83e909b0caf3bf8938026d987303560e9e5ea
SHA512 5e595eb752eb89a74d28e7343f71636ee962f26c36a102706ee7668eaff2641e8ae85d6d36ff440ecd3fdc4672c4767cadb2824beca03353e9cca7edfc1d3081
SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYiLlBUKubZrX+ld:k3q6sjBZiBSTZL+ld
TLSH
T196D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c8153b779757dad2bc9de008e712118eef545579b2d6f9e79ac96b52fd056f6c
MD5 5c370d425158bff5d013cf7c07241f78
SHA1 03d7ac3034e8434bfffafb937e21cf0be6855905
SHA512 7f1b60ef8e3f0e47939cf6bf38329ca1869dcf9372c4004633468b031e0185d93fa59f3b79df90abd3f0bf8a8435405810407887ed2aa10854c8a6819fc4fde2
SSDEEP 24576:tXYfDtczAFxVirnlBUKZ408vTZrX+lgdW:4tcSiLlBUKubZrX+ld
TLSH
T1A265F11973D508F9EC6B827DC8A18501E6737C9247A0E79B03F09A661F336D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1fb882caf058cc6eb72c00d1c94b18299ec51022d73df5a2645fafdde789c1f5
MD5 9501cf90149997946fd11deb832a283d
SHA1 5dcc16841da318be500552062f4c6e2b0c413e46
SHA512 c8dad97b56fcd1b8979a5890cdf7a1dc1be8d75ebd73adf03ce83d846a32f6b7d3eac588161dabcae656a81dbdf7a83bebf2150e27c115f3af9541826a05591e
SSDEEP 24576:60Le5ji0hmxxrMWxVirnlBUKZ408vTZrX+lgdW:6Pji0Aj/iLlBUKubZrX+ld
TLSH
T14C85AE16F6748735D073C0B9C5D2A68EE97230825B308ACB4296D77C3F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6779f61bb22d52d6e11ebac01f8c448070d183f681188d6fefdde7844617db29
MD5 3868f5d359218f7053f8d2357ad1c646
SHA1 57b8d07636817ebce8bb8e6c83ccc14149ddf109
SHA512 200f6ed3391bcc39480b6c8bcacc831fed154ea56545e26e6dc4b418195945c45d597da865882104a2419efd6c7f6d562ae941c42ac8434f8c8c71f8dfbad18f
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWn6q8wyuMxVirnlBUKZ408vTZrX+lgdW:D/ezSC6vUzPveHjyjiLlBUKubZrX+ld
TLSH
T1C1756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 14a24fe5dbb365a76de3fd2f574e89b33041804bd389c96ac2de5d2f2f9157ec
MD5 e5bf6e9f116de0a41e2b59e177c5703c
SHA1 5a51e7c0fd63e80b4ee6142d90849757cca2a0c6
SHA512 45376cb3cc8526bc308038051d8b752b79c10faaadd6bb694e674550672e95d2db3499a34510068ddc77f55c2a32ffb99a123cfb80a832cb20a190114e0372b8
SSDEEP 24576:3VbqPb88hv/l+YJxVirnlBUKZ408vTZrX+lgdW:3VO88hXl+qiLlBUKubZrX+ld
TLSH
T110559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ffa07ae6b4d9ad537ee0dc2f1df92e9bb100bcbed6637721354d9a53a6ed3c5d
MD5 ed2a91ec3021f25dac66b98a4976df7d
SHA1 97f11ce46df9a8bc06230e6c262c3c5bb4ca3657
SHA512 16118c72118b171d9a2c3d58b96fd7cd88ac58158e183c8a20ad797e253a57bbf0ed8853c3e93dd57a4ca09df6538f680ae9b2dc2b9789fdc9a12d091f17e1a6
SSDEEP 12288:oLaxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:oLaxVirnlBUKZ408vTZrX+lgdW
TLSH
T1C6452346214518B7F23F0BF1B0B49801F2EF3C93E8A96D2763B137460D768E9F8166A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 66e4ed34772ff7ad0a197890bfd6cf69b1ca212806cada24ec2163e4d83c2780
MD5 c4a0aab96e3bafeab3c08e5588c5a8d6
SHA1 5a5a0a3e0d7cc43e3c8742d7c96f0b394367cbc3
SHA512 b72d6e913c82fe5950aec6e562c1639951c99b5c8b49c199cfaba997787f052bcfa9e06b4a982c2a2b3b1da472d0ee7b70e6c3fa738d0ef3a99271065fe5d696
SSDEEP 12288:1eBNUbTVO86UBxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:1JIUBxVirnlBUKZ408vTZrX+lgdW
TLSH
T1C365D02BAE28FCE2C27E4DB856918600E77278714F61A3CBD275830EDE235E45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 edf03660f8f86b02001a47e7fe2c93d027e4e89fac25cee3d963d7789c948352
MD5 c0100d7c596d3b618d65658b182230c7
SHA1 4a59c9d77e5303c54c3a4313ded3e67e1d2e1201
SHA512 83f6e72c8d904a3d443f9c6ed23880da28d0a82a2832f124f42f907cea94a2247953c1047e75a783b78e82edf000205d963b86f3f43a18cfd570637bdd66ee3a
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH6:wQvGAdlCEL8c/DRNw5CyiBSTZL+ld
TLSH
T1EF266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ff2a317c9164ed33f6749e9e4430aa8837dba20e5ca719f7a5accfd4ae5e8b54
MD5 26d937531d97dec585bfe11c51be4f1c
SHA1 2dcbfff9b88df4bc1e91ff4aebfaf5e9ced46b87
SHA512 8b0fe0a5729f415290c6802748a92568c13c273f0019ef8e93d3e3ce7e62755a957f459cd5724a0b6502520085899fc08a8d7ac18a060936f7630e16c5fbe354
SSDEEP 12288:eAwSfxL/2Dc3RDLLmt0LDQewsAjvxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:D0ewsAjvxVirnlBUKZ408vTZrX+lgdW
TLSH
T19475E021FA75E436C27F0DB21B35C706647D79604BA12AC3E3F85E8E59302D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cf1554d3c9cc37b592922fa34f0fa59cb3da06a821aa7d0bf36222704bf668f3
MD5 86fe37c320c4b571dcee272affb54096
SHA1 22d68a860466ecd8e30ce89fc7d48b7bfff722c3
SHA512 4ede1cce3c85967175062d42f1b0c9c5bd0ceecfc45a9dda3351e4f283d5bba8c6505688c0b0ed530bf94d5f563a32f106010463bae2223939fe04a97b63d0e6
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpZLud:QUEtQevvqc2W1cpV2tI32fu
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 86a9d90f98b89b90c120f39c6c08e3000b88de135d97e50e44111a26ba85a8bc
MD5 4bc8053e8898d3db15df13b90bdc5636
SHA1 45ad2a8c80f667f2b334e795fc2bb73aad1853ec
SHA512 00af1d5bae194df856efc80b77f0a55e27b06a7c08973415151888eb3705cc8ad0e3281c029a0400ba4b9146c189753bc66480b57380af97ae279230b0671e78
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zPiLlBUKubZrX+ld:goquVjnmWiBSTZL+ld
TLSH
T128D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5382dc5446ee8e09b3460d5881514da2665dcc7c3f48f0b95ce32709054dd284
MD5 5bdb1c57cd4a914250b07205f061c986
SHA1 9cada54e30cd765b9f1df36b04f283cf3a639f53
SHA512 08120f98120f30a28c90a0c99a7cd8d1c1c1bbe11fe051eed1fb46521848dc6b696272a14f0cc47d22cb25638f52254c4c1caa8837e20ab5cd4790af44424755
SSDEEP 24576:+AhGL3IFoiwtA5l7S534xVirnlBUKZ408vTZrX+lgdW:+AMUFoiq5GiLlBUKubZrX+ld
TLSH
T17235AE81E7F955D4F5B3AAB899B58570EA76BCA65E31C20F2260D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 339ac40a14c07c5a19211c62653c99d4a26d0ac71f4d627461d24ad7d969f673
MD5 0451e5a44cc7b56d96142ba3972e91b4
SHA1 4cf86da49cde8162c7658cc6be71058512fc59be
SHA512 11490ce6d464b725f799ea3646ffc1a8bc249758d948d4a40c39469027f9808d3a01f7952d8c7e6b28fedeaaa3bb00caa89ce19a65659b7f56e0355ca8ef7f7c
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+CsxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnWu:2wu4OW7xVirnlBUKZ408vTZrX+lgdW
TLSH
T1F765F14A32A50CF9E57786398597C536F7F2BC022A25DB1F1370C65B5F33261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fb396d70e846ac9da6a304af7e64cc75a5fbf960c166a608fb2dac48e7ff46bf
MD5 12f2108a1af0b528ee9dc260df3dda65
SHA1 4d30458cf0684844b8025751ad1efdc8e81964c9
SHA512 27262945d513a4d26de2951e550cc1ffd1471ed0d2daacea4431855e50cc0ba5a8fef0afadf1b317da1bcf783dd312f716ee7b645732a85fe5aa0d84e4aa5fb1
SSDEEP 12288:7eZ1IyfxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:6ZuuxVirnlBUKZ408vTZrX+lgdW
TLSH
T12A55128A329420FAE17742B9D8F04A05F3B638A3677653CF137112561F33AD66D3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 732f12cb823ed9c99a80770c236b6dc73047df983c208903c91eec75665254f3
MD5 3d6a94de184062724d8b602ff3ed700c
SHA1 e5ac44ceb31a10c7094d512f796c6b76ea104a21
SHA512 e875ecf4c2335e73675d28be9414aacde91ca7d00ac4bbc0c76f3fef527513c734384655dcc2fe162644fb2a2f371fbd26f7acd7aab649034d9a6692a7c2b81d
SSDEEP 98304:SQRQyi36YOcPbLvw2gAf+PN3piBSTZL+ld:JQyiKa/X+PNHZLud
TLSH
T1CF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 21d385db0d34feabb5ae852a6a6c5c2cb3985bde597ad572035e74c74b2bbe50
MD5 721df539f7d7005f4c31283c662047f3
SHA1 e07866a94e67dc9256095e799e7d40fdaf64474e
SHA512 61afa65350aa00cbcd049662f6c86e993ce64d597b8b2f47c8fca3bd389f36b7e6416b9676fc0a5e95b2f16b12ad19ca995fda0c3881f23ff9d1eb9a2ea2179c
SSDEEP 98304:CQRQyi36YOcPbLvw2gAf+PN3piBSTZL+ld:ZQyiKa/X+PNHZLud
TLSH
T15A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3bfc78d9b3c8e3035bd8b02d6ed7e94305bb4f4e9470d1045766a644ca5be60b
MD5 d804340c76023db22335f328ef8306bf
SHA1 bf999d6278f3c1ebb1c6dc93a5f4e8292a128af4
SHA512 0df37a408f190d8fcce61ac8566ed7cdc0cb97f52ed96254d9eb08bacad1305dfb84c76c2eb69bbb2f8ac073dcf10c862da36661cd0f72baac61b4be471eab42
SSDEEP 49152:Q68Qg55nhceWu7PNU3//iLlBUKubZrX+ld:KthLRc//iBSTZL+ld
TLSH
T1D6B54A33B2F600A9C05DE1769F4A872196D27C758FE1E3DB815172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f248caac44305f4e31149f091b75ca1538e57562cfab660b2ff57c9dfdf10bee
MD5 2fcc6493fecaad8fbf03f444305629d7
SHA1 25c4ccdb8256a5f4ed831a8c97c237a75db54d62
SHA512 4b290416b4c030a777628b666dab298766555a23454b7551504f09e2171970d8133f8a8f8b0ccb465c83c134dbb10fcae7d22792ac089c53857ac1bd7b8f6cb7
SSDEEP 98304:/y5112gYy5azzVvt69nLKnhZ8iBSTZL+ld:yLIHEWhOZLud
TLSH
T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 584dac2bec33e24c676e7f7e582290d7dd3be29d66fed1a975532f29f2e4bb31
MD5 5d91ebbf96d7e7ede5fdc24d0f2bbbf9
SHA1 4164a7e13066ceaecdd1ec04c0206d1591246eb2
SHA512 543c14df55e719f4adeb1dbf41a9ba14753e9112bfd4d6943ac2d1f0eec0e2fee509797941177a31da41107e49588fb2f935a19bb7cee8e243cfd6670e22c083
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glliLlBUKubZrX+ld:tu6Jmdxd2dliBSTZL+ld
TLSH
T1B6D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 865a068a2a033aa7e1f8ed139b8934aaddc4d80e6506facdd2598b4cce191405
MD5 4a999d8d0076772d14524e3c2a4da80a
SHA1 31a29795ad6e9d1180996fbe30ac3444d31db3ee
SHA512 b1bc93ff418b7b4fb4af58f3a3eae7adff4f012cbcc58734331fb5f948935d687835455ddf8045cfc07dffe1649cc538e81a0cf9bd1d2e21d189e59e253f9811
SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4xFiLlBUKubZrX+ld:4mifPWRWiBSTZL+ld
TLSH
T1B7B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3e362d6e23d69e1b28ba0a8a63c19c43808f4334796bc10b1d8b167c11addd99
MD5 a5911c440fc0b1ab6d5ca29e23e15a91
SHA1 db6db174d07b166474063804cd495471c4e259e9
SHA512 f8a576ab3555e39d5477d437b06d959863799337bbe8582f5298b3f27d83607f21ec85cf7e14eeb59a1c04c8b7b5036b419da8495912e861c6366e76084716ec
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqIiLlBUKubZrX+ld:O5dKii61IiBSTZL+ld
TLSH
T18CC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 42a4fe92983bc87094dd2b978af390cf7a1e78bdb82c4700414fe75681d9497c
MD5 49d786c5e84bf7fc9b61b8c3ba8606e9
SHA1 d90bb85b9686c94ba23a0e38d0c260207ad65bfd
SHA512 ea3df7cd66f458ed59d6f9937a9247da6b203b27463a8f9fd712c59e42963ecafd5a58f7c48a2820e783892082c8d1de030e397fa57043e137e580f01329ba9b
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wxiLlBUKubZrX+ld:TX2imphaiBSTZL+ld
TLSH
T14495BE03F2D900E8D06ED174C7568632EA62BC160B35AAEF0A9077561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 94851a1ca5f69fba8346846e02ae0dd02ba14159b8b35634d11cc649ad1a6b8b
MD5 595bcb31be5f8f4519bb2f1eb13e4d2d
SHA1 40e15fb8cc7513694f007219476f1f102c273483
SHA512 a0272b4e1f764268e84da4ab8bb525a38f5a7aeec2454893876a616a1e32215e7ccc6391373fe74e3ad9fd80fd56b5226f33625b7b4a9b85c35740ee038b7c2b
SSDEEP 12288:jyxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:jyxVirnlBUKZ408vTZrX+lgdW
TLSH
T1B3452346318608A7F03A4BF1A0B45505F2EF3C97F8A6656773B232021E76DE97816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 86261b69aeea4bb2c86ed0a040e1cfaab2845d15eb86bf2575df7cdd0ce0a8a4
MD5 eb0c358a81f3a22cd8ca3e6b9f56f4f2
SHA1 3605b4fe47f92ab3b0a2c305add62152ad04e6d8
SHA512 37b5a82d8130e4682de8e61ac70eaccf6bf298c6bc1c6b9e9a70edde4f4a4e505181a284c9a7c6463959f4fe788a0f747d1a7eb9aa9382eee603886f49ba3f9b
SSDEEP 12288:FjxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:FjxVirnlBUKZ408vTZrX+lgdW
TLSH
T1E7452346318608A7F03E4BF1A0B45505F2EF3C97F8A6656773B232421E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 71f5955d4a4523f5e6e543c2bfd7d0f5706b8985bbd35647567f58e4f6025933
MD5 57cad589289fd2d8a503fef3eccd0b33
SHA1 e97e3983eaaaf4fdf807491f420222b96e49c880
SHA512 19071ff3081e7b6f3fe51b95ffc3e117a5a4ed54c09cd7859c384001ef4bb1653abb8055b0fc138a94ba7f4c2092de6f5d56bf358aafc9cb4b661ddf9bcdcce7
SSDEEP 12288:BZxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:BZxVirnlBUKZ408vTZrX+lgdW
TLSH
T1DD45234A318708A7F03E4BF1A0B45505F6EE3C97F8A6656773B232011E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 82a5cdfda28c15be54f3cca183b0198ce6dbb8559d7a9f649bfb40f2210f38b0
MD5 c471b7ebec383a008885ee9ca7ee83fe
SHA1 44fda23ec4220e14b8abb7f6ac24fd43647d5308
SHA512 b356587ca06c8dde38be8181ea4fd1581a98a828d2b9868f28f067d5440a5a3fdd022d6dccb3c7e853617df11855657f18bf77c9a3ddb10ea0d41d41f9af104b
SSDEEP 12288:rVYxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:exVirnlBUKZ408vTZrX+lgdW
TLSH
T1DB452346329604E7E03A87F5D0B08501F3FB7C97E876666F637126460E72AE87835FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 29e7f6595a014a9437ae5ab67efd530b2af1368854b3f7d7f6e630a4d0d53bc1
MD5 d2a05b0d98df6377f6d4ecf2e5f84641
SHA1 2ccf1cffaf27976c362c13ae0199794e4f17fdb5
SHA512 7712fbfcd0f0c47ae5e630690c0a085281ce267c54be027e1ec8edb31e3af5356f23836d41b27cce6d11db0072bceb7073c0377f11055a7b9f60bc29a6c3f062
SSDEEP 12288:xgxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:xgxVirnlBUKZ408vTZrX+lgdW
TLSH
T1EF45234A318608A7F03E4BF1A0B45505F2EF3C97F8A6656773B232011E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d5bf021dc76a36f8c1543b9183ab7cebbaab9e3fe1ab0a29e178755cd76dcd71
MD5 0d2b5575307214874e43ab9f99bdac0e
SHA1 add0b167551882f2cfd5961ba2438b1eda2e23c7
SHA512 97e3e80fb430d44d332986d2f223e638d5698c685909f921d832c8c1437bdd13124e440b1a4aa492216efa3319337d78a2e35f1119b1b7188d2fd5603f467e2f
SSDEEP 12288:jHxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:jHxVirnlBUKZ408vTZrX+lgdW
TLSH
T153452346318608A7F03E4BF1A0B45505F2EF3C97F8A6656773B232421E72DED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a7b8930b4fc128f358e040e9e12a5dfba11778a2fa87bb5b53ca709699f0a955
MD5 4f59f15d007b91a5fbcb109d9abd197e
SHA1 86387eb6016c53977569f9e4b187e298df4ba52d
SHA512 c811bd2fb669f6dd02e713bbf0f8210996f3f4ec3fc11e0543dc298d1eb2d3c2779701d372fee26feff8a08040607be3718f191cce983e57d94f58d486a2934b
SSDEEP 12288:7LxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:7LxVirnlBUKZ408vTZrX+lgdW
TLSH
T15A45234A31860867F03E47F1A0B45905F2EF3C97F8A6656773B232421E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 55cf71ac55f3c123a3d0d7ae458c986ef5fbee6d61cfd46ffed4bd3356415ea8
MD5 ea138b08b566ece8760d7d0d25cfe3b8
SHA1 263e0e4b04e3dcd9f5c93f01d2dd751bade5a494
SHA512 be49527d67aa182b1ace79e5c1b391589d24b69092a280373a59e01193b53bc7ec7de8316a3e0a466ee6a72b7188fee629e5bb6719f1242d75a98ecbddb121c8
SSDEEP 24576:bZMRzFVSODxVirnlBUKZ408vTZrX+lgdW:bZMRzf3iLlBUKubZrX+ld
TLSH
T17165F185739018F9EC77827EC8658906E2B27C5A5A70C61F13B436671F337A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6531eeeb564ba12be912fbf1bfe0a1e9f6d62e9a9758cfa9655f214326098fdc
MD5 dd7cb22bbe50b2e37ee64592c74eae7b
SHA1 673ab86ae6dd22631a6841a6a7489293b58d5d4e
SHA512 97f2b887baad357ebab1b03714456119f0e0536470208c222b181b3ffa18cb2c36625b8c74797807dee18a907967675e61ec966f6e7ed2b916ead7385f20c752
SSDEEP 12288:6exqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:6exVirnlBUKZ408vTZrX+lgdW
TLSH
T15945234A314608A7F03E4BF1A0B45905F6EF3C97F8A6656773B232011E72CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b3708c857c6b66d290ad859f8ee55a6a84fe6a4a11957599c161b33141b79f4d
MD5 b797843e34c4966768102f4dbd207faa
SHA1 e28dec51ceb89e3770135c2715e2db1d9a152b70
SHA512 188061620f168955c21c6700d20b7bcbead18f358f8ba0109143ec978ce04fce511908750b64f8ce46362e7eaa5773be3e1ed388679654b9dd0167a705be0563
SSDEEP 12288:aKxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:aKxVirnlBUKZ408vTZrX+lgdW
TLSH
T1A045234A318608A7F03E47F1A0B45905F2EE3C97F8A6656773B233411E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0af4b03bd7005eee864cd70765442da79ae8cbe37a281c895c132628c4f3de97
MD5 166b7dc74d3d419c09394dfd2f9f59f7
SHA1 aa7312c0264a073d684af4243c3da853c89f3f84
SHA512 aadf8240db7e7663f193f66d69fe7d5f033351e7ec6de1333ef1f7041d43086de0efc9acb180fd4e48f3c096cbebe283fe5389f2d9e5c6bd78367008ca01c940
SSDEEP 12288:6yPz5L8fxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:nzyfxVirnlBUKZ408vTZrX+lgdW
TLSH
T1D1550247329120F9E13A8275C8A11A01F3B67C775B649AAF13B017761F336E5AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cda011e9b2d02f52ae46f4602c29cefb9486afae0ca076339d0379b1e1cda16a
MD5 b73d078c3c65ac7bf80a4f94ccb8c39e
SHA1 8634ab38a467af07d4af78ee9765de2d02da2370
SHA512 892c1bc045b7324540a932ee2fa619b0999389ad59a9af6df2a49d1f6a47734639aebfb1ed26aa97d3785d91db5b0f003d3998f5920ebbc975b5d81a4d3d1e0e
SSDEEP 12288:XexqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnWA:XexVirnlBUKZ408vTZrX+lgdWA
TLSH
T18745234A314608A7F03E4BF5A0B45905F6EF3C97F8A6656773B232011E72CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 deed36d7d483276f36106b6064fa45df4eae2235df03bbfd2bd62f5b608a1535
MD5 c727ae4f51203b44e78b6fde632f1ab7
SHA1 d7b17ac5e2384704f9001554fc3045c0c08cb7cd
SHA512 4671f08f5c7140fccb8658e39362a7bfe4096ec55722d54ca186ec5f818f5720fde40bbe284195ffc2f39db459a1bf52f5352e2485eefaa13e0f26b490c985f8
SSDEEP 12288:UexqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnWA:UexVirnlBUKZ408vTZrX+lgdWA
TLSH
T15745234A314608A7F03E4BF5A0B45905F6EF3C97F8A6656773B232011E72CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 faeea29fbea0baff360bae583af09dc3835ec0d50a7c9fe489ade75c24131cd7
MD5 68306bfbea51d1905c17d307baf71163
SHA1 51b415dc33d8a9962d64b50ca5c3fc779ae53ccc
SHA512 5453822fe88de369e42b4461e2b936ad1cd15dd893591730e3f7bec5b3755fd457fc2b7ea01b0500f3f919e4242f851559fc91055204cc42cd6829aa670fd53c
SSDEEP 12288:IyPz5L8fxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:JzyfxVirnlBUKZ408vTZrX+lgdW
TLSH
T1E4550247329120F9E13A8275C8A11A01F3B67C775B649AAF13B017761F336E5AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 dead67bf4fc079ff4f06e465fb3e9e6bc94f9889e8ac7b7ae658f6a32738f0e2
MD5 40fbf8daccf60ba207a7a7cb8e55c5ca
SHA1 8004e1cc125e90b7d7d578acd297a7061415589b
SHA512 fc5ad71a55ffb72c1256311a6bab890bcc3420b84fcbc45e1f2b0764cf24eb83a5b4a27318ef1da06ca2f8c3adba6d260a4faa91e4335e5ef732fcd84c6da5ea
SSDEEP 24576:eTDaLl3z0zDpxVirnlBUKZ408vTZrX+lgdW:eTuLljCiLlBUKubZrX+ld
TLSH
T17865F185739018F9EC77827EC8658906E2F27C5A4A70CA1F13B436575F337A11C2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0f6e0808c4ba5bcbb84f8644a981a58e5c96e1468ca2096cc292efa5e43227ed
MD5 1a7511d2c094ac38abfa0ebfb86b9733
SHA1 6fd31bae121890c7448f39760e8f9e76cacde918
SHA512 a4ff08191eb49b6294a6a18cd8d3e63b4b32a153c168b82ddcdd46aad6c8b905985c29d9f02a7df9394f11ae26cc03ad8b7bdb579b814cadf5ac552378aa4deb
SSDEEP 24576:E3vd9CHKy7GZdxVirnlBUKZ408vTZrX+lgdW:Ovd9CHKya3iLlBUKubZrX+ld
TLSH
T18975CF80F3E414E9F0B79A75C9764501DAB67C9A5B31DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 be31f2a3876bc214643cb86f216e6b34d81435e97462c9e04d96c06719d7b0ab
MD5 4b352b53a91f375a2977abfbb090279a
SHA1 8c75d2428773c3990a7d158c297ee313efe821be
SHA512 91f4772b9010e6089d27137867ca2eb93fa820cfad6c22e690167b62d2726e10890e878b92e885f44de1b04eb6aab009a57bbf9f8e73b59e7787ec84a7c2fce5
SSDEEP 12288:65xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:65xVirnlBUKZ408vTZrX+lgdW
TLSH
T1EC45234A318608A7F03E4BF1A0B45505F6EF3C97F8A6656773B232011E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 71b42f84786876db2f037186dbe8539680d9ea22bdffa7f93a275fc2f4eb9cbd
MD5 dbe6d6f1793ee5774ebf6256ef052213
SHA1 c3770cda31850c49ddad39cbc3165f48914cd4cf
SHA512 06189e70f821367084548dbfd98a4d80964d435138aee0a47f82f08fa3bb507c24eecd0c45b63d5d30e15edf407aed15a17f43c1ee4f321dac46f296b3c76e34
SSDEEP 12288:6/xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:6/xVirnlBUKZ408vTZrX+lgdW
TLSH
T1B9452346318608B7F03E47F1A0B45905F2EE3C97F8A6656773B236021E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d8c11663407175103149c13b2385566b97d0bd0095312d7f58758baa7150641b
MD5 b42c939d821967872db2f343a5e02b93
SHA1 2530e9e819957b5d7d96efbce4a1a5b4a8c77869
SHA512 2e60efdc5238490a805bf2e421c85fc95362557d614a22889dedd7a9d7016111b5042118959be73f8508492e1133a854b0e24268332f6426feca23dddf982dea
SSDEEP 12288:QUxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:QUxVirnlBUKZ408vTZrX+lgdW
TLSH
T121452346318608A7F03E4BF1A0B45905F6EE3C97F8A6656773B232011E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 16f4807df2c858bea91402fb3a559ecffd138315ff159c77942f6ba77448806f
MD5 6efca55a3ffeb9b4ae5ac67b7d6ecdea
SHA1 e211ac061a1f2d66a330e42beff09ba62fc1dce4
SHA512 29b32837846626cd86ae172d43a02c7e44bacd58e53ad6e1d122ea8e5be6e7f0882f925a4012bdd45d4abf3686a9f6b0610976f2bc5f672060771b47ac529a97
SSDEEP 12288:WexqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:WexVirnlBUKZ408vTZrX+lgdW
TLSH
T12A45234A314608A7F03E4BF1A0B45905F6EF3C97F8A6656773B232011E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b2d138a99a66c91278d1aa17b40627f2f4442ec523824ece5d172539f1192ae2
MD5 9333b429d221c2bf58ce8fd4347d24af
SHA1 913f3c664bf0db4f89a8b5067fe7ce95fad8ce8e
SHA512 368a8913c7f4de5f8fd1dabef39637f0f90f762550e0321e0742b1f50dc0fe6682ba5f28aa3fc03f4dcf1eae0356157619d281d5ae634dc8c184f2754455560a
SSDEEP 12288:H5xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:H5xVirnlBUKZ408vTZrX+lgdW
TLSH
T16745234A314608A7F03E4BF1A0B45905F6EF3C97F8A6656773B232011E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d26e20466370117fbb53930936506de11fd44e04d98fd0f19c60bc8ce614929d
MD5 0a36e499c29a21814a6ca75170655419
SHA1 8119ae091d69c833dd99f63edac8f361097024be
SHA512 bea6eb9e5c43d2b9cee2b2c3cb85a83fe7139ff85bd62d5710a6cded1c136b828bf99a1afc2ed56910d39ef441fecec38d4ff568ead33ac083efe72fb1897a25
SSDEEP 12288:3mxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:3mxVirnlBUKZ408vTZrX+lgdW
TLSH
T17045234A314608A7F03E4BF1A0B45905F6EE3C97F8A6656773B233011E76CED6816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 70a42b52437771be9b0eb41daceaa79d783b72e51998656dfc0c74330fbec16f
MD5 da011cfb13cf6099a92bff21de2abeeb
SHA1 6785412ae6c65e408c12acd4732e99a572b35d3b
SHA512 29900bb57c8c722b17288211d3be5c1c8c0f330a2a0c974c2d238c3793e294b440a59a3f9a8289209d30e526b9b6b553f5304125a0d031aa34d0e8c59b2b6195
SSDEEP 12288:PgxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:PgxVirnlBUKZ408vTZrX+lgdW
TLSH
T1CE452346318608A7F03E4BF1A0B45905F6EF3C97F8A6656773B232011E76CED7816AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4c662c1cf7cb79d1c7a922c0ce67851b708185dad9605a3e86e5c41087bbfc8e
MD5 7e6def53560d3fa1d654aedb21f99feb
SHA1 80734763778e854c581d9bb8670ee484d09f9d0c
SHA512 aeb0a04ecda18add693bfe8e5413c07a15d306997987e1512eb4b0fafaa41df6e762b6ab5bd91cad860f72d9c4660a77c7d64e6258389f04b3bdf215a7c9a03c
SSDEEP 24576:gfwvUk9RX6wkyAI6xVirnlBUKZ408vTZrX+lgdW:UMnYIciLlBUKubZrX+ld
TLSH
T19785D029EBDC04E5E177927C99B3460AF2B178691B31C6CF12A6536D0E33ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8e0f8c1e82c28e9ddd559469add5f1c84320a7b2d2ad72f6b2868ae92f6a45d6
MD5 3438d3e196ac15ba9a3b39fd3f5e3f47
SHA1 75fc458f9146618c4d447c66f9d2c00e6e6b4e14
SHA512 48a8d115d02e2adc44075d8b02b9b9761526bfa026fe3633a6898cd4dbadd4980caec9e3536f75577a6b8df3d99bf154f6600eb2a37c59852d1f2e268b23362a
SSDEEP 49152:ZYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0RiLlBUKubZrXw:0ySzPJiBSTZL+ld
TLSH
T1DD067C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a23cc7cb98fe9d9e9cda2e869c9fea67ca92197872e664cc342d641194847dc7
MD5 c3e53314f7161b78e429ed18180d4a3b
SHA1 4882541d2ee1b9b760ad0f898c40cde3180090b7
SHA512 92bc52412e00871478eca462c53b7edfdf51536c659dccd0314117eddc76c0f754045d394eecfd73e3d62710b3b98d9235300452ab77c02c630351802a9818c6
SSDEEP 24576:k47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYzxVirnlBUKZ408vTZrX+lgdW:k47JUQjTirIhCnDHUPfF/BiLlBUKubZs
TLSH
T1F365AE1EA3EC01E5E1BA927885154A1AEA71782E5F31CACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bb62e770f37d8f366e80d3b35cb9b22903fd0f1c2ed39a492cce461824bdcda4
MD5 538e389eadc463712bff1d5a89b7604e
SHA1 6d74d4ce1e08fd59eadf534b849cff670670fa88
SHA512 13cb660f0902dc5ca46e3e53e22e40a48045dcdffab2388c769f6b13108e5b178100652dcd02f4544fddaf71a0a50db77b9c848563b6e5be689c84a72e94cf68
SSDEEP 12288:/bsfuxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:SuxVirnlBUKZ408vTZrX+lgdW
TLSH
T13655F00AE29801E9D02E52B5C7554A00F3773C6696E193CB63E0F53E0F366D4ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4d78ee236430ac203bee93bca7dc0371680e8c2e1a8bfc209ef353ef74d55c9e
MD5 b76c63511b6353ae08714316fdc72d71
SHA1 522ebcc30455e0571e41628c7653b657703588da
SHA512 58cc645e66ab6ef7131e32041d691b3d0d8abb83dc80c2442f5c54088a81ccb163ab2831dc49d8aaa03236195b95812770cc7740510192c03393ffc367eef127
SSDEEP 12288:yjmB+y57Xi3W0k78r7bT+Hf3AJLfLHGTvVmUvG6:ye+CwpvbqHf3AJfHGTvVmUvx
TLSH
T131452911762AC75FC5A940325E33D2CCA7707D45EE05AB0772C8873FC5766A8BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1d053fdf268f50d280ee79871321e0bd2f39cbeb2f9833f5a0868da534dc7e5a
MD5 031d0068dd4ff07a9cf148ce2d23ee43
SHA1 4112a067fde812893dac9423326a205e2282243f
SHA512 0ba103ac4dacf7943d493dcfcb874563598a6adab2ed6fc2f2d079e48b36a370b7263565c7694acf12df2b3446d9d38567da1ac5842f9a35a9bd6a7791a9f8a8
SSDEEP 12288:mPI1tGr7h4YAHNm/08ptfEmjMFp+D7RRAsQo2:N14NECMFp+D77co2
TLSH
T1A865F8419137E38FD0F76072033A9B4DAB74EC52B7096F267388453AD86AB55B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4f424f959f40a6a1366f977a4683e528c194bb9e4dc1d43fa3e91b6075dc01ef
MD5 1c26cd6ec68bf49882f2d064a4fffbba
SHA1 4311bfb5d040c5869d39d9f2a70ffaec2a8b4e23
SHA512 8718041f2d24625e2a1766f5b87c7bd37747f41fef252f056312621ccea013c8b7856acfc62e62575fe16479640b97fd7d7b4ba6acf9aeef3ec9118dad3851cc
SSDEEP 12288:a072xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:b2xVirnlBUKZ408vTZrX+lgdW
TLSH
T14845234622890C67F03E5BF0A0B88510F2AF7CA7EE55A4E7B36133451D32DD9AC36B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 bd4d04d9af2e55b1534f853fede2f61a19a2b7d269c7e658b881d5c2c89b23a8
MD5 3754e313e59dad7b9824d6999c7b37bb
SHA1 2b0b99b081bd29798bd5df2a5114e731b01a7237
SHA512 4695b5d2ae3fb2d19db7b0edbe6de1ab3183f1c0abf6987692e43f4174321095d41fe85f9caea2840340bdf4d3fe31f9153988e6f849de19057a3a1e985d3ac1
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYMxVirnlBUKZ408vTZrX+lgdW:Igb4mBIBhGF7iLlBUKubZrX+ld
TLSH
T1C465AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b655d27f39f9b163661b9328f31cfcb21f254fb3d48e2644228a7eba7aaf3631
MD5 03247b465ef59d43977346ba2db618da
SHA1 532f27e832c0ff9415ff402668e1ae551f475a08
SHA512 068cc4d07c4ee13b7399eeff82884ff3d1b6177020964c198955d094c82a3c099e25a69eae7c8b3c30365d5920c9b4bd21fb1c233f43b2307fafbc839147c1c7
SSDEEP 24576:EG88u8FpJqH1bzria7/mDxVirnlBUKZ408vTZrX+lgdW:37ZFPqVea7/qiLlBUKubZrX+ld
TLSH
T18485F15572E101F1D07BD13889964663F6B2B8261364EFDF07A88B521F33AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 62688bbbd9b35d701e154979a5c80915dc62275b92416c7aadaab9ad7dd29706
MD5 78c380c70da4a06f374812b44795640f
SHA1 8be68d4ec368b160b6d685973f19c4380fe716b2
SHA512 daaa2f3f48e177cc57d44eedbe9956f1b1b60615abd78fa4c0e93e63ecd57170beb79455a235e6d3ac405bf424d453bcb3cd9e2edfad380f34bed26385a3779d
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHiLlBUKubZrX+ld:BG05lO43bEiBSTZL+ld
TLSH
T1E0D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4ebfa9653f1cfbdfa6b895a22a763fb97a5df82f6ea1f4f86332cb3c72da5c5e
MD5 bbd9a22ce81a80e20f4d9e4e26ed1815
SHA1 dd938e75dcd11bfd22009f9d7d36934f568c0afe
SHA512 f493969bcad77cfb5d61239eded1b71ef3d6bfbca1998a8a3754e7c7717160117cc7381ae87810a696b8695038bb4d6a94f6f6cc18c9e42b7cf694ee768c3a78
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnlxVirnlBUKZ408vTZrX+lgdW:ia5POZ3BJt2pasx2+m/iLlBUKubZrX+v
TLSH
T18F65AF4EA6FC01D5E179D17DC583861AF5B1342653329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7fb98dda02cc28ce024fe70ca4b4b0cbb9f890c7aabf78796a2a913dad231fd9
MD5 20bb9316ab63309598dc13c8a1ad6762
SHA1 176ccfb2e0af4b1f24c8c8c4a86e5b5e8ef16217
SHA512 f6df7a5fc6b728d71b2a81fe1a60dd7349da393dd12fed8080e2f17c5944e783e07eaf4bf7a37c7397cb18f85258693f5aed2ac10dbf9ad3d287c8eecc4019a8
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkbxVirnlBUKZ408vTZrX+lgdW:sNc/zEOVHFKiLlBUKubZrX+ld
TLSH
T11C858C1623E901E4F1BBE1BE89779546FAB1786557308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ae2224f80fb0734a72b70459654d3cdecced3b1d114fc0d388e864a86ff52fd6
MD5 c66448c613baae37d4470299040b5861
SHA1 155c3d9e2015e97866ee11e6e2025eabb78bdb63
SHA512 8599d00fbc695362fc5bfcc748232a4a3a191c955aec10057616460a3328642e337c66e8793e91ceeb412b5acc47fb6a4a586f4e198710e8c3814c071bf31080
SSDEEP 24576:TTkNvNnaFeYhJNtmZBmVxVirnlBUKZ408vTZrX+lgdW:TTMwBtOmBiLlBUKubZrX+ld
TLSH
T1C955AF6EB6B806E4D1FEC6B5CD238512F6727861173292CB5390C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b07e46f60a980ebeecb949f056f317b0c9e24b8a6ba75125ad95310206e147f6
MD5 c17a3934bcd6dc610d56157fa076b6c1
SHA1 2647168c0de91155757234431ea1cdc5ab267b35
SHA512 6a66ab5d34bdcc007f4c7015e5bf2ee989914daa3f14115b9b4d23b5d5fb211bb7a2560789dae5ca96cfc013b99087a4b1c369a4e9a1ee9538998e514da1b495
SSDEEP 12288:/HvUrBFrEjwaQ3xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:/PUr+NQ3xVirnlBUKZ408vTZrX+lgdW
TLSH
T1F065E11F22A91CE5E67AA17D85928609F7727862171292DF03E1417E4F73DE8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a0ddf8770682d651496b6734f3d74f502ceb336988a4874b1ed49ebee38a825e
MD5 43b51e1c6ad293642a23772f9ae20f06
SHA1 dfc421a39219bd37d5a65d8a389dbde1ce1e52a8
SHA512 d499c4572dd978c9f3e39007c14dd5797682eb3d0ff00e395ce2486865b7f6911b4286c5c2299320fee1354d4ecc64be44825289b31c36ad0df3bda103496f6f
SSDEEP 24576:FD3FHshBIYQgASxVirnlBUKZ408vTZrX+lgdW:FDVHeBIAA0iLlBUKubZrX+ld
TLSH
T10D75E16EE69C04E4E47BC1BCD6638906F7B138A9032265DB12D081B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1508-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1508-310-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1508-111-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1508-118-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1760-78-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1760-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1760-302-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1760-72-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2164-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2164-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2164-29-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/2164-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2164-0-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/2380-311-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2380-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2380-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2380-105-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2380-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2380-99-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2428-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2428-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2428-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2428-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2512-283-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2512-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2512-60-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2512-66-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3076-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3076-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3076-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3076-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3304-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3304-86-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3304-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3304-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3304-92-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3304-326-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3476-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3476-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3476-130-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3476-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3476-124-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3544-307-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3544-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5080-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5080-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5080-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5080-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5420-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5420-44-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/5420-52-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/5420-55-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/5420-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download