4f1002db18a2f5a9427d077cde8d415000675db995d235713a16bda340acd12d

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260808-tebtfszepa
SHA256 4f1002db18a2f5a9427d077cde8d415000675db995d235713a16bda340acd12d
MD5 6fe035d954eb35a04f29878d9dd18286
SHA1 dc64b2feb60ff7f479e94b2ee114b61f7fc9263b
SHA512 147346db68c81cbcb29c270aa09f16225f623f71818f251a656bda751f8ec28d53ab975779a9a1b223abbf1e148079a0f0f18d723c2a72cf919160574ec973b7
SSDEEP 49152:p+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755Zt:0/PvOBjcXvvOOc56U7dG1yfpVBlH
TLSH
T1E2165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4728	elevation_service.exe
2728	elevation_service.exe
6056	maintenanceservice.exe
3052	OSE.EXE
4236	PerceptionSimulationService.exe
1292	perfhost.exe
1840	ReFsDedupSvc.exe
5476	SensorDataService.exe
1232	ssh-agent.exe
3632	AgentService.exe
4700	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9d7549bd83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056e076b64e27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca4e44f74e27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000364c04f84e27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e60a7b54e27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ff79eb64e27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e48ddb54e27dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e2784b64e27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010003bb64e27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4536	2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4728	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3632	AgentService.exe
Token: 33	4700	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4700	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4700	SearchIndexer.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1840	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4728	elevation_service.exe
Token: SeDebugPrivilege	2728	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3976	4700	SearchIndexer.exe	104
PID 4700 wrote to memory of 4372	4700	SearchIndexer.exe	105
PID 4700 wrote to memory of 4640	4700	SearchIndexer.exe	106
PID 4700 wrote to memory of 960	4700	SearchIndexer.exe	107
PID 4700 wrote to memory of 3652	4700	SearchIndexer.exe	109
PID 4700 wrote to memory of 2352	4700	SearchIndexer.exe	110
PID 4700 wrote to memory of 1848	4700	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_6fe035d954eb35a04f29878d9dd18286_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3052

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1292

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5476

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 32f9d4ba68b3379c829d16e20cec165928d72877008f8c2c0e4dee97a164dd7f
MD5 2c3c905d46fd73d0bdeb1e74dc3ab2c1
SHA1 6c5d44afb39e3e35c9eecce974912f875ae5c7d2
SHA512 4926156ea5cd5da075a041fbb4386dbaa1d3e458ca0bab9c91200a00e3a73313da6a7a3c5011e72fdd245894c9fa9cacf03cb339474f284f9f8b19195afa155e
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbgDUYmvFur31yAipQCtXxc0H:z3q6HjBDU7dG1yfpVBlH
TLSH
T1F1D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 617b7f8dd64b134b4c8c89c0fae55c174dd3a8bde3d7560e0e14a611bdc8ac1e
MD5 b4507122bfc22344a47206ec7130bc32
SHA1 239d2450f4ad3da0fed38d7280530aa77a18e455
SHA512 1e1aa521bb8b7f84c62f424eaf3ba77a079e9bf39b5adb27114b47f39ed56906e4e3e1dbe5ca7bcfbabb60a14e84f7e76bb9b14a5956f228981b1c8ef9a1e523
SSDEEP 24576:dXYfDtczAC8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Itc5gDUYmvFur31yAipQCtXxc0H
TLSH
T10505F12977D404F5ED27823CC9A6C111EA3378954760EB9B03B49A2A0F337D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fc0deec59d84ea9fd6af5ea5cbcb5dbd061e8380dc59c3785feb7e4b6d1472fc
MD5 8da252bc7e498431887aff4be9e3c672
SHA1 ebdafb2c2934e1df7eec23546a4aa0658ec52b63
SHA512 8914c9b04fcaa86a140ab817189d1ddcd21a72e9501ff504014e72cd998cb32ea3c4ab151fb2299adafa0b60d1c9015d24951808d06517b57e6fcf070031a2d8
SSDEEP 24576:p0Le5ji0hmxirMb8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:pPji0AcUgDUYmvFur31yAipQCtXxc0H
TLSH
T175359E26F5748331D073C0B9C5D2A69AED72308657308ACB4296D77C2F67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d3be5f8e674844ba6b774cf82be4059067efde63aa372dd1f6c68177fb0af065
MD5 b7a4935ad35e806cc0eff95b52499d02
SHA1 f605494ad5a756d19f22fb549f34de2220e8e986
SHA512 55123d743247f368fa8f75c3298f955492aa46bfd9536ee65b134178293267309407b97b90eddb215d7f3b8a1fd022250ea56fa9d816683e2a510fd0436144e9
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyuZ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Y/ezSC6vUzPvxHjyIgDUYmvFur31yAif
TLSH
T1D4756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6c0135224cf2c9638adc54003a1920ca3aa619ecbc2ec0e70aab68a60655c63e
MD5 560932f683087b167d7d7b4af61ba491
SHA1 ee544b848315af6c6e7568071de218eeb70804ad
SHA512 bca21620474c302d1ad8f7bd20d33b3cc2df2720c238b7a60abf5b998e6ae38bd90d0e36b4b1cb67bf6540b34e9afb174bfb310fdc7351582c1afead9ab30d80
SSDEEP 24576:sVbqPb88hv/l+6u8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:sVO88hXl+PgDUYmvFur31yAipQCtXxcm
TLSH
T1D255AE66F5748331D073C0BAC5D2AA9AEE3234425B31CACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 c359d03829617b6dbf9de777fe31824e5a8103f175d16f4fede83ace4c0107c6
MD5 dad3700d3ab0d051d0afb7c3225cdaa3
SHA1 5a17a4fe5ff2b531dd0521ed4bfed1f7711c0939
SHA512 f245f71c4adc49fa59e686cb2880c8c088fdafd64649b132686791d6476d02a604cbf5b829968dbb4b769818ce327001b6856394fea877ffabfa145e33537e0f
SSDEEP 12288:nRqEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:nRH8NDFKYmKOF0zr31JwAlcR3QC0OXxx
TLSH
T18BC4237B694CB0D3EB260530C6FDB1A56A4A3FF86946DE3662383B2E0174DDAC81445F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dd96df5a1570a3a67ba247d9e73f87ca5fa5c8d1f109e662007f22073c3356f2
MD5 adeba5bb1dda5e576561a9d6ce012916
SHA1 e1aa6b0a6bec94354daff2ca55d0c4f22a10402c
SHA512 9980a3213148ebbc97ca716ec87ab52a4e51672f7e6af5955fffa999ae69a6721abc152ba7d1c53b1d2bc3e3873f9255dd5d66eb0a3fa10ac50cdea7768cc08d
SSDEEP 24576:ZJIU28NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ZJIU2gDUYmvFur31yAipQCtXxc0H
TLSH
T18D05CF3BEE28FCD2C67A4DB85A91C240E76278704F52A7CBD174830E8E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 34e421f955a2f6461673442b25062a5dd0644c3b01c7285d7c18645f5330d8bc
MD5 dc6bcfc90784573e940098b827c82e0f
SHA1 efdb752e3587cd175aa394afdecdc29286cfaf58
SHA512 13b671f1c14ba4725347f90901d7fcd49b99fe3d9ecbaeeff21e580498a6b3de70ca3206c49e2d297fea433ea52e39251c46092419af238fcdfbb8476ed6b27b
SSDEEP 98304:5QvGAdlCEL8c/yRNw5CwU7dG1yfpVBlH:GvyEYc/y3w8wUoiPBx
TLSH
T1CB267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 34169f6fc545d6b706b5f78b02befd28a553c712bbf1a6305d51fb36dc558af1
MD5 9e459c3c35fb53cf756371280c32e5af
SHA1 a158c1e97188c034606b9fbe4fc7a199bde91a20
SHA512 55e6ace06189b5ab6d96d6cd00419c8df82f29cab391ea449482630614ff2abea7379d2d06b04a0e04a2a766cceff22491fe97b6984033f79e2b1e15d84a3c65
SSDEEP 24576:JdewsAjE8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:XljEgDUYmvFur31yAipQCtXxc0H
TLSH
T15015E031FE74E032C67B0DB21B7AD316182D7A604B511AC3E3B85E9E49306D26776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99716f5b391aff0ab0ff7aba037334cfbbb5d2844f7030ea917029e966c20891
MD5 27a81682d33cc3c8753f302279c1a1e2
SHA1 97d3ee8c60cba1c92da132bdd3c64e2e58449d4a
SHA512 b2149f16c9f748a77100445725e3cbc1036308bf4a6f503050a5e1ef9687f9e8eaee1a9314259163157218dbbc5a4cc818144d82c2a4de33538045ea488ef4a3
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9UoiPBx:0UEtQevvqc2W1cpV2EI329
TLSH
T162474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4dac048ad94fc3e13568a3f8602149fb7357deb66470674a163e82a72f5a1df9
MD5 c7d3719e152a47208b6fe58b2735e402
SHA1 f7678fda992e7b37eec206601e6abbba5c51dadb
SHA512 d92ca762406579ed56fd0530b453275533198365aac63ea16d5ecb9f9712facc0aaaf619d3a44aa18fc613dc0c4bb110f66fe1bc467b55953211f970dc5ef341
SSDEEP 49152:ECbRquA/m2yL5zifFiV+XenmE3/zkgDUYmvFur31yAipQCtXxc0H:NoqHVjnmsU7dG1yfpVBlH
TLSH
T12AD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d76ee847bcc5b6cd88fcf543954858d96251dc9ba699db98c42f093aae926f97
MD5 54b89899f89f68115d1e7fa008d9a4b2
SHA1 6e022ee7bcb4d64ab185183ff8c79f6210ea392e
SHA512 5436645cd52210695ff87a5e12a7566addfdf1f09519da6dc6eea6bca8c4947955142b5ac29e0e009f7bbec302d15ff3e504a95af200280d71dce41ce5cd439e
SSDEEP 24576:BAhGLJIFoiwtA5l7S53d8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:BAMyFoiq5tgDUYmvFur31yAipQCtXxcm
TLSH
T10635AE81E7F951D4F5B3AA7899B69171EA76BCA55E31C20F2160D21F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8b907f36fcd486b7005ce6229253d21e1a0f2d8b2ff0940ef192f92186ce2087
MD5 c405a7c7137d800754e68aa46d5453fc
SHA1 4f56f4e707494a67d729155068ffddd65392264f
SHA512 183ec1c729ebd71afc15c0cba417976be8acf18e56a22de913f74e33f6f1c7cdcda0e74823a460167f23798833dc13868ea9544d1bbdc144655b1a61db85eb3c
SSDEEP 24576:FwuoOW48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:FwDOBgDUYmvFur31yAipQCtXxc0H
TLSH
T15505F14A769818F9E9674238C59BD136F7B2BC512A21DB2F1370C71B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 866ee95b2f5a8ca7decde6028f88672adc3b53b7c976b719e7d5a19aeda66ebe
MD5 49496133da2a29e0c0ecb78fb17d6a4f
SHA1 69b4d786167e203452b7d31793a38e01e06a3890
SHA512 cd13b3d2c5d95f160a29861c8885554cd9199b4c8b43e78ab7b2772c0e3c543ab91cfe0e7cc08958cd2ba9273b7a1784fe2e39e957be852f7f63f0200725a22b
SSDEEP 12288:OBZ1IyXEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:IZuj8NDFKYmKOF0zr31JwAlcR3QC0OXn
TLSH
T122E4126A36C870F2E5234238C9F99245E77238A5677687DF1234176A0F32EC69D38727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1e7d735f7978c4b375313466e1d148027120a506fc48ca57648442bef2c4cf45
MD5 a492b94757ba1a1ebc5aafa5ae48e12f
SHA1 a53a68caa1bc2874a2e155156b45700998acec07
SHA512 7f94c001be7990960cc33cc73f961eab647b1129b98c53f848301252ee7e1a4f101c278fdda706c9996012bd136ef6ad5fed28b9592b08fe93135b4c77fd6929
SSDEEP 98304:sQRQyi36YOcPQLvw2gAf+PN3fU7dG1yfpVBlH:zQyiKayX+PNvUoiPBx
TLSH
T13A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1c098317fc38361f148a98d0f61f23f04c699f1a090f64595b952e7eb650dcc4
MD5 d9704119d6a3b32191d8c9b74bad1fca
SHA1 513e3318fa27cd3d55fb722257ebcdad709f4f27
SHA512 33d43c4199d7076da1d9fb0ba6897164a77172e6641efc3cce905f410565cfe9311f2bbd66854546e86efda70706d1689682148482ac5c0d9fcd29b92d841b96
SSDEEP 98304:NQRQyi36YOcPQLvw2gAf+PN3fU7dG1yfpVBlH:kQyiKayX+PNvUoiPBx
TLSH
T10C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3dd07a54ceacc0ca2ce5fde99793b66e852de535a20d3355019e1937584b2edf
MD5 303d841294cba162631cee9ba852220a
SHA1 8cccfb7842cac0d214e3b23fbe6f5c7b9478e687
SHA512 73159d8ed60ccfa36f3ad7fe93c6686e960f4d9b70b61aef733f88321ca5ab6eaa901f7034c933c9422cc89f79e2fea9071c59100d04923dbffac9718dc91096
SSDEEP 49152:k68Qg55nhheWu7PNU3/UgDUYmvFur31yAipQCtXxc0H:OthWRc/VU7dG1yfpVBlH
TLSH
T1BCB55933B2F60099C44DE1769F4A973196D27C758FE0E3DB8115720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f4da3996987dbd662aa1245c0844c253b167773530b8052479185ee487766ff0
MD5 fa9f5fd3545e1ce31c0733a0f1a7b927
SHA1 e33df58682f8b58a9a090126d8903eacd61af940
SHA512 98848ef14353b3c46b1abb37df3e237a49e2c5c44565ada9dfdb6ff8408e56e523c01a891b2eddbcb03b075c42615fd8e501b4bc487edd8267f49c7c1c5907ca
SSDEEP 98304:sy5112gYy5azzVvL69nLKnhZyU7dG1yfpVBlH:tLIHmWhkUoiPBx
TLSH
T146167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6223449754eb629586546cee7a36982372f2da8d0a1eb5b5335d51056583f682
MD5 416111f646c7b72de3db57bc03940bed
SHA1 f138b2d1771d60c575ef6f5ffa38f74184329cd0
SHA512 2ed07a7be506bf18c6f39673a2425ce840176798790e06fc7a3db6da739a9aa98a152e387345bfa8ffede4b7f95ae5421b14040c7b09e8b999f3dc19be6b738d
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glygDUYmvFur31yAipQCtXxc0H:3u6JmVxd2dnU7dG1yfpVBlH
TLSH
T1F3D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 096d93a50a8b1979209d16f6c4587b479e56a47ab175238378d7cb160630e8af
MD5 a4f790b6eb2aab358da570047ff3a7d9
SHA1 7b0906965dd95999b91fb4705ca8a3e3e126a82b
SHA512 aecfc34c37e1f50fd7637b604aa45118eeff222bc482d69826c3e9ea50059b5d4967470d8f927908f22ae9bf05606a95606a854ea455a348090f485be247e3b7
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xWgDUYmvFur31yAipQCtXxc0H:jmifPbRsU7dG1yfpVBlH
TLSH
T126B5BE13F2D900E8D06ED178875A9232EA62BC450B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 39bb3c1dd94e0ff12bdd2d972d59d75d3a0b69bac4b65e454f647b24153a6d0a
MD5 6b6dc218ff8430cd7ff48fb4f1edc701
SHA1 2d3a833446c975abe9b1d2366f0d178f1f16e7c4
SHA512 5061cd3c206684ffefc9c43f1f67b5099dd4b9dc3b6ccd974622584e8142f0eafc7b65717c375a8a1f160715ad3e93a88930c09e602c60b6e84d7c2ed0a37474
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqjgDUYmvFur31yAipQCtXxc0H:q5dKTi61GU7dG1yfpVBlH
TLSH
T1DBC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f7a3afa02b261353a82be792516ce0b5c714f19f71b49780e409a64583421a28
MD5 50c17ae9cb3277b5168b59bdb22cf00b
SHA1 499af222d01ac47f6cabfabad6249610eef3490b
SHA512 f492539979962335fd73390bee00279ab31fb6267691f891a25d5ddabf13b55a50dd474e35f9736f891a54f5de07cc63b249af24f122f482e52fd526797fae6d
SSDEEP 49152:1htSn8EApI0figngiDn0AP5wigDUYmvFur31yAipQCtXxc0H:EX2iyphIU7dG1yfpVBlH
TLSH
T16F95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2fe03675166699cf123cb08edee44be69f4be619e96f0c38d885f8040cc06006
MD5 103decb703f1d17b24ae003a526722c5
SHA1 cbd910a1590f4a4d2d3c624698e5bc9a3f304d83
SHA512 30dedd7643b361438a908f91464da86b3aa1376196dd056a714a6af8f0e5ad21fd0bd85b2e5fd2b95adf849eb0a73c454b44ad728d595042275c960c642aa4e6
SSDEEP 12288:BCEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:BP8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T15AC4237B684DB1C3E9120570C5FCB2D1AA4A3FF9B6469E76723C372A0270DDA981485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6692d46779b907b8a8e541d460af744e12b796f638191c39f738c15a28d60613
MD5 3b0a2392e8ec7ab0bd374faa0bcbec48
SHA1 24913fd72133192ff0519ecfcbb73e04ab9bb5f8
SHA512 9cbdccb42e7ec8dca77014d2a7e3f69bab1c048ecc925b922047c35bc6bc156dc8985760ad7e0590f7db83cc7ca6886d192fab67bfac040558abd4d5b24feb55
SSDEEP 12288:PjEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Pg8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T188C4237B684DB1C3E9110570C5FCA2D1AA4A3FF9B646DE76723C372A0270DDA981485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4b5e1a3f36f626a84311ac2d09a52fab548fc6bc78abc10367d858b87a08ab80
MD5 29038edce52ff5b996c32898bf871f33
SHA1 18a557c0e4daaf66fb19880cc976a96c0ac4c7d2
SHA512 db24732aafb5abebed5db709078e013f868b702a0fcec75410d1ca06b7a4dfd55eda8b8cf8830dbb8f064c5f88154313b0687acfbec4814229db1ae83981b6ed
SSDEEP 12288:E1EFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:E+8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T122C4237B684DB1C3E9110570C2FDA2D1AA4A3FF9B646DE76723C372A0270DDA981485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a57f1c6ba7901d766d2dc0747b7d2fb7269e5b9aa78ea10850c87fb13fe347f8
MD5 28664dc087b357b35faafd4d73d0a87e
SHA1 6413d056924d4f46ddb0213214c41e55a273b0f1
SHA512 7f8d0d8df5846c87dce3361975b9682b889dbb35ed8129d3476484cf84b9f27bb3e85b0052b7dfe5aab911c7ee7980f87238c51ca39c816dbdcb30133689a6fb
SSDEEP 12288:dVMEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:l8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
TLSH
T1D4D423672A4D60C2D8228274C5FDA191E76A3EF8B712DF7F63342B1A0670AC5D83495F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1f113a52ff91843466eb579223a354a24931118c694b29d32fb5f99b554d6e16
MD5 534a4f03d9bc038513da905c14f3a548
SHA1 5da907cfa9c6e6b99f76fa696f3da6a12343e136
SHA512 002c9b5aecef6ae64e02e3c219f9b4e3a61b7912e871fba2f924126accec9bcf3c064f689cde72c2daad04424415012ec0706eb27882e15b9f47fe81f4c00a02
SSDEEP 12288:/0EFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:/18NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T165C4237B684DB1C3D9120570C5FDA2D1A94A3FF9B646DE76723C372A0270DDA881485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 045a7ac072484b26ed64980b89fa30b45dc97689583881806df54d4955b1eea2
MD5 653fa904b12d5fb7810d13e3e04f585e
SHA1 0395bc490dcc1f3012efe2fefbc5f4c92dfcbd34
SHA512 2e6981132a04f7956548cc2309315a2ac80cdbbaeac617c66dd2fd32118076885c34dca8080fe3188fd08abbc4586cdf071fc7d81ae54409d5e1fce826d9c80c
SSDEEP 12288:RfEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Rs8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T142C4237B684DB1C3D9120570C6FCA2D5AA0A3FF9B646DE76723C372A0270DDA981485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 075a893475283363316ee3cdca6adf9dc625b92f122d7030ed175d7d553b22e6
MD5 00e873af587b8c1b96db21be2fafae79
SHA1 938a06fef1db0d676e27ae3e121df702bcc87763
SHA512 3ab1466da1c8150c4f209b4730c432dcb630b961d34df07f1578af07c96976d37effe3994f603de429699589ed4587b135c5ea41a7ed957a2dc78791672bcb7f
SSDEEP 12288:cLEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:c48NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T135C4237B684DB1C3D9120570C6ECB2E5AA4A3FF9B646DE36723C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0b79f0953ad1dda08b66012977580b048f18d0c7009d7519a3a57ce1b020bcba
MD5 f10425ba8cdcbc5a1d18503c3985730c
SHA1 e4db22823305844d1b952d0ee6c5c06e0415b8a8
SHA512 66f18cdd21d35f05423674bb1febdc5f8d2280a8615bc53c14d4d9699affb9a25587e8a0d191255aab30d71c1e8641e9be1e58057b60ed34a1fc731f787abd8e
SSDEEP 24576:dZMSzFVSOA8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:dZMSzfcgDUYmvFur31yAipQCtXxc0H
TLSH
T1F00502A5B39418F5EC23813DC9699506D6B27C691B60CA1F13B8372B0F337A15C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 31f91ffa7e6eac0590c454118592da733ef43d365b156e5b1795d37dc5646e28
MD5 6bf4720d7f0eb37a9d61eeb6c553316e
SHA1 b16ffe00fc84ffcb924b9ac167df4f4cfe6f934f
SHA512 2fb62cb84d3669c1a0177caedbb0feac33fdfb7a0c9b0ab60b54143abecfc6172fdd722470cb86f56e7a44214dc9c524f861bb398ecc7bb3c02c48fb63701ed1
SSDEEP 12288:72EFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:7T8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1D4C4237B684DB1C3E9120570C2FCA2D5AA4A3FF97646DE76723C372A0270DDA881485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 7cad4ca84644e87b522b3abc98b2f306308e66320274ad446341083b6d188ec2
MD5 96b69091ecd658f2e5eca39506eddf46
SHA1 a6ee4cf55a9e5421912dc6f7201777844aeb8b0b
SHA512 e1d9541000dd1c596d9e02e7599d9d2f93c71a641efd8887e7032beb69d9d3a6cbb6f21064393e29ccfe4fcfbb35c373318f5877446c460a71d3d449aed02b25
SSDEEP 12288:LaEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:L38NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1C4C4237B684DB1C3D9120570C6FCA2D5AA0A3FF9B646DE76723C371A0270DDA981486F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 7ccd79b08fbdb6c71db16a23f7b6d49c90b722d1488e12d3a3ec189cce884480
MD5 7b9b5e946565bbedf92f17ebd90f88e2
SHA1 0016fb9ab5c08cb3a6b058fa964776a5f32bf446
SHA512 bdacc6e82b408a5fba8bcad763d9beeb3b201beeac1de7674bbf5ca6704cf40903abd52ed0215295e8f3a2a9f5cc7eaee9399663ec4d6da8153f038b6dc3adc8
SSDEEP 12288:uyPz5L8XEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:zzy08NDFKYmKOF0zr31JwAlcR3QC0OXn
TLSH
T1C4F4121B769930F5D1368238C8AA1642F776787617208FAF2374173A1F33AD19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4649474587507de1c7524f32931448ed53af99602ef263ee961c02bc19e391cb
MD5 45396c4f6477bb4e0467e691a0a45b39
SHA1 f5d0ac0cac4567cd8e95f0ee4645e3f68a0520ed
SHA512 a692228410ca7b2735094d04e2f57b4abb3a28a2c99a18e52a3ea66074c551893075caf716b05796ab628316c8c0474229cb1ce9b3750851fb74857a747a2d2b
SSDEEP 12288:G2EFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:GT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T17CC4237B684DB1C3E9120570C2ECA2D5A94E3FF9B646DE76723C372A0270DDA981485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1540b432b3d42f9a38d87c2994b52f8ee78890047dcd4a3feba70be54e2976d4
MD5 e73067eab363fcc50f6735145d3c21e0
SHA1 879e4f343bcdb981e214736fed0d630bdafd4121
SHA512 49b6d1cee7c21b8ab147d086437e2946f7fd5a083dd9771cd9bb0d1a54e208936dd3eb9f350f5f2d0f60ea68af608f52f688f65c55265880d6adf1f2a21d60cc
SSDEEP 12288:F2EFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:FT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1CAC4237B684DB1C3E9120570C6ECA2D5A94E3FF9B646DE76723C372A0270DDA881485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5ae0434f60cdce93bc6e027949b68e35a5153930075ccd226f8bd7770358af92
MD5 61970db51b40c0cebd8558a00215efdc
SHA1 5ded57c29201f145e8bcf272749f4bb44f946ab7
SHA512 bbe2e9f21f06e078d5862116abdcc631833dbcd52875e4d02579302f4022a37aff7df269cea18f62a4a50ff09640026fa46bff57b8cb332a04cbc0e8df841e46
SSDEEP 12288:CyPz5L8XEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:fzy08NDFKYmKOF0zr31JwAlcR3QC0OXn
TLSH
T114F4121B769930F5D1368238C8AA1642F776787617208FAF2374173A1F33AD19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7389a3bb63f172568710e654e0b79d0a2f91a3f623762bdaeb4cf3da18d0191f
MD5 3a9203d293cef3eaaf5d5c75c3d75935
SHA1 13019fe122cc69d23f38d9bc5f3aaad5d1daaa95
SHA512 b492743a62ecd0c73bebc1be31b6a4fab2a86d44f2a431bef82d22dac859836d61b59b3d7cf71b2ecaa9885f9482fef39289fccd4c55b24eb114b63b74655be4
SSDEEP 24576:eTHaLl3z0zDO8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:eT6LljZgDUYmvFur31yAipQCtXxc0H
TLSH
T1F80501A5B35018F5EC27813EC9699516D6B27C6A0760CA1F13B8372B0F337A15C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 d524b841c35ee1dc2fb04b5158eed5c7563efc1f002e171fa1dfc6354544260d
MD5 1231496b47c3fc7f94d2934018b57b54
SHA1 3bb2a3ed5a4b63961d2e1061f16eae8f601ce644
SHA512 a4645c7dc65823daa797000e114683241b9ac1d14cd283b2beb023409451a9506d391790628f81ba70a94dd581b02b88c1bbaa4fa39af3f46d1456492bc7a65e
SSDEEP 24576:F37d9CHKy7GZK8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:l7d9CHKyacgDUYmvFur31yAipQCtXxcm
TLSH
T14A25CF91F3E810E5F1778A35C9765511DAB67CA91B21DE8F03A8261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b5eed8957d8ec89485c2017c646a612e16b063ebc1bc4f8ec461ac4dd8f162a6
MD5 9768c0562dd888e9cd3ddcfda34d94d3
SHA1 60c401e307a25b4ba5b8f25ff8e6e454ea4fad6a
SHA512 a86db54d789b696b3a3ec6a50137bf48e0105c56ec1202c3d6ab7ecbe7a98ec8b1669a916a616d4a62b2c3f3a46a24d3703a80b17c1e6d42376857b89ae46027
SSDEEP 12288:0VEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:0e8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T162C4237B684DB1C3E9110570C1FDA2D1AA4A3FF9B646DE76723C372A0270DDA981489F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e6da7ee7708e382a4f620a057955fd760d0adf3214625bb358aa6c6420c68c66
MD5 6ac36a001f9fe853ce9823904aea5ffe
SHA1 fc49f5a754f2b1df3e0a2644d7313491bf166b65
SHA512 af3fa3105fc610d5f3ddf4ba6f839d5dd0c74f7607ea75c8ce019e82a73f5ff8f0a883ace83a9ff3267ed29449c3a4e701ed2677c6e5dca424e845b24fa27a70
SSDEEP 12288:U3EFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:UU8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T105C4237A684DB1D3E9160570C1FCA2D1AA4A3FF9B646DE76723C372A0270DCAC81485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 45f0087ad0d9b65e8369e7f45886b64b32248192aa7570bf841f824721067421
MD5 8d4581b4d3f55c41b7ec62df36a84fe1
SHA1 6ee46f973f1a74581e6df9fcee8e64084a4dd05c
SHA512 9f919f9b0bbcce4e4d50d2542f1bc07d95ddecb1972d34b14b30bde08f301503091da5f7ecbe18054c90832a8141b6e2543adb1bbb1b4faccc8b2ff47cd55226
SSDEEP 12288:vAEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:vx8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T190C4237B684DB1C3D9110570C2FCA2E5A94A3FF9B646DE76B23C372A0270DDA981485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 5849c48e63a59613e32cfde60bda8d47da77dc34fd1922392f20805a118f251f
MD5 ce1fdbf0f3eb7e3ad4481abbe38d7f0c
SHA1 813923f392f728faa4839dc9e455addfb8b1c271
SHA512 4d006411017ced2d936bef7a7d9bb4146466768f95404afae77e018764e8394eaf1dec2f6f084ac64b55fc6cd209a2fd8bd84e0bf7faa53cdffd468e19c1cdcb
SSDEEP 12288:62EFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:6T8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1A4C4237B684DB1C3E9110570C2FCA2D5AA4A3FF9B646DE76B23C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8f9f5fcc0915b67f4827503cd62d65c366eff3d90c1ca7c068e51875a1c0f40f
MD5 e1abed0cc67374e832278bad53eb2580
SHA1 0a8e758ea0aabfdc31fd337ad0fa558c85044441
SHA512 a29b1cf99b35a5c9b13cef908c5abca6dda3c7f3aed7d293eb01f20aaac58ecb43831150d67c443e46b2223be4183cd33e53e26f01154ef2070a4d6b041d6274
SSDEEP 12288:gVEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ge8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T127C4237B684DB1C3E9110570C1FCA2D1AA4A3FF9B646DE76723C372A0270DDA981489F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 5233960826e75f59fc5d885befa70b708991e4f5a614523e23d586bf7cf13084
MD5 826a8f9d88a13379685e3a7221340b85
SHA1 40df52181e03c8a539b8f53de85e77aba39ee4ed
SHA512 24cc0ff6e771b4bfc93a20b79c0ce24be3ebdc421a084641201d1828e4534d787298bf4ae4b2b66570971681ae3dc3a85e4657ad05e46571a9c335aeb468d10e
SSDEEP 12288:KeEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Kr8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1FCC4237B684DB1C3D9120570C6ECA2E1AA4E3FF9B646DE76723C372A0270DDA941485F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 9800c9ed8b646aa2c4914494daa1fa83836e40fafb2929a269c76ce826feb108
MD5 d40b725a61dada94f730001afc9994ef
SHA1 3dabe6d046dbd05dd692fcd3257895762c220a4a
SHA512 57d881e399f33492bd1f9ada4de1e454e8c0e278e93288afa9192c5c311584c1240c6e7034f994d60feca62fa6e45474bf20ac273e1b67ff0002e245feea6862
SSDEEP 12288:70EFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:718NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T12DC4237B684DB1C3E9110570C1FDA2E1A94A3FF9B646DE76723C372A0270DDA981489F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 96e371f98e7aee1c51bc71149f9ef0a9b3af946dc5f91e1b209fa9cdee65d853
MD5 9786b094378192501d41c1aeb8e3c59e
SHA1 09df4fe058cfeda74ddf13e081d90475280ce2ad
SHA512 b85edee271cf968979c5ab1a0d68defe5663c4f001f46e084c65e75757d0f91dea2b64e0f2cafbb17b955c1645880fa16e7c2d2fa241c4ce7436dc60c66b1bbd
SSDEEP 24576:1fwvok9RX6wkyAIn8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:zMnYIngDUYmvFur31yAipQCtXxc0H
TLSH
T16E35DF29EBCC44E1E177923C89B7460AF6B178691B31C6CF126A536E0E33ED49D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 24a50674819d3a5e28c2d15ea1c391bb97313e3c8fde6e6c2b47b6a7b126bea0
MD5 988ac762f431d245c40f0f1464b895fe
SHA1 fdcc61bd552426f8fbedc5219211d00ff7c1d160
SHA512 83d9f02ba4cc94588ec43f312898a141a6d2c9193307774bd5f4a37a3edbd7206c977a9ad9fda0dcb62a83b599b51b7667135c43e9167a37fd74b1cd69d80059
SSDEEP 49152:FYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CgDUYmvFur31s:FySzP/U7dG1yfpVBlH
TLSH
T1D9067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4cc1533629efb2f8298172cc8422ca108a9b4b611bc9cdb01b66279efd73f45d
MD5 e6ea3e2aa9126a22c45ca906785e09f4
SHA1 060e5df9f510c5df7a78e3e84c8a808bd64cb9e6
SHA512 d09285041c867e5358f0714d35ae3b5ef187d8daefcb098cf1243fed7cfe189232167087c1b3522abc91beac4333d1edd2c7e840a90331bc5a7977e87c932263
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYw8NDFKYmKOF0zr31JwAlcR3QC0OXxx:V47JUQj1irIhCnDHUPfF/ygDUYmvFurK
TLSH
T1AB65AE1EA3EC01E5E17A827885558A5AEA71782D1F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 69e9e184e73cbee28e8604decc31f5ae318b570f218035a470e0e7e4fb5936ea
MD5 525a466363f5775d18af04e741e79f57
SHA1 596bd28379901718dd0edf49341f2eb2e8a6d5ca
SHA512 6695b875113b8d28acd1c06dcf7e42fc3cbad8976518a542c2a5060ad6fdfc9b35a6c81c58c4350e9bfd7adad76930988dc7ccb4b6b3fb41cabe8d2adbe947f2
SSDEEP 12288:dNsfGEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:yj8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T1B3E4011AD28812E5C02E5235C7A99281F7273C6597E1D7CB63E0F63E0F75AD09DE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 44a869c06e0192ffe40576fb1e4a37c63dd722d0c2b3e48e5a7d9593931b1d9b
MD5 9ac5d74589a08b8fd695e5475060e49f
SHA1 da6d45de928e6625f06ed96563ba1490408fd9f7
SHA512 6a88c94b259308adc5a73e1225a64095fb0165f530f72c15bcce3f29a52532c695640f065c3f5cb6eb5f126023a08143cfbd8d43e6d38efa2c325c3402d1e3d9
SSDEEP 6144:asBC2naI5dTYR9yVLcbPotMxcA1YU3fUktKIe9NcH6I0BgijgCzbFrPZf/Opl/IE:fuqRU3f49iH6ITiZFrPZf/Opl/Ve+B
TLSH
T195353810766BD75FC6AD40325E77C2CCAB707D01EE459B0372C8972FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 eb1393849fcfe80f722463d76b35d92db914a40705a0d035a0f30691dfe13d4f
MD5 6a30e0afc53c3178787d7d3dc7eacf60
SHA1 bec685f6ced68b86f58717f1d7ef8b2fbd9536d5
SHA512 252a21390124d001ae0bedb03e0e63db4de04c52d4c53ca346ff0ff3058cec0208aada9f8f82723163b75b8a402ecf8dae3cc19cc18fd35640581f5f6723a4a2
SSDEEP 12288:vUKOdVZAq715/7TbZ4+CbfpE2gRO3Ud2o7fSmRmdAHZCH5eJXxmNPqOj:/1L
TLSH
T14A65E8816437A38FD1FB6072076A5A4CA7A4EC03B7456F277388453AD82B725B0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 45b7237f621787fe0973cd7b94b8aad1028eb061a3e36fdb890f6f41d319a80c
MD5 51ac5d3184db30adb79f5b55473626db
SHA1 f33c959f042b3a941c0f8e9d836799b5540be06f
SHA512 1f4cd4be4fdd8b9733d07fdb02e7bd3d58b20430b909fdad6b6484eb280973106f90ed7771fb750d8180c3fba892b6c3de0d799bd9a73abe5e379a6cf242f054
SSDEEP 12288:Pz7uEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:f78NDFKYmKOF0zr31JwAlcR3QC0OXxcm
TLSH
T169D42377AA4DB182E936057085BDE160660E3FF86B45DAE7B138372A0170DCACD7491F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5c56b9c2ce25aa4084fa8407206ed711d691e8f15f72cc8c204a74a5d8b3159d
MD5 8f29e03d0dbefce96539419dfd851c97
SHA1 85eaf091a5b9176d8647eda4f5b0f596b85f9cfd
SHA512 2ce3465b5cf8ef4a12658f2157060886089f9e37a938cf608a7cd25e2424f4639bd7aa7e7191f4175295fb8b7799314087f987a0a8f004d59ebd484abeb4f4e0
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYZ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:fgb4mBIBhGFwgDUYmvFur31yAipQCtXn
TLSH
T174659E1E22EC02F5E0F6D2B8CDAA4417D6B278161731D6DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 bd502419b7e50d3c1dfb3538616e59d6e72648ce7503f50d36e3dbf825c2be99
MD5 409fc3695f69424eb01670705914f54c
SHA1 701deecba56e3a9a719aee5495156e03171408d4
SHA512 d122a0273268649fe384cfe6ee2ea703810ca4fb41e5b04300a9f48dfeb26e144acd1dbbad2cf9e360912d27c194afea115cb41426b679f5a7a4f91d548a8a35
SSDEEP 24576:OG88u8FpJqH1bzria7/mA8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:F7ZFPqVea7/RgDUYmvFur31yAipQCtXn
TLSH
T16D35F16576E501F1D437D1388A864263F6B2B8251364EFEF07AC8B550F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9cbbbcb667a567b1551faa98fbfa98f2855385d112343bff3bd4666622b69888
MD5 124ed31b60d74c0546babe5b1b49bc54
SHA1 309b0ef3d7770beea4eeeb188f4f5e1036f5df25
SHA512 4c9366dc295749d221adc8a93ea83510b77cff13e3874a0890c179b44a1c61120026fa64cebe414667e405262064116cc468835d6e9b36431718bc966d541fc9
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsgDUYmvFur31yAipZ:KG05lO43bqU7dG1yfpVBlH
TLSH
T1F5D5CF6E62EC11F5D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e5b2f4cce97d8403cd4018f78c8209fad47c96bc381baadbccf2bc7def6dbf48
MD5 dd6c517608711360fc9f5b8f92b3de57
SHA1 99ca16d69e56049c956251d4c0e67eed863868be
SHA512 5f3221a6ad1ec126ffae089e441ea5ce48b0ae27f2bc68b2c77043f97a7c8bf98caf98bc13390d9145dc3d4b2a6d08e63b8d5ba96c575f2379cfa8ec428cfe4d
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnC8NDFKYmKOF0zr31JwAlcR3QC0O3:6a5POZ3+Jt2pasx2+mUgDUYmvFur31yH
TLSH
T1B465BF5EA6EC01D5D579D17CC583861AF5B2342153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e1130c0b17a0a031c8f978e5d06b6d8ee9ca61e70ab090b1fbcadeb46d874660
MD5 80b08864c8b76e5e02ba61b2be8c3bc2
SHA1 dd6eb5d7c24781d960ae60f1ad5b8e6c31a96a02
SHA512 a0c69ca185311d78c44fefbfb0160f73dc54e45bc85eaf5893bbac44d334b9f4e3a9665668a92079a5c639d2c4414ec798f0897652824802d9f9a6540b7f7f79
SSDEEP 49152:aNc/zEOVHFxgDUYmvFur31yAipQCtXxc0H:LIA+U7dG1yfpVBlH
TLSH
T115857C1622E901E4F5BBE1BE897B9546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e44d03823ef3f268195bdd241e8d789674e182166b3bdbfaa62dcbd0dbbedf21
MD5 e25965713ef2d02055118efe44c42755
SHA1 2240641444feffe59e18c33dabfcfd7f3863a73e
SHA512 b7fda011f2662d16ca3e65d2ca05f0a9aa090c54e3de2958a0a0d2d8bc72e7f310b798d341b59eb7e8f76e6f3dd1cf29cdeb4e7aebf6e81bfb02550f22e01823
SSDEEP 24576:p8kNvNnaFeYhJNtmZBmu8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:p8MwBtOmugDUYmvFur31yAipQCtXxc0H
TLSH
T17B55AF6EBAB846E4D1BEC6B4CD238112EA727461173293CB5390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 b61bea6f080a9e6211e72245a99929a32b6db17dc9b9e0fb54f09c50d2a0c803
MD5 4f278d684b78a6f0cec6d0e71ef9daed
SHA1 eb294c65e3a0a0b4241f6347aaa08e86554089d6
SHA512 9a47c7d1fd6cdf02fedc03d4cc8e219e15f5c536fac586584e957623cfbe0491d52593fc201c16496f9d1783798958bf4c1e20c40de29d85f8f6ab99e8e5e3a9
SSDEEP 24576:/PUr+NQc8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:/JQcgDUYmvFur31yAipQCtXxc0H
TLSH
T1B105E12F269C18E5E636A17CC5968319F77278621712D6DF02A0827E0B73ED8BC3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 2b740181610d8fb43a4509c2f39618db88fae778cd9a1cf1666c405793f3efa3
MD5 a4e18e43686724d6e8496e7f8445e053
SHA1 07e27da27d0e0dbb93e4218f799246ec9b9ed3e5
SHA512 b8556b57bee9841162b20bece83436e980955a721204aec88e74cbc542c70be512aae49e81703a03419d5d7968a446ec7300da838dbae16d76c2f6a79ac095e6
SSDEEP 24576:jD3FHshBIYQgAv8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:jDVHeBIAAvgDUYmvFur31yAipQCtXxcm
TLSH
T1D425E17EE65C00E4E57BC1BCC6638606E77138AD03225ADB12D491BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-120-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1232-316-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1232-119-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1232-126-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1292-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1292-89-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1292-84-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1292-83-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1840-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1840-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1840-332-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1840-100-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1840-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1840-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2728-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2728-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2728-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3052-283-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3052-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3052-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3052-66-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3632-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3632-140-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3632-132-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3632-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3632-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4236-299-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4236-73-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4236-79-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4236-71-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4536-69-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4536-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4536-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4536-0-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4536-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/4700-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4700-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4700-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4700-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4728-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4728-21-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4728-15-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4728-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4728-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5476-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5476-113-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5476-317-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6056-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6056-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6056-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6056-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6056-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6056-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download