90b74b00adaa9133daba53d5632e676123921be1db338d2a157e911e5b35e806

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260814-rb3rnavgla
SHA256 90b74b00adaa9133daba53d5632e676123921be1db338d2a157e911e5b35e806
MD5 340068325a0a464ce57e00b65758a12f
SHA1 a8447db84668fa100ebfabbe6ef9059cb8a07986
SHA512 fb489ba2fc3a3a0a3f0bd031788002a14b9e032e73e2f98ac121337c002a4e58b4d48018d1429b1521286ae9a050a5651ee6558ca211a7c09fd7cb665a25b9fa
SSDEEP 49152:+tY4be4yHQp0+6N/zdzQiHsTTOtjDvdpiryXkp8oL+bzxGMzvAgFIDRRAubt5M:+Va/rVtjptUf
TLSH
T1CCE57C5F52AD00E8D1AAE17C86468A0AE271F816C731A6CF16A4475A1F7B7F34F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3508	elevation_service.exe
1308	elevation_service.exe
3524	maintenanceservice.exe
3928	OSE.EXE
4900	PerceptionSimulationService.exe
1092	perfhost.exe
2052	ReFsDedupSvc.exe
4636	SensorDataService.exe
3900	ssh-agent.exe
1740	AgentService.exe
5308	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\129f8aa923e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041c0f385f52bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035c30086f52bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080f41086f52bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dea57c9f52bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e338a185f52bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9b25cc9f52bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4144	2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3508	elevation_service.exe
Token: SeBackupPrivilege	2052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2052	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1740	AgentService.exe
Token: 33	5308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5308	SearchIndexer.exe
Token: SeDebugPrivilege	3508	elevation_service.exe
Token: SeDebugPrivilege	1308	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5308 wrote to memory of 432	5308	SearchIndexer.exe	103
PID 5308 wrote to memory of 5800	5308	SearchIndexer.exe	104
PID 5308 wrote to memory of 5668	5308	SearchIndexer.exe	105
PID 5308 wrote to memory of 5868	5308	SearchIndexer.exe	106
PID 5308 wrote to memory of 4600	5308	SearchIndexer.exe	108
PID 5308 wrote to memory of 2720	5308	SearchIndexer.exe	109
PID 5308 wrote to memory of 436	5308	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_340068325a0a464ce57e00b65758a12f_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1092

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 60297fa1098ce3e2a3b3798ec1cebea0b3767a4e4a3e5428d51b9b7cea4a3bbb
MD5 8f596b07fde4b8e23e3afcc0e70d5e10
SHA1 9801837ff3bdac1bbd6728588a81d874de28a8d9
SHA512 a60033b0277c4129f99d9cc052daf79741204a8bfbfad5f65a57f61f51bb695e943bf06a1d17e926de7c6f8929cec1e2381cd91f1dcc0a569ea2c17896dd365a
SSDEEP 49152:Rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnQgFIDRRAubt5M:X3q6sjB2Uf
TLSH
T1D8D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 aa42b5dcf40f2bb4ba32b042bbdc4c5b8e6dff78b85311efaa0e329d79896a29
MD5 736d4db35f833fa301109ac562f30d1f
SHA1 ff65f6ca1e51e67086ac9c435bf7e2798b43f0c4
SHA512 1ea5bf252e625cec40e4abcd6183bcb265e70685841108b853dab8f636ea8750fe4c4f3e14e98fef09ce582f10cd2e93c99a36367967e370945671480b6463e6
SSDEEP 24576:KXYfDtczAHVg9N9JMlDlfjRiVuVsWt5MJMs:RtcKgFIDRRAubt5M
TLSH
T19C85F12873D509F9EC678279C9B28601DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 3c5b26e05d7478c4f47952374ba7bee9cb38c944587510fc26b4e9fcb245147c
MD5 b1bed206cbdef1f1eb5e89d58dc5f8b2
SHA1 a5d7b1d2190e55eca43fb3bcd0b4be6e1490b7ba
SHA512 af25d09912eebb758a56112ba257f6c8c45a6d0188197860624228498746e6db635afc2e6124a467e06c523c429e8a66edbcc38042cbec8224ba93982f2f0125
SSDEEP 24576:80Le5ji0hmx7rMoVg9N9JMlDlfjRiVuVsWt5MJMs:8Pji0A5fgFIDRRAubt5M
TLSH
T159959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8ee98badae91c867b055497334dc8e9b26492c6a6082899d388bc8111e88e229
MD5 de394781ebd4fceb09a8e4b7e5aafcdc
SHA1 de9bc0bae5cb4b2b107498a513131243017e182f
SHA512 bb9e4de814b839e46d8edf9112110e76d0965be46bc44941fbdccedc2d55d6696ba3dc11fb763ccf5a34f0444bafce7fd091249b69b82e9d8354763e1c6ceda2
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyuWVg9N9JMlDlfjRiVuVsWt5MJMs:J/ezSC6vUzPveHjyTgFIDRRAubt5M
TLSH
T1CF755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 22038bb730892f03625824524e82e532fbc0f93edc58faf5a91c727ed54a469e
MD5 f18859b1b3714c37f78b80ff1f57b2e5
SHA1 2956390dddd0677b5a42c56b4d0d456de6facc55
SHA512 7b1e2fa61cbd037293cd57b2589110aef817bb02d2914db2c0a3ca04c1c6b50102c81e1152ee36336d96de4d7aa2c51307e3e7abd0add548bd488063675c01b2
SSDEEP 24576:mVbqPb88hv/l+Y/Vg9N9JMlDlfjRiVuVsWt5MJMs:mVO88hXl+qgFIDRRAubt5M
TLSH
T1C6559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 fda48ea49ca36dce2681e979ec78610f39e097d5f56ecfbf57e6550a3add2fa6
MD5 e8063453b94cbb97beff7468b3d73261
SHA1 7e76cc40b1f8450e4b98c5caf6a8d5545a140784
SHA512 416495442a909c558afbc615a56957e2006e5407ad0f15741fcd41fd8e01e6a64ec51a76861fb64dfb367b15daaa79125aebcfe472d939459aeeb5e726187183
SSDEEP 12288:l9oV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:l9EVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F16523AA7645A5F6C65B82B1CA73538ACF235E5836C58547C2B019D1C9FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 0477aebaa25e837cd1ab00023c1e0721cbca97e0cce81e1758d14027b9b4cc51
MD5 bacdfa558a524cfd56f43933b353120f
SHA1 8d5801a4a7304fb1161a0b471509fd024bcd9c20
SHA512 fe2363d160a731ba90325be76bd66063c3498dfa55b98505c5322a8adf075a35ee34766734ad84cf3be61babda587e73acad40082b91213d7d20a425445e364e
SSDEEP 12288:6eBNUbTVO86UlV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:6JIUHVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1CD85CF7BAE28FCE2C27E8DB89A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e838ebb77cfc2acfb94d17d4a2e923d4f883129997cbd77cd37c6376a01b4a9f
MD5 a152868c28381fdd47f51f91ccddaed8
SHA1 2cf220ce4fbdcf5656865f379417b164f90e0433
SHA512 ff8d786ca28e051326ea8a7faa61c8abddf93b3c1690f66e9fbb0537c2d55f8356d283fc6ceb82c30e29aa6a1b32f76a8640f1697c1dab965837808788e44d00
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THy:JQvGAdlCEL8c/DRNw5CrUf
TLSH
T19B267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 531e0a5b5f082b3f866ea19365552e4bfd790af0d8fd4dfbef83a0cf7b4c87d1
MD5 1a408075c6a720e1915b3d35faaae259
SHA1 1acd96bf7a7eab7672d1c94147b8aed9476dee87
SHA512 9ee6ea8981cc4fb20a3b8d643ea94931d80f54e7e62f302b9f0a954b37d474fd3fd3276bb84d150d65a6e67186898086405fd23764018dbd02365ac4c498b4e5
SSDEEP 24576:TSewsAjVVg9N9JMlDlfjRiVuVsWt5MJMs:mljvgFIDRRAubt5M
TLSH
T18485E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 49994c20558b8c37d41eb9ecf6b001e3e17750322979415046424f194fbe675e
MD5 ecf51eb3d7f7ea3c64eb01c1e63968ae
SHA1 93fafe087013dbde31224fb8c8e8c921f205ce10
SHA512 cd37d0876b7c0f0ab2f59924bfaf6e7fa0451e10141e2718788e23fc4f43d5532837a137bcf9b1267f2b9570286f8d6d5fddcfe1aa0a428060aa1907e235a9eb
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHgUf:0UEtQevvqc2W1cpV2tI32gUf
TLSH
T184474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 de606bd9b87b375e5d568d070a0896b83ced50df403364b9d1aec0f42a46f615
MD5 8df30bdede9beafb7a7c4b726c31a854
SHA1 e82520e0daaa369634ac726d3167001d9a68f8b3
SHA512 e8d96fa4a63f81b947b7cd48dd6ad33c4d24b941aa106b4101aefc3e6d8e77bafd060331eacb00218a30411d010c037625714e745a634c1123493cda678267b1
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/zPgFIDRRAubt5M:/oqtVjnmnUf
TLSH
T179D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a3fa293b66ab9d20489b342cf4378cf82ca67b6c92d71b121428c51f1d3a8b25
MD5 2f64f6e3a79b86de99a362fa79c6db83
SHA1 73bdca9f8f81a72feae00a696c0831cb03256f0a
SHA512 f92df6f2a044305b50aa6ac1e08c745e63bf17685e17bf89ff74cc66fa3d09515a92e66885a22c1b3ed42ea7079adac71ece04120a1e1e27adf9802e80b5bd48
SSDEEP 24576:aAhGL3IFoiwtA5l7S53aVg9N9JMlDlfjRiVuVsWt5MJMs:aAMUFoiq5WgFIDRRAubt5M
TLSH
T14C35AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 579bb95616a275b1252195ddd76071841178ffcf9f8ea06d682106b6db14d50e
MD5 d980122d9a03c94d097676c7c3845aeb
SHA1 e979900f5f0d385bd9eea9531fd645edf02d865f
SHA512 e78105f9a563f194a36fcb37755ce8ad0fac34404e194e1545e5adb55fad8d3adf014c44fcb95638115ce55f1bc8ac7fa000eef53f31fc0854eea2b7059cc005
SSDEEP 24576:+wuWOWpVg9N9JMlDlfjRiVuVsWt5MJMs:+wZOagFIDRRAubt5M
TLSH
T1B985F14A32A41CF9E9678239C653C136EBB3B8013A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2ba68b5b5542fb5239408720c1bc2d77b36baef1ee2438f325665a0d222a0c52
MD5 abbda1fde3c90c3eb3d3e1ba494e9d64
SHA1 b4b466a9f3e157e5c1710a0d658e6cbbc6e6dacc
SHA512 5cec2e0e7f101a5a5985abf5dd7d6fad719a0cccfef7f723fbc706d3920acec3d72b01ce28b3e25210002c1ad419cb3b46c21db17018485d3bb142f33c8acf25
SSDEEP 12288:70Z1IyHV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:AZuQVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1467512AA32D460FAD1678278C9F24345CB72785633B283CF427006A65FB66D25D3E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 699ff2f1e74079ffbf4323c7879793b901f98d9fb6b3b61f28e3297205edeede
MD5 c30258ea3e728a59f26d4eac776fcd49
SHA1 cbfdc8b353f2ae8397034584142cef95f903a07e
SHA512 67993ac4ece560c46a84deee2805a565ab8a8968f3cde04472fb788ec8f1332fa53058a019c9ad324855166d3ad7c06c15c46c95aef050353d17ab246f182f4c
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ue:SQRQyi36YOcPbLvw2gAf+PN3OUf
TLSH
T122667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 26be73b8bf91290e8d76a324143e3e46976a118c233710d87dfff01f81d8237b
MD5 68b07dd87581ee0c517e77f4ff1ac8c2
SHA1 13d6f23caf0923e068c906b644f4cf59c1467ffd
SHA512 d7750fe0f5eb1845dcdafcb23274d84370939b9c48a81742a051d89467d3b594300298946a1124178c932fd3d1256b1f0c1ac1f5781cb5f01d4553e182f74676
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ue:qQRQyi36YOcPbLvw2gAf+PN3OUf
TLSH
T195667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d0ac87df6a35ddc65f9b95adaad3038ca68ab55b5ae2afb94cbcbc541b4d14d5
MD5 ed0023a14a298512f23eece0fef8cd67
SHA1 3bb54d3eb4d534ed65105163e50af51269729708
SHA512 e74468f7517aa7dc0161dbe0f8e5be9866cd26215e4bd86f2c2f80e6774d8fc91207d663609a5ed5fab4e4dc0538fa35552006f4019428ecc9f50ad063d3873e
SSDEEP 49152:A68Qg55nhceWu7PNU3/fgFIDRRAubt5M:6thLRc/4Uf
TLSH
T13EB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ff7eab4ee6677f8b57de9ffa09dee572910935b4abfa849e6c52a90c18c7d9e7
MD5 8e191592545b9430dfe35bd1ab3e20f9
SHA1 abb5358d6739be0dc056c5fc9b8e3752682cd8f7
SHA512 bf1c1b60d5c4cabe70d423f8ef392fb2db0be79a5d15317bce8e69d4d5eb6a6859b1e39aea71c87ea53ca2f2b8649a6b25fbcdd9d59bee8de668c82f6794ef80
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99U:dy5112gYy5azzVvt69nLKnhZ5Uf
TLSH
T1B7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cceb78f759438b2edbb4371444fa9549e430d8a0f7517d6207c6f1dce99deb75
MD5 a57a66fc9aa1488e7389491a0fd35d0d
SHA1 23f3a6ed394c28f2f98fd52ee300a7eb573cc81d
SHA512 acf576cb6dba952f677fb759fee05089d1d79e8c444992b63a5b7441751f2aa4690461dedb1c52be2eb1b13eb44954c52ef46877a6b011abcd0859756c285c18
SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllgFIDRRAubt5M:Iu6Jmdxd2diUf
TLSH
T13ED5AE13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a1ad1f39986e00f5e6de87f452cccaac3a456f06059e1cbfb29138ca70722b80
MD5 99768d348dd2027cf0d1b151240c1679
SHA1 5c45571e62c8abcee599d00c7267813c49ace1eb
SHA512 51394446604915e0ab81f925409c8e46458f48e2ee631236e459dcf5f9df99a44ec37884e4000d47ec1187e7ae4814ad98acb7c8bac2dd7e5c4ebfac8b3c18ee
SSDEEP 49152:71hpsNoJpF1A63U44CwH7R4xVgFIDRRAubt5M:7mifPWRnUf
TLSH
T16BB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 46fc8ecfd5844b383328c951154f8597dd5adedb741f68447e09c13169d41aa7
MD5 702c849eed4b769f6e69b7bf12922681
SHA1 17ec0b49c048b813eb530c1801eb232118475caf
SHA512 eeb3848ed9b1ce906603912f24e1c8f09479991185340edd9f8ed5d62ead43a424eda66b1cc5966cf81de9bd6315ccd069074352f106b7abd61ae31ca37f5860
SSDEEP 49152:ESuZQIY0Be2KcRVtOnks6NMHqAgFIDRRAubt5M:W5dKii61NUf
TLSH
T1A5C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c756b6cbfb998012e93c65be014d3a523a3fd95a82321240e6b89749486d2cfc
MD5 e1e28c10914008320591e226a4c3c9ca
SHA1 8dc3e51c3a759cceedeae7c0637139ee23d9615a
SHA512 c9efa87330ff1ca9f829a51e18b10f74298f10d7b6468af427c65ab6c47040646137269be475c7c00cb3a09ca986a2a511e5c09e512520f2ce8304e2bb4d2647
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5wBgFIDRRAubt5M:XX2imphDUf
TLSH
T13F95BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 32fb370c23634e2472d15ac88c2a610545d5dec01db5b936d945ec056bc41673
MD5 7d31504cd8f4281a247ed11d5d715f96
SHA1 f1889e4bcdb649435ba437d98dc7cd74fcc67daa
SHA512 5a8d0192bc16c62726d327fc8a76bd7224e326894b57707c06a722eca6d06f71cd1e91ee0d9bc086fb761f2fa0d404ec98e73b1630b9895ff0b1081388aee848
SSDEEP 12288:zgV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:zMVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D56523AE758695F7C50BC2B1CA735389CF262B5E72D64147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1860476101438c877eec56a4136288d8971fd3b3a4f7a8866576fcbf346d6ecc
MD5 7eb15289959218a1fe8473c020672526
SHA1 f23f6a0248f09937a57cac542bdd37cbb174ac4c
SHA512 e53dece46557d13c9d7185a313da6ef331f0415a80fce3f21758c4f799eaeb4145cf278171c227c286f456199dce59e869a100233df49fe59467c49207092e03
SSDEEP 12288:rrV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:rhVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15E6523AA758655F7C10BC2B1CA735389CF266B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d5c6500c1db8de5688d6ab8c50dfd2828d77ea20b67cf4c30da484e0ab1191d7
MD5 29b10155713947157c014fe0dcb2ca59
SHA1 f4c7f2a54c27822acd47831d49a69b978a653f45
SHA512 b65c11ab232ca52833b9fd0bdabb3d2e42dd472d78329d6f56b587701e7846fc20be7ddb7cc5bdac197e1931aac9c7f1d4f86d10ed6a5bf0a918cb921ebaa5fa
SSDEEP 12288:YdV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:YvVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17A6523AE758695F7C50BC2B1CA735389CF261B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 149e25be6a4045c6d6bf87b76726a48e2150c4088a413cc883458cc5390b15b3
MD5 755fd754ba56aeb2f91ec89c91e4fada
SHA1 be73ac333911ca9686b54d1db4e4522a1bfda555
SHA512 7f183b31680907d2de83543800766d66695cec9983f9e90e3215dcb98a619dbd3d82b60dd01c96436098de769ffa9690ce711fc1a22c22ac2723f4b157c0c55e
SSDEEP 12288:PViV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:0Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14C65236A369651F7C457C2B1C9734345CB727E5973A2828FD27009968EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 19d0508ca3cfe5f4c3a9ed093d5d681d0152a5c28da7596474cba939a89d3ffe
MD5 88095698f303d2ae596e769fd70a8b8f
SHA1 b8e98c9cc171ef1536198ff3327b0dff83ef8ac7
SHA512 23f6d973c3df11b4290a5f3e49840b11614a407d74c0b67fedf97624b0295fa5458a4e5e36e7101f4175fdfaa2e5728c927219837c7b640b016e6d105e3edfc1
SSDEEP 12288:8qV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:8SVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15E6523AE758695F7C50BC2B1CA735389CF261B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1fd81e70e907f9d940986bfd44b4c9758c20e330581a644785e3f5d62fcc4a04
MD5 545b110e662a960ddb83fec2316d3c34
SHA1 455e7dfd01dfad42fdadf2d24ce1de7d51a9deaa
SHA512 79175df0ce27ae7154606e49316b0206813c48687f50f6356256038c56e55dc5751fb52b103a8dffc63e5250f7f6266e404124b50c556b1f7f3b12ce12bb3eac
SSDEEP 12288:pavV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:padVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1376523AE758655F7C10BC2B1CA735389CF266B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9d624c5f32569cece37681e3ff54aa3396f94c461d9c21cfafeaef2d1335183e
MD5 306b3c47adb566d4f9ef219b97a1f684
SHA1 0c5163d3371a28dff43c7e025230bd403f803da0
SHA512 d1e9495e0fdd3840e71d8dce24177b41167cf8e3e8882e895779894de8e702d3bf97e6e5671e686b0950e30dcfdfbb9ede99fcece0a1bc9811349601db19daef
SSDEEP 12288:ZTV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ZZVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1C26523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 44a7cb8c28a87b4a0d0bcc9439462f021984a4fae266a7b55a36d3ef09a46202
MD5 8724f32609aad844ebbc4be7e9af47b2
SHA1 2472588d228b78f12d86bd0e41b1a2fe3ce08a15
SHA512 87ccdf549af2d7249f4cd6ebdd6a51246ecb68b83f10b194b59c37139cefe2a1ff7492889b3a81eccd78d115c86c436acd1f4cc679a0f2bcd8fb6af8e344ca92
SSDEEP 24576:bZMrzFVSOBVg9N9JMlDlfjRiVuVsWt5MJMs:bZMrzfHgFIDRRAubt5M
TLSH
T1308501A9739018F9DC67823EC9628906C7B27C5A17A0C61F03B436665F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 349a0eccd7539fcd90824f8903b1264089ff89ece841b28935f486445e80744b
MD5 4d365e651a3e1880f57e5bf5f83d2039
SHA1 ec44293f1c724df986742038d99d3ac38327bc0e
SHA512 946271893b8b2918e270e64cd1c6621ad34c5330efc0c04413cf576f6f506d2866e1be57cb34861ce0a52b4943eaf69351cb28304542fa9056de2e79b4e16425
SSDEEP 12288:HcV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:HgVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16A6523AE754695F7C50BC2B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 687f5dc6e410f2c43cab73ee582144b45bb2d110c7b5232a6f73edc4bccd673d
MD5 982cfaf874f1090f5b2cb538dedd6257
SHA1 309b8d915e4aac13d0e06dbe43d3555677209ce7
SHA512 9936342fc9d516a88d599f6e8ad64572e4e448bd2bd21d5ce6115bbe343656620392f09972b5262a9a00b093ba64672854dcfb771c1204d74cc3831595f70b71
SSDEEP 12288:OYV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:OUVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18A6523AE758655F7C50BC2B1CA735389CF266B5E72C68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 eb433ab3215292edcb07eb46ad60ba8fe00a368392658e9724f50b6ce1e30b79
MD5 9d8dcd4362b5b41c6e7d88fd938df4ac
SHA1 ae6deb59b044d37686bf93ab5d65a178a0f66c28
SHA512 c35a2ad24fc5beb842c181b48bf8673786810a4ce341035eeafd1fcaa84ffefff96dba2e81fe8884179c3f19af2a6d5b3cad9f04ae2267178acbab035ace5481
SSDEEP 12288:pyPz5L8HV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:IzylVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19D75125B73A130F9D1278274C9621A02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 83a3d624f9a234faa89938ab6f9b1bef3760e215504ce555831865fd6e4380bb
MD5 8ef85f896648e79ee643f2fef7beaa69
SHA1 cc5ea223658502a84d1836a94c843ceee8ad2da6
SHA512 3b9e085fb7003476b82f11c24ea4564d3b09a1e7dc4443f76cfcce80555c22878f137861bd58fcab027fd5d8099801077f300a83fd150f78235d0df4fec79df7
SSDEEP 12288:acV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:agVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1736523AE754695F7C50BC2B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1d526f969bec646b08cea93aa4d7514f0ea094e906b7a53943ee9bf57f95fd2c
MD5 efecf54a7853ae85306bcbcbb159c17d
SHA1 61a5735d15f239f561f41727fecf686600e064ca
SHA512 51aa50ff96fd1cb170be8d6c8667c80e3952876560d354b504f6aafebd4713a53ebbb74c69925d5d580a7756e8d138c001825ae2d8c68408e3e8aace3bdb714d
SSDEEP 12288:ocV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ogVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F76523AE758655F7C50BC2B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 45a96a371f5a8a1c8f635917e768c404ba1ecfb8ec1355eb0a02ea3f2e06a9d9
MD5 e0dc81c3d7ac8067637f1215b2584e00
SHA1 abde5d54d054fdadf4199fe37cd369d576e023e8
SHA512 dca36a2d5c48d2e8a9e5a6961ead2e8b30a3c75490dc60fc50ec76517ee4140e0cd90a8814ebd0870aa13def125698aebf7a5fb6e366568c1e968f58e15dec67
SSDEEP 12288:XyPz5L8HV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:azylVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11E75125B73A130F9D1278274C9621B02E772783617608A9F53B006B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 8d8f99a2d83245e940224e0a79d89d11a3c78f1eddda375b73d75493b64d3e8d
MD5 3c698fc91bad5585cbeca5fd76b4b5e9
SHA1 fdc279c85056807f4ada1bd7558a52c2855e1ef4
SHA512 15327c351c9f51cf2975627edf2f86b3fd502a04e4aed4a61bbe9014547c2c930bc0b01cb75eb460ecc4c076b25081614b59346344475c2ee37b06d41536955e
SSDEEP 24576:ITxaLl3z0zDfVg9N9JMlDlfjRiVuVsWt5MJMs:ITsLljSgFIDRRAubt5M
TLSH
T1EE8501A9B35018F9DC67813ACD628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 9543fe4f235a76a750e15b71394efaef60fa336f47fda7c5b50ca09fc14b4bf7
MD5 b3f69c24641c441be56a0b4331c0aef8
SHA1 b96c77baa7042407e9045b162558fa8059baceee
SHA512 d3f431a10d3aa9ef60e7e28e82ef3582a5353d82879218fa06d6f5d1ff24320b3b050d74f429633467adc32492744eed59fb36b83218d89172d39bef04869d60
SSDEEP 24576:y3Zd9CHKy7GZbVg9N9JMlDlfjRiVuVsWt5MJMs:UZd9CHKyaHgFIDRRAubt5M
TLSH
T13595CF90F3E414E9F0B7DA35C9725602DA767C9A1B71CA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 f01f705ae6495c5612d3d1a3dac650a28829226324ea0b5aa24c009bbe0f9def
MD5 3bd82793cb8d89f738b5f7a5a68cee6f
SHA1 7c9b0a5fc3fb5c2c5cab6fdca6441b066aefc3e9
SHA512 a55369a62e5cda6eb57f26eb2dc0973ab8ee0663b728b71375aff1a616b28985b089e4991e99254f4ec2ffad2e3c46aca6d81fbe6c6997075e85b6901d0c6d42
SSDEEP 12288:B9V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:BPVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D86523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 6c9dccd74382334e22772984bdaa79bdc57a2a4b2db54cab50a8e5dd88c277ab
MD5 2362c84cb8e96d74ff1beccb7c66a5c2
SHA1 12e9ef5832cb41a4a5d0c69c5d629fe6531e7070
SHA512 784209a9c7084421a437dfbf79ede688a4243c754a7218c0a62efa8c5aa09be23c5dd9f665e5b01532bb3bd18dd5f3b18ffa8b97b7df2913cf92bb4390337fe6
SSDEEP 12288:EnV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:EFVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A76523AE758695F7C51BC2B1CA734385CF262B5D72D68147D2B008919AFC1A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4a334be58da55b726407ce14f0596402e35d539043125824393551ea4753e300
MD5 e9ed1d04e3f43e4780f15f3e0a5f8ffe
SHA1 48962d6c16567c8437478d0ab8a0c31dcfced57a
SHA512 d78625b0c004251831d3d2838e066081bd546ef8646c55df58d3481f6e6653e9482794d7a2dc297cc6737851fe789bd06122b175e81a22f6022f3288a9120010
SSDEEP 12288:9uV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:9OVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1FB6523AA754695F7C50BC2B1CA735389CF262B5E72D68147D2B00591DEF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 8d041fe82f422c17c5c70deba1dd59177b3139845783daf6538b2cbec9f96caa
MD5 305f4148ec40e1d0c1a45f8374d6269e
SHA1 5e6b6be32d1b8736dae5f5f690bbd7dd0b956ced
SHA512 266559263aaa8d304e53e339034d3f72e6ea79b0520d8062645ea716f874ba6819bb7c77ac37b2795543610c508f461221f2379d3fce68ab6056aa902b0c2dbc
SSDEEP 12288:ZcV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ZgVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1746523AE754655F7C50BC2B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f27c4aa7e04843bf81bbfab8221cbb8068eb771e4f48c5f328a2b9bd4fedab2d
MD5 5484f33fa0352e43ad6ca661f9fa3599
SHA1 05b37ef87a66cd4803223c4912d56499807d51ef
SHA512 520950652012ca49301b33c14bbf37789f26b8e83c6794ec66e621e544e0143c5c97463cc3333ca4bfb0417d0a3725235e5626acde0b658afc9f0aba55b97806
SSDEEP 12288:k9V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:kPVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1006523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 47b2fb381f54a0b15c2756dfba60328314abb342e6357f13489ccb1ca495b30c
MD5 18a16351f35850078b7964da8f95c406
SHA1 931ba709297e7dc001ca7e1cb9c5d4f0b224fc74
SHA512 35b48a0a5eb0dfe6ee9f4cf3f9ea1c5b1e72361f4759214d29ab862566132fb723188c63c74540e7390bd335ae765584e7575d34c86fb28d7a5e89e41f4c338a
SSDEEP 12288:kkV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:kYVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1316523AE758655F7C50BC2B1CA735385CF262B5E72D68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 679d0dcbd75659f4cdcef47b66d31dd6732a39596e8f6a7d2af4b75792c8664f
MD5 4a33780fe7cdf3ed93e7725a55c263f1
SHA1 9c3a11814e56f81ded9713a6a2ab219e6a83967e
SHA512 fdf58f04147f03d7a85bebcd8958b362ff359d7e30af8cdbe674f58ea98095e000fcbfebe46e705c8c7a946612cf4f1b99d66c21c8e06b54854ae6da941bd5e6
SSDEEP 12288:sqV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:sSVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DF6523AE754695F7C10BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 60481d6b7c50999c2424bce2745ad6917c299d030199a65cda79ded6632bf9f5
MD5 a3aa4c1a7511768308e6b5c55c696b89
SHA1 c2bb78d33c4badfbd1b4820b68bed617fb78a993
SHA512 1dc74a221a3ba360680e352218ae21635d086969825fc079e9ceae2440136b4c3eec7d80239d94c7f121ac8eb2653065995bbe37eead77df5d273c2397aee48d
SSDEEP 24576:Vfwv2k9RX6wkyAIkVg9N9JMlDlfjRiVuVsWt5MJMs:FMnYIkgFIDRRAubt5M
TLSH
T1CC95D029EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7901d2a4493e241f5017e8a64b199f60c4523749b39eb1c40b2668990a9e10e8
MD5 f0e6b3f453a0486cdee0f3bea2fba3c2
SHA1 c178d2a17af1d73156b3203e3c5ae77529b1a877
SHA512 2d71fb1b9e14308bdff2ba55e730f555132ebb3351bc7cf2a4ee08d4ed6b2fb9b218004d0e05f3064685be98541fb2e94e74b13bf95676fdb44810f28e43c081
SSDEEP 49152:CYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hgFIDRRAubt5M:ZySzPuUf
TLSH
T196066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c114c15f0177a2246ef214e89ea17e4b65e7817ac04dc8ddf5caddaaaabeb016
MD5 317edaac3ee2e0d781855d7ec78494c8
SHA1 54b0f4e5e73a83ffdb0fb1b177063fca61336db0
SHA512 6366eb57d0304f385d1807e516168125014b80aefe6af93ed484a4156f06eef631745fcd1c61d0441a7b711c6d4f481584a2e8bc07856a7012eb618251e91c97
SSDEEP 24576:b47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYRVg9N9JMlDlfjRiVuVsWt5MJMs:b47JUQjTirIhCnDHUPfF/xgFIDRRAubE
TLSH
T11C65AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 856297f5ee8e46488021774e35481805d650780b2a68e7b9c0d459578ca902f9
MD5 73a3350b489aff9d1d3e206f3842b5b4
SHA1 887808adfc0870e9ee883bcdacfd148ecd591c0f
SHA512 85c8f9d3181bdb55e0ad3b0e33d6bde0e8c7ec7438103ebdf5e973f5f901df6e5b8f3a13a4226ed348e854bafb80b0969f23390d32325ef226cc5f2e4c3ac249
SSDEEP 12288:uVsfsV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:jQVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17675F15AE29402E9C06E9275CB524641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 5a45391cf3c8e607c01abca58fbed79af583e31670f9d530a692b0c9e00dbd0b
MD5 688a5666a2396139b8871ca71b2aa69a
SHA1 9e9dd2e57a5ed0d444a832976b9b99cf13b4d3d7
SHA512 105ab5b4bddc1e764d7f1d15ddf74d9551a488b32989a109d38d7375e3066c2fd5506783310c6e138259e301d1fdee1e530ae4dab73088856cd927332b39737f
SSDEEP 12288:yrkNU3fRTAk42l4GcOU9T310YVly4RMqqrM:yrwUPTaVl3aaly4RMB4
TLSH
T171351811766AC74FC6AD40321E32D1CCAB707D11EE44AB0773C99B3FD576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 86d7e01a70ee3cdb11a2b527c348f6823d0ae88a2b126d0abaa023064f9bc96b
MD5 1657118241e8afb3099c19e9efcf2a9d
SHA1 ef71a2cc2a0c11bf18b366145320b347369ae1c5
SHA512 9b0180cbd410bc2efe9f328302fb6b27198246640f435c9c32659928b4853cbbe8b5495efd7ee052cadf4f87f697652729d4841964b39029a81540ee6b394df6
SSDEEP 6144:CoAa2wMZM109MStk7hmWb4/pfasWCF2horTabF9lsbWQD9tMxoD9tMxTccoTP7TO:RK9MSO7hmWb4/NIgbWaPY
TLSH
T19465D880A537E38FD5BB6032072A5B8CA7A4EC07B7495F1673C8443AD86A615E0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ce6149f583207b1b93080272f795b852d4824958288b824cfb853a59a7920e02
MD5 368941db2e1396c39f427b9d96a57a04
SHA1 b3f9dc5af7606a15e0398fec8f70c18a44811d35
SHA512 1fa5606ada96571093572545c8dc1db4baf366a0ff04f5e64fba9c0f921f216638ce6979b9c51e33c1f70403c62bebb9ef90465216121552aa25d1c24e61bd99
SSDEEP 12288:M+70V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMse:LIVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D765237A768999E7D46B92B0C97383058B2B7B693B8181C7E17005D199F81D1EC3BBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b2d0957822479dcc08deae0f9e24c8b018d1e10ec5bc2940aff867951761adfa
MD5 a7bb33d4863ef32c5a718cf5767ad79d
SHA1 f01c8270718f37f8cd0b11dd327b6aa3bdccd531
SHA512 ce67bb92e4ac3777ffc6c5752b7b925a172ef61747897546ec2a471369d6d1fc2a8a93dfc3c547c627408d0e61f1df0360ab83e50f4ed9e24ee3e87b2376ef27
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYWVg9N9JMlDlfjRiVuVsWt5MJMs:egb4mBIBhGFbgFIDRRAubt5M
TLSH
T17E65AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 94799d27a9d114863f4b18a418631591a6c05a67546e3415c62c1e6660404628
MD5 001b48ea7bdfb73c79ed2e9ac579fae6
SHA1 fa16f7be2c34dec832e34ce93fa57ebdb83cb7a9
SHA512 8461ddd0ecec8cb2017007f4fb27a8a9460b7cc041231028735f0950307a407e91a2a1abeea79d8e03ce5bce57b3746780f71d2aba1110cb6da232fccee9fdc6
SSDEEP 24576:OG88u8FpJqH19zria7/mBVg9N9JMlDlfjRiVuVsWt5MJMs:F7ZFPqVka7/qgFIDRRAubt5M
TLSH
T1ED95F16576E101F1D47BD138CA924663F6B2B4251364EBDF07A88A511F23AE14B3FF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 a670903357d50454ea676da1d265b1f78fb8d49ae9970dc2ed07a57af38c5f13
MD5 30cbbde93e1630992dd6fe19a020d927
SHA1 ca1daba2e14d085735a879152d6bf44e9b3f3160
SHA512 ebf61580e5cbc45b5478a2f2c824b9178f3fb06cd0ed09029242de9ed5cf364a046b3a97c235545271969a17fc5f7d22421401a65db0866835bbd65643fff63a
SSDEEP 24576:EPUr+NQtVg9N9JMlDlfjRiVuVsWt5MJMs:EJQHgFIDRRAubt5M
TLSH
T1D585F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f19921f9064e952d0cec458dce39b5ad2a350425edfa201abf99aa777ba819e
MD5 43b0a4020385090c8c9e09f0e39fc704
SHA1 c8dde04cef2eb5592ba4ab803c4a8f982ffb6378
SHA512 c5daa66103f0800b1e97b726f31335a591ce4ca7aabccefefcddd1391247a2b84b6aa80b2e717dd1e3f40844a92b7ac7b134bbfad49ff3dbaac057a87e46f2f4
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3gFIDRRAubt5M:mG05lO43bRUf
TLSH
T1C9D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 870567734b08101a85a891e01e15b2b24562a7f87492203ea6c7bd5f6b454926
MD5 8eeb11da751b91494116746fed55ebd2
SHA1 3bc0830917876632bc99e67efc4754ba04f9cd38
SHA512 de9cbe48d14e17ac7b645bc1e3689d20b4901e263ac565eb3ca63f238c99ca8075d9a9a7f95c93c3dd16fa858e51c6d8e7d59a45e76e10b346b3ad32b32c843a
SSDEEP 24576:Ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnzVg9N9JMlDlfjRiVuVsWt5MJMs:Fa5POZ3BJt2pasx2+mfgFIDRRAubt5M
TLSH
T16A65BF5EA6FC01D5D579D17DC583460AE5B2342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c40984cc64b52a80ef67daf7e89be075f49b26b560c824b9302150d8d02a9db1
MD5 93c106f3c4efde35f853dc411c86dbb8
SHA1 195dcccebf8163e754daa293dd2c66f43da02a72
SHA512 5450f7faa16f51c78b0cc24a1659ebf1544fd1c9cd6949d49497490133e5be6a35e2b1eefb1086a3bdac5036f4fc309aebcf8a75c44365a883bca66bc5953a42
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkJVg9N9JMlDlfjRiVuVsWt5MJMs:JNc/zEOVHFKgFIDRRAubt5M
TLSH
T168858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f277a33079765fb6c3835c0db292a2b0a3344d52aa7dcdc7bec82040489997b2
MD5 d739f7dbab14af80acace2c716e6309e
SHA1 41bfbc1e4969f4d102835f8319aab815b6e28a4c
SHA512 9a8e68f383473de30e15d60f9e4976e2981fb2089eaaaafd530f82ebf28bdb57a285b1c8592e985ceb044785e520cebe5dfc118b55a71e38f5ef495c2610bd19
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmbVg9N9JMlDlfjRiVuVsWt5MJMs:wTMwBtOmJgFIDRRAubt5M
TLSH
T1C555AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 b374b62a7884ff9a7f302509a73fed505ab3c95660a2f7e193d48df694d6afee
MD5 9b7d205f1fffab2e353c108b9386a3e1
SHA1 a8c533a5a2510a4f645b4cc061040351f052d4e7
SHA512 cbacb5d3685c142ad87e059ad73d05e58e20b0a72987daad8d1b2b0b1ae55a5ec872fdae03e6b7abac0076bcc9a6a0465d56b5a9e8cfdccaf8cf99007ceccf9c
SSDEEP 24576:hD3FHshBIYQgAsVg9N9JMlDlfjRiVuVsWt5MJMs:hDVHeBIAAMgFIDRRAubt5M
TLSH
T1F495E17EE69804E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE47D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-82-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1092-88-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/1092-84-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/1092-313-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1308-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1308-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1308-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1308-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1308-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1740-131-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1740-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1740-137-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1740-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1740-139-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2052-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2052-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2052-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2052-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2052-99-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2052-331-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3508-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3508-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3508-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3508-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3508-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3524-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3524-39-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3524-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3524-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3524-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3524-58-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3900-316-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3900-119-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3900-126-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3928-283-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3928-60-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3928-59-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3928-66-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4144-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4144-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4144-6-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/4144-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4144-52-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/4636-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4636-317-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4636-105-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4636-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4636-112-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4636-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4900-70-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4900-72-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4900-78-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4900-298-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5308-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5308-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5308-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5308-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download