eb76464463cc9a1a54b78bfa4dbc6b8419996ad4f1fd85ac8ca669e07d880e8f

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.7MB
Sample260816-albmgswdpc
SHA256 eb76464463cc9a1a54b78bfa4dbc6b8419996ad4f1fd85ac8ca669e07d880e8f
MD5 8bdfa406ef8ace0b07b00c55a2be04cd
SHA1 c23d7cbba558c12c1e783d99989be43dd37bfa71
SHA512 91e8aa97fb1380f5309239bb7cc2589d72632da3c6ab7028ed294c45857f832c7101fcfdc29d73f46a3a380607511298267733ebadb488943dcb5aef46fe9f52
SSDEEP 24576:ERF8L9uknyX/4lshY0mAXHrsqjnhMgeiCl7G0nehbGZpbD:ERFQ94/4lPGfDmg27RnWGj
TLSH
T13A85F3377257D8E5C91D9070CF265AF052A07CBDC7E287AB21C9BEE4BB3119079A620D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5756	elevation_service.exe
5744	elevation_service.exe
5728	maintenanceservice.exe
3140	OSE.EXE
3692	PerceptionSimulationService.exe
2564	perfhost.exe
404	ReFsDedupSvc.exe
1228	SensorDataService.exe
2964	ssh-agent.exe
4820	AgentService.exe
3408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9729b323238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041dd99af142ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bca6f8af142ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033e2b2ae142ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1680	2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5756	elevation_service.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4820	AgentService.exe
Token: 33	3408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3408	SearchIndexer.exe
Token: SeDebugPrivilege	5756	elevation_service.exe
Token: SeDebugPrivilege	5744	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 5920	3408	SearchIndexer.exe	103
PID 3408 wrote to memory of 1320	3408	SearchIndexer.exe	104
PID 3408 wrote to memory of 2508	3408	SearchIndexer.exe	105
PID 3408 wrote to memory of 5012	3408	SearchIndexer.exe	106
PID 3408 wrote to memory of 2104	3408	SearchIndexer.exe	108
PID 3408 wrote to memory of 5832	3408	SearchIndexer.exe	109
PID 3408 wrote to memory of 3044	3408	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_8bdfa406ef8ace0b07b00c55a2be04cd_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1228

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 608548806aa28de1edef2ffde4d92f42f0bde975b9b7084842d0eb420c42ea9d
MD5 ce764e26179b11bfa42b146757b29b05
SHA1 a67bf119b15f5abcb91444cd4e3cf6dee7336de2
SHA512 a8fd1188bf2842e7367b45ded2f8a29ba606acd9b70825b21f1d09ad49f767945c92d8ca0e700e447232d1609abd02c7b7973e2dc06283200fc0578dab66ddee
SSDEEP 49152:bb+632BuPkFKRrdE6ohrstBhuXjfS4LWxniDmg27RnWGj:p3q60jBdD527BWG
TLSH
T132D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 49a8259447a324e751eac1ca5c74b92f4b7520ba17d03cf8569a8d3722a9ed43
MD5 4cd76859b3289cc11b18e3b1bf05e42f
SHA1 e7e1c264aff89af14425810ef20b1679ea7f9db2
SHA512 bda546c665d2f6a13ebabd817efd67e93f3cdaee51ed4d28b768b6a2679d32dfbfc69eb5731170bce9a0525b401fa082fd40f88d22bad47165789583248eb957
SSDEEP 24576:kXYfDtczAosqjnhMgeiCl7G0nehbGZpbD:DtcJDmg27RnWGj
TLSH
T1BA650129A3D408F9ED67817CC9A2C506EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c1a236bb92974d6e95af15898a01412dd023248c3f86a772361e59e799bd43d2
MD5 181047188d744bccc0ee73a4beba9e5e
SHA1 b1c5b910f0aaf02a4432adca06ced7d8cd84a72d
SHA512 79edd9755a35fc6fe92d412a5b7938e767d4a709ee4384cf59779913f05067dc2606ae3ba062c73bc65dbf19ee553b922107d6fa7680f79f486f3891ed9b2a25
SSDEEP 24576:A0Le5ji0hmxNrMzsqjnhMgeiCl7G0nehbGZpbD:APji0A7qDmg27RnWGj
TLSH
T133859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b59d8c2bede90069714ef389d827ded794ccc3b805518896196d528ad31392fa
MD5 433a72491b86c043b8ab43286909397e
SHA1 d165cca6e6203cb3159906ab5b6f58bb72ce3e4d
SHA512 d49d63c09b0b47a2679f54e046dde6e82ff191689856367732a0e4f8c8240558a32831a55081447b578688d9eb42b28d6dbff4bbe81887b07f5f783490fca9ae
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWr6q8wyuFsqjnhMgeiCl7G0nehbGZpbD:U/ezSC6vUzPviHjyuDmg27RnWGj
TLSH
T11D755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 50dccabd025ad59faf935d44944297827186b03d371f5f81f6ced6c4f5f05fc5
MD5 0636d05c786ae1fdcc52a2d3b818c95e
SHA1 c9018cb7ba564dbb03adddb94d5e1d9b9e81c8b2
SHA512 dc0f6e6ac866da462b8681f222d0e9fd65938878e986392c17f0fd4308e977f4485c23ddcdee14d918577a1d4fb8a9f28d87bd9551aa832942f320bc258f9b37
SSDEEP 24576:EVbqPb88hv/l+b0sqjnhMgeiCl7G0nehbGZpbD:EVO88hXl+8Dmg27RnWGj
TLSH
T1EC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f74d9d1fb0139d666faa270e7dd1aabf724477edf6cb3380879bba539d18393e
MD5 27e9decc3eaed51f389c28a9209a9c58
SHA1 e029ccfbfe967fd03b056a9a4b7a761b56576c42
SHA512 b85ad668254e10af4fd11b5b6c69c59d9662f4d0af8241854e0f5fa9f5300f3ac5a660b23aa0c5c5c72f6c2c0a08b33284e5e9e212b5e4ae2162e592a21582d1
SSDEEP 12288:CjfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CjfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BF865C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE5B5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8c58792e60d2b60b9026602809a3b586d0458779c5e2e6eee88cf6d4a1d64367
MD5 db3202bb84fbe6a8fe7dc1a54e64ca41
SHA1 df2e9e319876bed27b7052ebeb86fecab1f36842
SHA512 32260e44258c8748b5f0852e77eea2aa622c685118901f065214f8d99b9691e337105f2ed014d4a7b8570a4f376f68a0ae817d4b2c3166d947b3423df8f096ad
SSDEEP 12288:seBNUbTVO86UcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:sJIUcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14465CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 22ebe3e02f0260df27ea4c70508b5f0257676383e38a8f0f2ca748e38856a835
MD5 92dca4990692c27472147e77bcc1b73d
SHA1 83c595dbbac68058a79224d49431b9b1053d42f1
SHA512 7e5c719133ab92196b69ce23627974cf1767125d23cc00c2763dc97fac82b7272caf06a735769cb45ff63a769392c829eca9b98792555244106b3a1b573140c0
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THT:UQvGAdlCEL8c/RRNw5CpD527BWG
TLSH
T12E266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2ffba1c55eca8b3dee2e5d3fa4d4c9796e7d86f14ef2fb4d4182e7ebca433783
MD5 6ad47d409540e4b9e4e4a1719916c8b9
SHA1 bda7cac7642280d02b8f4a8137cc663c337b8c9d
SHA512 9dad60b88fc1c034a09668d8d12c0e37402238ed60123d9151b93e9b95484d621d83a83df7fb8805fb6488e55cdb6488faadcb4685f7a7ca7fb2efe931772342
SSDEEP 12288:WAwSfxL/2Dc3DDLLmt0LDQewsAjWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:rSewsAjWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bb6865a6729a26b894ca26a47da2c526ac26304a3dea0d2b62c1ec8259260083
MD5 03ac84ada0cf01096ba65691b7209a9e
SHA1 ca59887624cc2ab67d8229356c33e8f359c39717
SHA512 f4d899e7f6285111e335b2989b8939ae11b1a184912dd9f46160abfc99e53ecde505e676ce532cc11b7461b153c500bfd19984726a24b90a10af34499539d59b
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHiVQBWG:5UEtQevvqc2W1cpV2RI32VB
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d347b3623346b4052f4ceea8816afd573cdc5505c89f0c88a4b4d7ee946858f5
MD5 14ac7f3fcd995281b4bdb728c9f4997e
SHA1 5877e3d12fbafcb195cdf4a347e76aba577ee4b7
SHA512 7daeecb6a54365010d11d0521b28374091062e664cc7143474e261cdb509af078cc682a3746110770addafb34699e5099451f1bbd196343bb0ea14a3bc98c1e4
SSDEEP 49152:ECbRquA/m2yL5zLfFiV+XenmE3/z6Dmg27RnWGj:Noq2Vjnm9D527BWG
TLSH
T148D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a8e986bd7e734b25a3133a53b20613e25cb29f08c8933364b7423bc0ae9a01b1
MD5 8345e26a17b51ed7f545d84be8e6811d
SHA1 75155ee9a858e9f26f30fb7ff7ac53ce768fa165
SHA512 305468a60265eed110a3192d828725ccbf434128321a1820082fdf81630e95e69666ea95d1ee1e9d86ba5e0714d30daa6b40764e630d9ba08e4a16e4354dede9
SSDEEP 24576:OAhGL2IFoiwtA5l7S53ZsqjnhMgeiCl7G0nehbGZpbD:OAM1Foiq5tDmg27RnWGj
TLSH
T10C359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c7e1cf000d3d7cdc9a4013abf56bb033d9e7c30ba9db2b4d55f27880730cc6a8
MD5 afc388175c5bde581f83c423254e937e
SHA1 3304fdcca867928b488f3d11163c9e3d923182d6
SHA512 ef7883f03d5365d7e4abb16874cc51508b26493c9f1aec28af2fa4fdf7195e31878c3bd575f71bc3dbc66562abcb5956b2a2b6101fdc128ce84a7539e75ee412
SSDEEP 12288:5mw5HEjsChNSBFgl0WDm+ClXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:UwuXOW6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B065F15A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cb11dc7752296615d666c4849e2a3e458aad1d05bf4daa2fdc2b8a8a6ed0452a
MD5 e9877ef497cf8fef416fc4be562c83b6
SHA1 6bd045314a33128f6035ae56e9f4bfca475eefa6
SHA512 111de6d76fc2d6859517d0cde887a691428c229b9bfd3016ebe482f47df21ace5e16d4dfb02438890690a2089cc96ae0dc62d6c91ee7ed3896cfc7c713076b2a
SSDEEP 12288:D/Z1IyGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LZu7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1815512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f3a7129550610cfbd687f6a8b79d3b13a465ca672085247dc7cf0e728a4bd26a
MD5 19f2b732c10603620086763b982d4859
SHA1 1b3e4e457ed1c91d2e040a6f03abb6f45b152206
SHA512 127876e928aa647157b3e51288ff8e98ce439b4cec009e49ea26cec6a2588e3a35cae315d4b4b4452e41f32aee65692624c8867cb8c18a425377f01ba9e04dcd
SSDEEP 98304:oQRQyi36YOcPhLvw2gAf+PN3sD527BWG:/QyiKahX+PN8VQBWG
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 075dc4755d74e32a72fa5e80c04c714251d088ef4c9c5c16496d27e52b694e62
MD5 cd7b4b9912719e1ca4c03dfc3438c706
SHA1 b570cc27965687adcc02969fe32c7e3e70a5b352
SHA512 d4aa7919f65bba03fe65d6be3d4c0dcbf298c00b0b1857fa78723b361d0471cb281032a989659f364b60a22dac4205f192395ccbf2adabd5e17fbfa61aeaf2f6
SSDEEP 98304:3QRQyi36YOcPhLvw2gAf+PN3sD527BWG:mQyiKahX+PN8VQBWG
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7207b988190cc361b9e26566e1e1dc640dbb5376d6b2fe867eba6cd41b5e13f8
MD5 96944f7a8e5b878308db4b114a9e38b4
SHA1 ce8c5926df40808cde6864f65113f6c328d23ca4
SHA512 047aada9c333d25d67e2a8186a8d5bdd21821faac72c8c5c4ff64468906a1ba498ea1b290eede82cd2cc310a81116c96e03a71bd21e54a12bd8f3284b303ac37
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0LsqjnhMgeiCl7Ge:U68Qg55nhceWu7PNU3/qDmg27RnWGj
TLSH
T1ABB55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e56f8549cabbe3fefe3e9899f8d567643a942330802a5a346091593044ff4401
MD5 8c67c1bbd9eb9b57665cc714d3396db9
SHA1 4bcbaf52edc5cebfd7cb3cd95ce463529e0928b2
SHA512 bc612e2da23a76ce1296bcfd0b0ae85141c6313eaafa2baea124f3075e9e8e46db5df17ba99efd23d1b6e6afef457510d42aaf4cf3da9faebe53c3a18c0e41fe
SSDEEP 98304:/y5112gYy5azzVva69nLKnhZDD527BWG:yLIHjWhlVQBWG
TLSH
T101167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5f358f5a955cefb7403cab31b279d2a5aac1024ede5be0b43d85536d1950e8d0
MD5 2fb542f34e61eb495fc8c2daf123f2b5
SHA1 bd6e4854964c4200ff9e8aa981690fed1ac45194
SHA512 9ae1e25cfab9f55c8eb4f80aa38432ff63af0669dd09b92cdd74c329de59cce71895f7f9bf361daf6d09eb71a36ada5f5b9ba9872cf6b9996a91e608f66e92bb
SSDEEP 49152:/B+taZ3usBWOBr4tEG20bqx0z+n217aau1glhDmg27RnWGj:Bu6JmUxd2dhD527BWG
TLSH
T1A3D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4afafb75ed7b74dbb1f1fbee64041da2d8eed8656b7103f0a02dccc5c9eb801f
MD5 aa06ffef5c0e2eadad5e4761fc43add5
SHA1 0fc392392146017bdcc0e3270f6ad1fb58a171bd
SHA512 187b1b73b4229e44a5115e68053cc493c3eca378abd5d0a436294c70c27925b721412d8ca84f88ce49a10e22d225072669ec09a45bcceebb21cb06f69314056f
SSDEEP 49152:b1hpsNoJpF1A6BU44CwH7R4xoDmg27RnWGj:bmifPkR9D527BWG
TLSH
T1C5B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 802b3440d0a9c8af5af47cf43c447ab33b7a000ffb82da43ef7f0b1773989cc5
MD5 2fbd45320c5fc1d27d38d99c2b4b40b5
SHA1 978423b48f6903315fde02c5d0be0b6b66b6dd18
SHA512 706c7d1b6b86b5dd4d61cd1c7a0cd7eab7ae557fdc130bfccc32a072da6e2a3fe612f7bc146f72b41b90bd73fbb437c06f5f6ce4e3b7976609658c7ee45e6cdf
SSDEEP 49152:iSuZQIY0Be2KNRVtOnks6NMHqvDmg27RnWGj:85dKvi61vD527BWG
TLSH
T1D7C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5a4316b346f13709d553b7c2016976d328db5a4e36a6f93326f94a9c9bc2b21e
MD5 efba203c029f621c7bbf9ff14501df7c
SHA1 680cb174bb3ad161c755b3d2957c760a671de7c9
SHA512 9998551e3fb14ade3c9c18492e12226c472315b169d02193db39ca002c3fc172f2a4898fa76085da84de0b91c251f70d1705971addb9e901f01864f10a74fe37
SSDEEP 49152:ChtSn8EApI0figXgiDn0AP5wUDmg27RnWGj:jX2iyphxD527BWG
TLSH
T19095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fafeb8465967596e0aa1bfd574decb91e6aa62dac5833af52aa17ea6a919d40e
MD5 c86b5ed22b16f865f40b5b6f5d2fe7bf
SHA1 4321b6d3b282c35e2f89c912239a5423fd60d5ee
SHA512 aa18767fd34e5b21cd11bea94c49edf1702627f81f5d02c9ba7551631d873bf0f86567b9c4242727a2d15c775a35dea084ee5a4dcd4e497edcedf50a429a13f3
SSDEEP 12288:VHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 45c5abe6f1f41a45fa5051dc5bdca951eee7a535d9791ccf27be4e4b68dfb6db
MD5 7a6ff336f95d5abd2ae7823506d1f8bd
SHA1 a734b294a16d9cd201c9c70cdc39240f609008fc
SHA512 cddd1a20275a4db7fef3129a3df096dc36d0d0d8c85b70a4c9697f0435f7b4656cf787636d530c6578d3128a95dbd5bc1c6b4874e0ec9db3fc429aa3ab963486
SSDEEP 12288:/SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BE964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 53986c20c067e6d5095bf33d5189e75ff8e77b880fd2d182cc5d180586573552
MD5 756952d3731806c5b8097d3563a24c3f
SHA1 5bccaf07249e2221820faea0b2f8e217100d6efe
SHA512 e4894798e020082937d175d543ab820236d08bf5dd5ea31f2701d59e41d72754da5d0f4383a12ea75b2d87932448831501507349fd27c652cf19c415edce058f
SSDEEP 12288:oEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 37ddc23aed3fba5efa32e819dc5b777cb380b4e5acd33b2658e4982ad3801405
MD5 524eb6d4694eef88c5ec9d974fd7b2ec
SHA1 e2d4efd5f8d227a3d67204f2de5ba1776eddcc22
SHA512 ce401b5debda3017a811e736639a218b474b69b637e4feb7f62a13c5ed3a166c381a58c10cbbdf0882add2fe51c53dd8a3a06083c6b857af826fa417e5094996
SSDEEP 12288:1V5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A345237B675C00CAD83685B4C2F5E11DE8237D56EA3005DB6B532CEE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2b75f1cff17aa7735d068ddacfeb66fc0ee32b00623ef0277febf5b01965712a
MD5 9796dc9ee2b5472001912c4a27f1b5d8
SHA1 9b2b2e18660c1db9773b91191d9bae266988315a
SHA512 1fab12d62fa90f5b296a4c615bf3f1e5d2dc920ea8fbe53d21cc8efebe6ffd596443659f3b1c12ace53c55dd96af434af3961cd46d2a850da122c3de726f613f
SSDEEP 12288:JxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F4523BE954C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDFBB24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ce14afa889d1d81c57bb747c86d171b34d3618b8e0ef8e5827e163814f8c0134
MD5 01493ef019b98f1e03c28594056d3bfd
SHA1 52691bff78e4e0701f89a2b0a1d0d207ba026742
SHA512 e191a0d419cf8f2cd5ae0eb172f9f481b2b50692af2fac31f56bb847bc31ec097d760932ccc73af22af4cf2d618e8917500958414839569f691129c16512d1a6
SSDEEP 12288:5+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C4523BE964C41CBE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b600923b98c7731bd702aed9e3c42296cf3aea958d559cbf72abd7b3a4d21dee
MD5 b0f5fcde8166f909c4778c57f894bb49
SHA1 046174ec6ef1cde1b3a6ce252cc64d9bd8dfa2bd
SHA512 cdf4ba743a29d3542cb85dd2c848b673df8cd5d88f2215f2cee9208d15fd29fa43c8914d9cafd77e3ee5e93dc82283e3b89beab97b7e42c68e4e4769d966f7d3
SSDEEP 12288:zKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1654523BE964C41CAE52644B5C3E9F11DAC073E5BE9200493BA5B7CBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ddf3912ab979a40928ea367f95e44aeec6813763331daae98fa5e3076e4e007d
MD5 b56fa98eb13e657144ca949dbb29f016
SHA1 9ceeb4513a24b11e428e0e4eb560bb0a4d69ff1f
SHA512 a1e41338fa64b6f18daaedcb63ea742f28329a3cf1eb53a7eb8c1565a5aba478a9074f958f67ff5a6e651edc080060e250aabc7b05bf83db1c2dd1586aca15e4
SSDEEP 24576:VZMMzFVSOysqjnhMgeiCl7G0nehbGZpbD:VZMMzfCDmg27RnWGj
TLSH
T1296501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f15bd4a8c0dda92bd9934bc883149dd6865889dbed6ce544120b3088dcf590f5
MD5 6bc282fe9784b33e4b3fb1506545053d
SHA1 48d3f264a11a187aa1a996291df3f47f8ce2d97c
SHA512 2f18d5e7a7b33bf04273f944515bf262027af47b2b5a1b677b1899b8fb0c67eb5c4097725d4e8ea847ac5de5ba605c329283e9dab8a0ce7560a3717d59be0c51
SSDEEP 12288:jrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE965C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF6B24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 11f6aa05b62ba937aa016bb495354cddb33e75b2ebe47bf004e4fdfd48364e89
MD5 b42fccdbfa061f6b20593a236e814a17
SHA1 bfb8579b668ec8eecb2f50f1a629e780fa854e15
SHA512 ea1a43935d85e1728e70c245a4b4a66363d242340da1a1132b62e10656d003a12942e0345f2cb370c0cac7c4b2a612a8834c4eb43150f62f1cebd54768ddace7
SSDEEP 12288:2PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BE964C41CAE62644B5C3E9F14DAC073E5BE9200493BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 de5acd70cee2f7705f1ad4b37bb6fc48f118391c388029170cf3f00003656caf
MD5 d0991c23a03a0316f1c2e7c239b5a815
SHA1 9d5513bb6c4e3446a2afc4eab98f728a083a325a
SHA512 e150e5739ec1268ff7a71f0a686f56bd6659b2145273e7d41da36dee307d1a6670f7d30c1acc1bff359f567a55687e52d41c2052f087c02bae317e3e9fac17ed
SSDEEP 12288:MyPz5L8GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VzyGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19955025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 715e73555d612a492880aebccf644d34a2f4aa8d069ef7de37193886b416f37d
MD5 53f922090d6c6df0291fc1613f1e4985
SHA1 f13589366da488ab1f464237aee6350cd3c4e422
SHA512 d23d598c33315406462a9523c79d394ef3f12657c8c9733004f3295ae69bffc5a38224af512e6e2db7a8eaa31b4e43a00a4a05cf12e2cfb6e8cf34d96abf2c2c
SSDEEP 12288:GrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1814523BF965C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a1a583d7411e3602246251d7e4f7830a04f3d37f226f172c14c9bd3383b4e5cc
MD5 ea64736e752b00a39f6b9195fdf599ff
SHA1 cdfc81d69070e4e60b2a4b0fe7fe768e270a0eac
SHA512 9464fb1d5fd7b212cdd8dd0ab096e314461e5153b5a2f3e5b7666f45aa8665e97df62a64e9228f4113ff2f0059303a7d7a50882d572c3cc89f78e7125fbb26b1
SSDEEP 12288:mrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BE965C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 2c1c55b8c8e009005a8339aab972a8511f7b85a34a4d76fcd41f75dbfe3c5a9b
MD5 05d04d639970832f00652e7e64989821
SHA1 c920118e14facf89e6e6ce9f8382bad157d408bd
SHA512 77fae2ad0e0f01166e26465e109debb7f15cae30de0db5a77e60b3992e6fc56bc1093899dd20704917afb2101bf397163241e672ddd4238c374c360ec8a088ea
SSDEEP 12288:QyPz5L8GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hzyGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17455025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7b93b10ebedc93ae4efaea825b671d263d18c9f6ea65a04b2cd6b9934327c5c6
MD5 585c5445ea4963e56516288c28c42ee8
SHA1 0854e0985f7c012093413d9110d0a5a90ca3ec8e
SHA512 a49ddedcde498c231a96744daf772fbf0d3f2ed8b55336dff932e8762848de10f2b815c199be2e3a616010f0b4c34856909649871123f694efde8f3fefaaafb3
SSDEEP 24576:BT9aLl3z0zDUsqjnhMgeiCl7G0nehbGZpbD:BTQLlj5Dmg27RnWGj
TLSH
T1196501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5973e61cd02ca209b44261abd139e0e950112c349ba20ce68bded688df70f09d
MD5 115cb9d73cff445afa3b1af965d31fc1
SHA1 233d3cf4eb811b87ba4f9c13b0aa54528f9525ca
SHA512 98859a1b76474f6fb9de4065b900d0d5ed4118c565e835e5016be8e9b349b230e971c02c3a892ec76bda21f46213d749e1acca4cdb8862b5a1ff9c86f5b93629
SSDEEP 24576:R3td9CHKy7GZQsqjnhMgeiCl7G0nehbGZpbD:Btd9CHKyaCDmg27RnWGj
TLSH
T19075CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3c3e6ff0c3a8aac88257908657fd93a8808378848922f782f73fc92abff51e97
MD5 154d0b80f9ec29b3764a633e95f11de7
SHA1 6f87f38b60ef781ed25d7fb50a80667f7dfdeec2
SHA512 d44cb0c29bd30f3baacdfef2ad274f1a1c0f6900d350f4d26dc07c6e488e1e5cfa292377cddb24c6b6bd433a630c8ebb6df9209dfaf136d6c628543727a89e4c
SSDEEP 12288:qkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BE954C41CAE52648B5C3E9F14DAC073E5BE9200493BA9B7CBDF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 068584b763e7f2ac39c9f486ab548574739960b809a4ea0e5f7e71f11c18cf42
MD5 052351dff655ba17586648430b690618
SHA1 4d42565ba02e1ec5de60accb0dec66258ea08776
SHA512 6f2a222c9f765a375d5d50ba216cb458ac2c4e7ab20758d77f9a48218916cabe5a7900b3a5f764b56ae670cd52c277d6d2fbf3915616845c8e67dae92ac77cb6
SSDEEP 12288:pmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1554523BE965C41CAE52644F5C3E9F10DAC073E5BE92004937A9B7CBAE7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 34c6e221218539815fd0f0397f6b52f993bda97d2283cab001a94ba60f680f83
MD5 b5e9930a6183deafd47ed587ce8bad31
SHA1 eec1c4a2ade42520e8fe56ab5359148c429c2c5f
SHA512 a46b9508d3fa0398285041c16d818813e9e4d99f457026c255f355a13ea4076ee9fff7eb21894acecadd2c113c82267e3d689d494a4fbc6366701679b9bc8d32
SSDEEP 12288:69Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:69sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BE955C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0ddac555c85020e31397dc41c803ea2678682654aea4855a7cf01f276a669e98
MD5 bde7378c0fe9f5a827530c08b412db0b
SHA1 5eae029f4b0806aa246ae3cbdfb0dbd4da6ef665
SHA512 39393577deb7820988c7f555caf649c2c96024d727c172f387f1e80e1e1bf973b379e6dbe2426be699b6ffdcbb3388d1e95d7a38df743f07c7b5a2c83b317719
SSDEEP 12288:grXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:grsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1954523BE954C51CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 51ac5b03d026a7d4fd0cca6a57012560d7ec3c7a15a17acd3158362c440cdbb1
MD5 f5aa2165c8e5178a9e34d031ace6f82b
SHA1 9977d4e11e9c0da25347ca20ea6c61eec7fa35e5
SHA512 124ac3fb28d3b97167f4a3fbc0510c40a7f1758b26ac788a46d7c0c251c7e67a394e287b472cdc482a73d811c0443ddedf2fca9cc5e104cf5f7a63394858f0c5
SSDEEP 12288:NkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NksqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BE954C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c025dcb5dc8d1a3f813f7e167aa645e4a429694e7d9cc952443606322997ba11
MD5 6e8c5ffc0593255b9882eef5e330e6e1
SHA1 5e02e1768badb0ead778c206e4278a7c07774115
SHA512 368f6167da97568c8ee5ce4405d8af24171bf6692408d6100bca3af9687affea3ee90393b51860e98b5e91fdcba009611b1ab072b12e32dbe09e0e7bd70d3872
SSDEEP 12288:BDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE964C41CAD52644F5C3E5E11DAC073E5BE9200493BA9B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 bb03d51f94a0e5e57f7a5beac7d75610786345aa23a6934c758e242591deb8a0
MD5 4211a412d70387e9d9bfe42f15c7a1af
SHA1 1051a0ecf6275635dd7cc3aa36a47c0fbac68eb2
SHA512 8ed603851cee5ddaa3353e14acf21169fd35a1f9415d50af29c7a31c4a293cff12ec457940d8580bad66962d8db5651c9ee7b961333e3924e5f178f65a947503
SSDEEP 12288:HxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BE954C41CAE52644B5C3E9F14DAC073E5BE9200493BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5e8a33221507806ac2238357858f9cf4b97a0b793ec8d31db21cbe2d162ed0b1
MD5 b6b69b90efd7d4614a2f541e64773caf
SHA1 0f11813a82493df5307964b5750ff96e6766f0d1
SHA512 0c4ab37faea406c8f2a740b7b4ffd943f1a3b18a317e2cd0711c2072263309d9aa2e4057a2bfb0a6cb3333208f7f01b851929092689f63d88a13a846d0a6dfad
SSDEEP 24576:ufwvok9RX6wkyAI/sqjnhMgeiCl7G0nehbGZpbD:6MnYIjDmg27RnWGj
TLSH
T1DA85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fa9910b606973ee0cb7e1fd8862c9e98c8207f20172677bfbf4e7b8c2f5d5e3f
MD5 b3f5130174b6af9ee2db0791aa253828
SHA1 32383b05d27bd58145b0ba8f2617c946e7fc1c25
SHA512 6c3c989b8a1476f9858ce91b143c36ee7604c048bb333b4787c6afb1ed0148914e7d9e0f89165723949fc3faf32fdaa14f3a67fbee8d251690c5eddc29a0fc97
SSDEEP 49152:aYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Dmg27RnWGj:mySzPMD527BWG
TLSH
T142066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b6dde75416732aa89e263d45777ba5c962ffda3555fe725fceaa7edef5b6694b
MD5 885c71f04e2248a3f9bd05e7aa5c4caa
SHA1 feb00ce70daecdc5b66ec0a7bdf2aa6c48900088
SHA512 c66a7645641da23e442a43a686957389ebee4b6e4abe5628fb031bf2a3f32b6298c89820fb1e086d75d2fd47d360baf94309387d28c29d83c8afbb660c994e72
SSDEEP 24576:A47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYisqjnhMgeiCl7G0nehbGZpbD:A47JUQj4irIhCnDHUPfF/kDmg27RnWGj
TLSH
T1C265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b2887f2754af2664c6f7c707aba9846623a78a37ebd0014b9e2fcd7699657af7
MD5 cfe1f22c5103213ddbd0312667764322
SHA1 8b8517213d7e6476545527184aefd031a7d939d5
SHA512 84c81169a0a070178b6e3a4751aa80272ce8b9f9487ff9cf6da9ecd77e3cf5572ecf923644726d2a8648f6e0c40ff9f46577f96f18f2352409f51b9625b17eba
SSDEEP 12288:DGsf7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F455015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 310bac3270b277aa055319b77a9ab0f2f99a5bcc2d9d5e4baa2d3c89f5b4fdbb
MD5 8b95e8a9135e693a3b95d58f6453d486
SHA1 30f8ef023696c60a8791f8fd3e9b3341cb5978cd
SHA512 2804d905adfa8475dc5436a3dac63fed6b07ada1d831613bba4a875805a222d8f214f4ed93aac77ef87478e5d3a103612ad3d4d74c198f81ddf7d11523ac0f5d
SSDEEP 12288:UVj/ZUy5bOCuWuQL3Ebo4OzWkw6XoscvMe4EjYdM1CzuY2:UVVUPCV/L0uSgcZdjYUCz2
TLSH
T104452910762BD75FC6AD40326E72D6CCAB707D41EE456B0372C8873FC576568BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aa210f896c5b95f79d3ef7cbc1eecd602b87e7199df808496d2de126857ef74f
MD5 d0d1e31787fe4a954a2d9eb6d6d237df
SHA1 e990c2683804fa76d5278262a357dce8e6957def
SHA512 227f21bed9340cad4eb03d424a83603f12fc146adc91fd747753b4cc64f8e5386520c763e1268ef3ec03df48402f917feda83bc98ba19f1e25e9f04f15319a61
SSDEEP 24576:zHWZ92806xA7agiJqHljJBalc0SZGnXkh+:zHWZ9vxA7agiJqHljJBalc0SZlo
TLSH
T11965E7419537A38FD1FB6032033AAF4DAB74EC0277056F267788453AD86A765B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 048b32eb2584a260500927c69eda23cfe05817cef243f47463ae077cb0239d1e
MD5 3d3893ef07da1d5e2f63cf6b0ea90ac5
SHA1 1f807a9113fd4a4dcc6314c8dbce2755aebba7e0
SHA512 e492923aae95db90c8bf9b1d0da19519c8189f3a7502d1d6dbd2020618746d40649247f0505ddb13d21c861c4bf3159e2a53c8baa109a36a317ce3668d04a52e
SSDEEP 12288:3F7TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14145237B934C518AF93605B482EAE12D680B7E669F1044C3B94778FDF6B18D88F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 02ea90c25defdbaa7b271275e62e93c59f7c1a4cbd3e2421d11b3bc8e5fdadcc
MD5 a4da0167848c6c38dc8b5f6ef34b4c4c
SHA1 59db301693a295fcf87410fafbcbdc9cd0c8f1c0
SHA512 1b555e5f58c6cc29c5b0f1564dfaaf19e1ead3134e978732fe8a70f1d344f9ccc2f28c19a3f781d413d0ebeb65131fa0b4b827368926c5d85f1de9ea6533fe78
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYFsqjnhMgeiCl7G0nehbGZpbD:7gb4mBIBhGFmDmg27RnWGj
TLSH
T164659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 58b9390261ddb83f49fe0f236787a0fabcb9d0f15100b6ba6928c23c1acbc27b
MD5 3e45f4c4ff3ee73a73820a9207364167
SHA1 20e8a82f718b0c348789ff84b2ffb8814342e019
SHA512 82db03904b72db754b6c54dae441cabf629472ed234a02528172cec2620eebe46bf59007e5f725532508f45f6f7aa677438c1039644288c024599e49cfbad86e
SSDEEP 24576:PG88u8FpJqH1Wzria7/mysqjnhMgeiCl7G0nehbGZpbD:+7ZFPqVha7/BDmg27RnWGj
TLSH
T17485016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fc2809bef199697c5ec26c229ff77d8cdf2b2055e7443842d157423e10953947
MD5 3b0298760739db106930cca20f05406c
SHA1 1ba6436d9d4408bfa655aaeb9d2d15f118cf419f
SHA512 9148b0fb7ecc17762c43171f75a9499d8e38bb90b509ba3634da441a4260899a316f665b313d06f18c984d5c26524a2adf96c026bc0c7700aecd7073bbe897c0
SSDEEP 12288:+HvUrBFrEjwaQuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:+PUr+NQusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD65F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8d107fd6d206a31a2d565661b7321069b171a4c0bf05373469e6bf7c27e3ccbc
MD5 6a20e9817f9b03beb571ef079d7c2dc7
SHA1 c172922d72a322ab51fd718dfb35f104921addaf
SHA512 cbb8387bd9fd047d2b3229e50674adac64f553ebbc1c9201bca7ca581ef33df58ea938c9c398a664f4e28ea2e2e1dbc1f2f2d4773180305d39a6c76deac43979
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSDmg27RnWGj:2G05lO43bLD527BWG
TLSH
T13BD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 015abac80717f4fe52c65381ebe81eee1dd6b3e550bc850f9756c40727ee28e4
MD5 3ac601d16d41bb34a2f2cbe7acfefb6f
SHA1 89f64a558e1686a28d51e06e5f48874368671b96
SHA512 a07cfba78111dd8362e0d29aa86d6a35204b3368e33d99080ed28f671394e4baa4ddfe80e6f1d9ec6a70d2ebd31e33be2cb8ffc92ee19df2c81e89091f501eee
SSDEEP 24576:kfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnIsqjnhMgeiCl7G0nehbGZpbD:8a5POZ39Jt2pasx2+mqDmg27RnWGj
TLSH
T14165BF5EA3FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 29066a58b88613b2f312122b352265bff9020c54fc6090c7f4dc0424b329db42
MD5 fed14c3d78657d228457b8e216588466
SHA1 c8e4ae38394623c734d47c2923b8f1d3c12782c7
SHA512 1584200ca7a4c71e56f79355d5586b0b60b62436b6a189dda798c3b6ac56ae333bd0d91b57159ca88cd5bd801da37ed0f94f09e41cc59c7a582211abaa9d5d94
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkasqjnhMgeiCl7G0nehbGZpbD:bNc/zEOVHFhDmg27RnWGj
TLSH
T172857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ede31ec571fc3a6986ded46ad08c03f5a2465dd6718dc7cf1ff24a43233b5243
MD5 ec498202c33beef83a84475def93a1bb
SHA1 92de3b9b86dfb4771a1a442b5c34443401d78012
SHA512 afce1d6ff951c79562fb9c0876752829ed2fbfd9ffb17fa4d23d2cf2021a9eca0fdfb3f9506efd7b2607a4025f67d8e03b78fd843e647a5d71162dce4540cda0
SSDEEP 24576:RtkNvNnaFeYhJNtmZBmxsqjnhMgeiCl7G0nehbGZpbD:RtMwBtOmFDmg27RnWGj
TLSH
T12455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 01e480b403f3630a409e2e27e664373de5caac850277adf92a88b8c1d3b62950
MD5 0c48e1c81fff03654d380029e752ff6d
SHA1 de820c5f212b57b28bdd456ee69a563f95e231c1
SHA512 514ef0973200b3ace40d17d8d9c4e680f7c866561fa619ca269ce4a555e37e74128f1a78c2ca106a01941c4087d28ef2de4af27eec4ba892af5ebaa6e6eb89ea
SSDEEP 24576:6D3FHshBIYQgAnsqjnhMgeiCl7G0nehbGZpbD:6DVHeBIAA7Dmg27RnWGj
TLSH
T17675E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/404-99-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/404-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/404-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/404-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/404-332-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1228-105-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1228-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1228-317-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1228-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1228-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1228-111-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1680-8-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/1680-7-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/1680-0-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/1680-1-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/1680-28-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/2564-82-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/2564-87-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/2564-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2564-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2964-118-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2964-124-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2964-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2964-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3140-283-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3140-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3140-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3140-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3408-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3408-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3408-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3692-77-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3692-298-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3692-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3692-71-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4820-139-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4820-137-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4820-131-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4820-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4820-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5728-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5728-50-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5728-53-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5728-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5728-43-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5728-49-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5744-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5744-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5744-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5744-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5744-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5756-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5756-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5756-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5756-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download