ce5c10fb1b345302f28c7a0162c8c4fca9ce30e8db02322ecfc171a6d1f451db

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260816-cjacraytas
SHA256 ce5c10fb1b345302f28c7a0162c8c4fca9ce30e8db02322ecfc171a6d1f451db
MD5 8fba8bc6f0f14a0df64d7e380b6753c2
SHA1 c17f84234d5459785de0b0120a5a682727ac0b73
SHA512 aaa5e11171ee6538fdb0cbc566d8519b546101b3bcd1c8edbd9b18ed91ab59ff5ef941d2db4d158e7fbdb29575b902a1426211c441111841c6d54aeeb384f352
SSDEEP 49152:R+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755bo:8/PvOBjcXvvOOc5idt6N3u5H
TLSH
T16E165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3924	elevation_service.exe
4752	elevation_service.exe
5820	maintenanceservice.exe
5536	OSE.EXE
4736	PerceptionSimulationService.exe
6104	perfhost.exe
412	ReFsDedupSvc.exe
5104	SensorDataService.exe
5860	ssh-agent.exe
4500	AgentService.exe
2924	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5998f81e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3f94dd5232ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fc1abd1232ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b42c831c242ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e2ecdad2232ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b12154d1232ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075b25dd1232ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3924	elevation_service.exe
3924	elevation_service.exe
3924	elevation_service.exe
3924	elevation_service.exe
3924	elevation_service.exe
3924	elevation_service.exe
3924	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2152	2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3924	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4500	AgentService.exe
Token: 33	2924	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2924	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2924	SearchIndexer.exe
Token: SeBackupPrivilege	412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	412	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3924	elevation_service.exe
Token: SeDebugPrivilege	4752	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2384	2924	SearchIndexer.exe	103
PID 2924 wrote to memory of 4300	2924	SearchIndexer.exe	104
PID 2924 wrote to memory of 3556	2924	SearchIndexer.exe	105
PID 2924 wrote to memory of 3368	2924	SearchIndexer.exe	106
PID 2924 wrote to memory of 488	2924	SearchIndexer.exe	112
PID 2924 wrote to memory of 6040	2924	SearchIndexer.exe	113
PID 2924 wrote to memory of 2724	2924	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_8fba8bc6f0f14a0df64d7e380b6753c2_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9db70c0817e6b91580dd93a5a72ecd74d16e75ac065873cc2673ce5dcf459ab6
MD5 991f17f4315ebc04255d2c77576e42b8
SHA1 ad926d409c72e32915ba8cba053140995b370127
SHA512 ed98bb20c25c8fba6f4f2b37f2bead8d7ec539e5fc1d34ffe8d68a8c16c1495da74ed71edb44cc748c4aab4a26b0b2a1ba761576a7464310c0536091c44ef632
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJsdZz6N3Q6itmOH:e3q6HjB1dt6N3u5H
TLSH
T198D58D03F29900E9E06ED178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f7572a5e9d2f8b1d9ac5359bc277354a08e330b2d298de879e75a6e06dc2b879
MD5 fcf2d939da6c26d9b98a236886ac582a
SHA1 c99b0d3fc1501c6c81a38b0743eeeddc573203d0
SHA512 5008dcc004bea29b552a4db0229fd487166921acd942ea8bc835b6f5e309eb8f0a0d3c0dccad22053306ecb4c7da1b5ce1d6af1c370aac40cd87d90732fd4a9a
SSDEEP 12288:Y1XLsswWkxy2lRq2czANf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:eXYfDtczANsdZCA6N3Q6itdsOeg
TLSH
T1BE05F12873A408F9ED6B827CC8A1C511EA73B85547A0E7DB03F499251F336D85D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 bda5a3b132d501fbdad782b798b4ebb84dfc2bb57ea27785c961a100c0ff3ad0
MD5 de5226bec1a0bc215c8fe68fddc83351
SHA1 a9cab75a268588fd2266ddc8b18bc799fdce5db1
SHA512 956c6b4ec0a8efe317edd3cac13d559b71d7d0bf9a433a0205f969a1d0811a5e10fb3bae784b89da94714ea62aa81544b273f763c19a582878486bbba22c40ed
SSDEEP 24576:a0Le5ji0hmxirM0sdZCA6N3Q6itdsOeg:aPji0AcHsdZz6N3Q6itmOH
TLSH
T19035AE16F6788335D073C0B9C5D2A69EED72308517308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ebcd31ee328048676bfa31c2402c3336f85d61e77dba7503f6200a7bbce5f87
MD5 dd178c275b0124b4005884083267ffbe
SHA1 bde2897f63c573072bae8777e11ddcb6691e1f45
SHA512 51bff422d196d939467505617684e6c6e950200bf952d6526f3d5dc46549accebfd7f41c9a96413fa03b8b04f2077e52ad7de49d7a0c23dd0d0d2f26809da499
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyuysdZCA6N3Q6itdsOeg:e/ezSC6vUzPvxHjy7sdZz6N3Q6itmOH
TLSH
T1CB756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1e7f9542205d0cdd916da6fc7d6b3d13f6a931e013787f0343e55064487dd4a6
MD5 763293c33b4dbf3d311c7d782e243297
SHA1 71ff7c4bed70b3cfd16099acdf84297662155c24
SHA512 1f3c83fbf2d2de2c866b171d7d6613b55e8577e22e836b55a9ad9aedbc5d792e1c252a8921f2913387094d360945994c1c76783420b603cd14964abd53357d3a
SSDEEP 24576:+VbqPb88hv/l+6ZsdZCA6N3Q6itdsOeg:+VO88hXl+osdZz6N3Q6itmOH
TLSH
T150559E66F5748331D073C0BAC4D2AA9AEE3234415B31CACB1246D76C3E676E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b1cfb353d02791b08ec5164b65f665c193399e2b705e9d9668dbc7305cd0fb73
MD5 f210f86b17a1c00b63906d12cb81b8c8
SHA1 e0985c779f3644f55bd7f28341e35a4c77d7019c
SHA512 9ff8845e96928963b0691fc3242d995d37472ad798b982a96ca70cf6e3fc11e813ade1f8ab30c44932b0e2f1e57b0311db6f5153a6be495514549d8774106928
SSDEEP 12288:zRAf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:zRAsdZCA6N3Q6itdsOeg
TLSH
T107C42346133C41EAE79F17B458E4E174D97AAE1C54E0ABA3C57139588C358E7CC7A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c43566bf64ddce12d253a3f6cebd82867bd47a982722d3d0e56e34e4b98c7a33
MD5 3e86e0eaec9e5d5661f623e8516a9356
SHA1 e5875266aca30bc1f067ab6d01ca09f242fe7f80
SHA512 ad07642e060f0dcdcde4a2ac10a0390d7ad62b8bf3de473445f59372a8cb03dd6814c7052776372a5c9a3b239aca1b1409dedf8e5ac3c9096bd4d21a5575019a
SSDEEP 12288:weBNUbTVO86Uhf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:wJIUhsdZCA6N3Q6itdsOeg
TLSH
T1E905CF3BAE28FCE2C27E4DB85A91C640E77278304B61A3CBD175820DDE235E55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 00776e8d8aaa6ac5b8896c9d6892bb295942eb589ab866a59ec94d94d97545a0
MD5 b30aeeda367c62b513b406f58e60a176
SHA1 5fa2516fa5db42526303f942436aa2681077bcda
SHA512 9d1f5938e70202eb4be7510bd09127988409a5b027dfd03d1ca97473301ddc4693772846c74e88245a34ac7a6f112cfa734a48489e09d489343ba885800517d1
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THK:OQvGAdlCEL8c/yRNw5CDdt6N3u5H
TLSH
T1B3267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 daeeb2ffaed3ba00efb86fb5fc4c33db862058f69e0a1f7844041f0347449a24
MD5 88eebd0ccc3e3a39eb5d0967afe69c65
SHA1 0bbdfdafa2dc9b2b061e7005356cceedd1dcf050
SHA512 521b2da6323fd0f12aba4d22a1249b05466bb3578457015d1f1d7905a5f5f4094980950fb7a0af13d08701294abcdbdf5c395e4569f3aa28de7e1acbb3eac747
SSDEEP 12288:CAwSfxL/2Dc34DLLmt0LDQewsAjXf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5v:HdewsAjXsdZCA6N3Q6itdsOeg
TLSH
T16415E031FA74D036C3BF0DB61B75C716583DBA204BA12AC3E3A85E9D58301D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a048a03e59c62e956168e38a0b5e8e47323eb775bb51afbba31e5c6213019a17
MD5 bbb7a0ec929675c9bf5e8118189ea9bf
SHA1 3e5443160f689b8e60187075964a1a298fec3bf4
SHA512 5ddbe96f69f70af3dada73d4affafa57131cf45c7c2e2d1eef9ebcca89dc91adad1b0312cb5992afaea1cd4d8ee73c1035c47d5f81131f5a68f7d1f77b0a71ca
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqtE3m:XUEtQevvqc2W1cpV2EI325
TLSH
T1E6474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 332e327f82a8f95447cd7c6bd46f74b49231e0d9276a4dfbbfbec32c5c03cfc4
MD5 2b8852349d335ed12cfca541f1eac0f7
SHA1 00d18791b5616ceb40ea72ac0e252db904cb53a8
SHA512 9e0f1e785bc09785d5808ce9b286ed0663f6c950db6c7c0250b8779016976bc925a9f0f58633c28909641c81d673f6798eaf7371d88db341d20a7d0cc9d3e82a
SSDEEP 49152:BCbRquA/m2yL5zTfFiV+XenmE3/z3sdZz6N3Q6itmOH:uoquVjnmXdt6N3u5H
TLSH
T1B0D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d08d913ad564448a633099da95503dc21d50f3d0fa17ab38ac1331d19e5f5f08
MD5 63d2363b03795a84af68d8675d0b92cf
SHA1 19f58bdf5e07c4f457a07b3f4b083a3d523a73f3
SHA512 27d7c11fe69252460e53ed6441110bb7c9b31c185a1b80124143e177bf6593108e850b1790dd7914fed0aa472b8feb3d6d2625866256c115427925758189b3f1
SSDEEP 24576:gAhGLJIFoiwtA5l7S53GsdZCA6N3Q6itdsOeg:gAMyFoiq52sdZz6N3Q6itmOH
TLSH
T1F9359D81E7F945D4F5B7AAB899B69170EA76BCA95E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 176fbe43ffe6681effeaa8faf538e5f7248e89c53ee119982acf90c940f704f5
MD5 895283a103eef89d7a57c323732c71f7
SHA1 9462f46b4f1ad211b77f5ddecbb90bbf8fa652ed
SHA512 19678c8fccd8e2f76c67170b1db8bab9ad1763c7603c9052d883455b68fb6552de5bd2109f2030cddec2535379e8209d427b588e411f0811f84516611eb9fcaf
SSDEEP 12288:jmw5HEjsChNVBFgl0WDm+CSf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5Qitdsu:iwuoOWbsdZCA6N3Q6itdsOeg
TLSH
T10805F14633A80CF9EAAB42388597C135F7F2BC152A61DB1F4760C65A5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 fbfb93e64203e5a005d609da591235ac1f228ad8f72390ee38e6686d1c99041c
MD5 3495b5649ec0fa1fbb11282c732192cc
SHA1 d8365b47eb2e0b62ad01f16e77ae138f1a864439
SHA512 159322495d95b2b1a724cded93907e00c0bfc9f3b967cc615bc231ffdcb1c6997931c2205ebde834d76806019410eeaf236b50f7396ec44b4272b32458795d0e
SSDEEP 12288:kBZ1Iynf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:CZucsdZCA6N3Q6itdsOeg
TLSH
T186E4124A33A860FAE39B137CC8E09654E772782527B193CF457066695E339D68D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 729b789aea6857f835e1b33cde42e57bbbe17a19048d9b931d6471aefbb5ad5e
MD5 f71795440a4e59a5e7f4366dc733d2d3
SHA1 b4a680eafcc9c870d1ca5abb18a3bb0b9ca2f9c9
SHA512 b47265eecf04edc2132ce8c3fe3e96dbf543c2bf928e85f25ed4ffbf0e2023627644a1320b8d7d87a914f23e635841d92dd4d670b5f8ba32a60610e0942c0830
SSDEEP 98304:aQRQyi36YOcPQLvw2gAf+PN3mdt6N3u5H:RQyiKayX+PNUtE3m
TLSH
T148666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4f83fe9b2e783f449c7aa68dcbc3d64ebe9ae4f547d5a497ba6b367408b11eb
MD5 c72175d9a49cb604540d59955374ff84
SHA1 51d1693c1a5083f984df184b843929acfa865a8c
SHA512 637e5e8147b8e0cf4f947729add4246d7b7024562dbea9ec5850c14f2fb5278af413876babb8a594b2ee0ec383b063b235180a863036abf40fd30701bdda4997
SSDEEP 98304:qQRQyi36YOcPQLvw2gAf+PN3mdt6N3u5H:BQyiKayX+PNUtE3m
TLSH
T176666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0610b26276cbbb454e7176df4a8cb07559a3925fa36ed2516b773efa16c27531
MD5 b50a00c83e012a86f919a2f01a8c0901
SHA1 d12a19fb9e13f479a4fe97218c6096ab38b59c92
SHA512 d1f9a000e65caff7a4306bfcf436178a9809752574b713c996b50b943f1fd4d18271231d13f4c8abdc12d6a432d198ae44fdf566ebeedc6ae49e2a4f1cc8f23d
SSDEEP 49152:M68Qg55nhheWu7PNU3/HsdZz6N3Q6itmOH:GthWRc/Mdt6N3u5H
TLSH
T179B54933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 76ef9b8f0d6e77233714c19b30cb3485c1c07c1a485071220375f09b9ff9d959
MD5 014c805bcd5c5f9e4094e036fd798df7
SHA1 222be37d5a5f5af353847ef8451f9e53583a34d1
SHA512 a1cc3f3785e602c09c019bcfa5fe989f0540cea079f823fe4133a9866a6b90588fb7085989af57e84f48869f12b37c6cf818b6e264f67b52897cff1936b0372e
SSDEEP 98304:+y5112gYy5azzVvL69nLKnhZtdt6N3u5H:vLIHmWhFtE3m
TLSH
T170167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e2534752ecf96008817e1d8d70218837d4640ddec6dccc0d3933947e66d7b00c
MD5 065ab7a2bf36dbd68fb0ef097ccbc2a0
SHA1 a17c09893bc6f27fe7929c20e9a655f581b271a7
SHA512 c7c698a900edeb128b0b5448d6d78400ad560db539356856570d8dc4a798ef15d7e03eafd6382e2287e373597abeae7400d1f7ed49ff7d7ea41e2d5b3114e834
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glcsdZz6N3Q6itmOH:ru6JmVxd2d5dt6N3u5H
TLSH
T1E8D59D13F1DA01E8D05ED578974A9232FA62BC490B34B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ca491f17af6e31cf3aa91b6e99a763b15e3271b13cfefb2fa5154754c91171fe
MD5 18810b4f5389f0454c6b8feb037a8bf1
SHA1 07647a45bfcbe96088b17634becb32fcf654967a
SHA512 db71516076e761e959b0eb61596255ccd4e0dfceb4394fb77fd4f897764aa46198fd1b0e95e4db5da69998e4952de724106435b3eed205d848e5b960cfb09c4e
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xBsdZz6N3Q6itmOH:0mifPbRXdt6N3u5H
TLSH
T186B5BE13F29800E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45F3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 85b6809934c71d7ccbdcd695369b1e76d5e6d2f75271f9a7a21c3c71116675de
MD5 ecf203bb0a31ccf4107ec53f1fa85bfa
SHA1 fcea9cdcd920020f5cc1b775899235cecd2d3b84
SHA512 27d9f409943a7578c41ed6a129bd4a6070e3c44bb32523009e93e8432204c2c5ba122194b63db20bd65bb3e2435778e74a3a8bd5668b8a273a3c9781193088bd
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqcsdZz6N3Q6itmOH:H5dKTi615dt6N3u5H
TLSH
T127C5BF03F2E941E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6cc266a55b2ec3964282e7b52028291b2f54aa7c9da66b6563918860fd970bcd
MD5 f3b48d435637e7108bcfe19358bc9cf4
SHA1 a620a14ae7d5a3d151f35bc8e6dc87fc029202b3
SHA512 f57e3a008671b8236c83315e265d1199f56e95ef9308e89cf88ee10b5ca710ccb2ac691884e802a72c37404a0ac320e8c57c624e241a15618f5d4a30b55c927a
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5wNsdZz6N3Q6itmOH:DX2iyphbdt6N3u5H
TLSH
T1D395BE13F2D900E8D05ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0c4f4e3b2d749fb44d2629e24aec36c7d148959a3475c17c57ba45e6a7ca86e2
MD5 aed3562e4b535df0f5916b606ff79b97
SHA1 895e4fda835a2f0f3b09f8c674cb8ec5c3a5cc48
SHA512 32ba3ce5bcde69e34fe152255711ccf08a371c0cbb2b6af99eb49f9ccbb873fdb92547efece929ae0bc100aca727d4b6b0f3685933c637dbce8ca7e2a94596a6
SSDEEP 12288:Nof3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:NosdZCA6N3Q6itdsOeg
TLSH
T166C42346223D81EFE74E17B488E0D2B8E96E6E1C64E1A7B3D57135189C358E78C7A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8b83410e7e01f89bbf87e2e68274509836514796be2072045ab4f173e5fc5714
MD5 ec712fa47a0ff491b5e5114523d6b122
SHA1 17525f1cf2f4137caf8c11e01f9e98ba5d004894
SHA512 1ea0c127f3b958afda6382831c00d69c15c7b5d01788d13b9a5f70f3ba8a4962b73a661b4f6647333129e216e49973a9a38b45c99d2b57e7a8818c6262a769ae
SSDEEP 12288:azf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:azsdZCA6N3Q6itdsOeg
TLSH
T166C42346223D45EFE74E17B888E0D2B8D97D6E2C64E1A7B3D57135189C358EA8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 42e882fc20f444fd1d35681f556d789ccb8e8c7fb134741bd50f409c2269382f
MD5 399777869e78e2afaaa9752801273bf6
SHA1 78a582ad2ea923e7f334958a6779cf4dbdb5454b
SHA512 a917afd0003bcdcc7915effc7dc6d1c3f96b8e914aea4c2cc820b71b110f5b212656d2d8046cc0e19a3f3db8c5a7664cee4f0c63ecfbcddfad14c7e56ffbdc68
SSDEEP 12288:kJf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:kJsdZCA6N3Q6itdsOeg
TLSH
T139C42305223D45EFE74E17B888E0D2B8E97D6E1C64E1A7B3D57134189C358EA8C3A173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ff7b0e09516556c9776d6c2c2318f7df6dac8abf931b392a3c360f467649f31b
MD5 09ff44c2e81d3dd6fceafcafcd5b9def
SHA1 ca00624dc89e436b1f8475210270e1c625463929
SHA512 e86a89f8e563e2e3487e6efd581fd8336fe2219ee2fd6fa63ba23eef18975ce1950e72474bed44ce5c5100042e02ce2fd12ef690c0fbf4a6abec2c75c541cc93
SSDEEP 12288:YVmf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:5sdZCA6N3Q6itdsOeg
TLSH
T19DD42306237D41DADB5E53B8C8F1D164E6BABD2CA5B1A7EBCA2039184C315E5DC39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 6164e29136d61f0827d0420d7bb44d7240ad3d767ba7fbba201a4e10344464f8
MD5 9f8cbef63260fd5911d6e427411a67f3
SHA1 88a33ef2b8cbcb6428d7dfabada977810119bad4
SHA512 1847d958024ecfd1cbd53b34e6fc460584a0c299de166f37fc2261dbe6da917ee8e3f5d1a6ae9393d28aa4a3617e1b743fc9f3b7d1123148c3ec6be9a3b23180
SSDEEP 12288:X+f3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:X+sdZCA6N3Q6itdsOeg
TLSH
T1C5C42306223D41EFE74E17B888E0D2B8E97D6E1C64E1A7B3D57135189C358EA8C3A173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 90a9943fc38ec5c42ccb2824de58fabae3d678d71e3614335a5d5aae8f145fe8
MD5 e098b34e75ba8eaa64eab18e985e9891
SHA1 bc5a3e1e3a6a222436c2f8b52ee281c5b129d226
SHA512 a042ac6ff3b1c5fccec6684bf6b1dde5792f8b09419b721d9b813d426e992c20dffbfeea017300e978eeeb464ee22d4322af95d14035f8d65b7c66f84fab6fbf
SSDEEP 12288:Tff3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:TfsdZCA6N3Q6itdsOeg
TLSH
T13CC42346223D45EFD74E17B488E0D2B8E9796E1C64E1A7B3D57135189C358EB8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f056c394ce275ac628667e9084d284cc444a20309e660984fda1f48e720e2a85
MD5 80cc0e78bd01ca43d6c901a3090bbb16
SHA1 bd895974ba95019a8158aa7a8b84b9c0c2f1d1ca
SHA512 3262ae270e075502229bd8cf15200ec1e800186fa4fa7474f3f9f13c7aed7c2ee257c5b0bcd9a79b95516aaad738349a637429c159c86a93da0b0d40ac112913
SSDEEP 12288:NLf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:NLsdZCA6N3Q6itdsOeg
TLSH
T1C3C42346223D45EFE74E17B888E0D2B8D97D6E2C64E1A7B3D57135189C358AB8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 77ed26025e000bf9c426c7db844d399982675d4d6b28aa824f02c081b996c0d6
MD5 a768bf8145347677ad9c61ac1da4b3f2
SHA1 c01d37e260845a36b713d522b5b71429efbb182f
SHA512 85b058e395bb7c4737af5a2b8ac2ea177b99e528326ce3475029abc1023453f87737bb7e132f5eba426a81afa555c0f2bbeb3b629925d6096148e4dcbd0feb40
SSDEEP 12288:8iZwb6zzFEoS2cPvyTf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:fZMSzFVSOTsdZCA6N3Q6itdsOeg
TLSH
T1F1050295736408F9ED6B823ECCA58915D6B27C190AB0C75F03B4362A5F333A15C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3c3a6c7dcd64a703a1056b1b7b43398f3cf0df39280b560cf56ea467d2a2294c
MD5 b66411ae9bb6bc96f43c62e6dc58c21c
SHA1 d80c893a0ae22aa0d42b13bea1da0ed7c3017ca3
SHA512 05f02dc71348ef323fbcb0b2877f692582bbd765a8a52f43edab01c0bdea07978912217115ac7d3abe123d9a52c8eeb3495885be6e3b964bf87dc624e3a4088a
SSDEEP 12288:Nsf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:NssdZCA6N3Q6itdsOeg
TLSH
T1C2C42346223D45EFE74E17B888E0D2B8D97DAE1C74E1A7A3D57135189C358AA8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a4efb0aaef8c6be346d107657d6ddb4a428778f49b40ce0026d6d4f6c5231d76
MD5 170d1efb21a89c7b83e6a3e272477ac7
SHA1 59741532e316dc700951bfe4ac06a569b9aca8bb
SHA512 93a8686338ddb0c5ba5905e3e47c52637dedaab2884e48a0fd6c42dc6984aa89afb064442ed3512b6b6d34aab07f3ffbd9e9db056c90ef42158b125af2f350fc
SSDEEP 12288:tQf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:tQsdZCA6N3Q6itdsOeg
TLSH
T14AC42346223C45EFE74E17B888E0D2B8D97DAE1C74E1A7A3D57135189C358AB8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 db326ee2cea15ead57eee7b87c4c7a9dde3df83d465605c9866f94f69b1aaac1
MD5 3d219e7281437e60b02bdc1ea0d24ff2
SHA1 37d3acb2b0cee92dc0b457b0502411f40a8a7914
SHA512 7f016058395320391b138d0f57b1eaec19bbb14cf0aa729ce9fa208cd6ea92cfa0f083166b57660205965b26f0c557bcf85614e9efb2c6de4c9782e593daccbd
SSDEEP 12288:3yPz5L8nf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:6zynsdZCA6N3Q6itdsOeg
TLSH
T1ACF4020733A920FDD26B4278C8E15A10F776B83517609BAF57A0167A2E336E19D3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 51e72b59cc4d44d21de08139525215d6a6daca310d476e0d8122b592469f5856
MD5 8e5617e1dc0940200d133fd0edc9aa61
SHA1 f04bc062e45e4713b62a8ad73c02053a472e8bd8
SHA512 00d3ec4dea48399bb97c1b4ba2fb41f2326b9ea3ea105f58ec13ac14df40598205897c0867263afa04ec9f866e73f0ff0d9eab2d7017b8cac6315e786af388bd
SSDEEP 12288:vsf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:vssdZCA6N3Q6itdsOeg
TLSH
T169C42346223D45EFE74E17B888E0D2B8D97DAE1C64E1A7A3D57135189C358EB8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1ed4fe12935a28250c7a9c6c5571f2484d0ffd67318696a03406973fd73996d4
MD5 48ebd475b17bb734ef20845a2b603c60
SHA1 fb87605c9dcefce232d55ed06d3558367c216697
SHA512 4a6088d4d744af04768b8e4b0625ef0f942902653673c1b4faadfc37b40deeaf1f6df9d515b1adf657159f35defb50a428e5b5a4d932a063f68696d7d34b1a61
SSDEEP 12288:4sf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:4ssdZCA6N3Q6itdsOeg
TLSH
T1E4C42346223D45EFE74E17B888E0D2B8D97D6E2C64E1A7A3D57135189C358EB8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 18a420eba093083e2993dc73ca408f9c8b08fb9f6559778f49cebee52d87b2fb
MD5 5814168990ef2ae538811c05f70dac9f
SHA1 d211f045c34908894d4b0a3b2475e5ac4d30a419
SHA512 af3fc0f7c32db5d1e8cda0eaec8530c8dfd8e1cce95bf6403f47f0bf639781bd3b28df2d8cf395ce6e62fe1b7df11f43e2ac91a90101ba73244deb079610b3c9
SSDEEP 12288:HyPz5L8nf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:qzynsdZCA6N3Q6itdsOeg
TLSH
T18CF4020733A920FDD26B4278C8E15A10F776B83517609BAF57A0167A2E336E19D3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 cf78b7f9a613095e54f3d360232f866242336d516b2bd8aef3e405b823fe636d
MD5 dffc7e2c589f97016715e03fb3d5e9ad
SHA1 ece98cb177881f27f4e4b6eafdab168ecb48fd8d
SHA512 497ad2a9a95591f81dcc9e13d775e1bfe479f9570475cf4106f97999d99d9e28aecfc9c257a2bd10a2f18587b8eb1ded435f787dd87d1575d009bb77c0e5440e
SSDEEP 12288:CCd9eWYoaLHF3z0z04PDvh5f3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5Qitdsu:DTHaLl3z0zD5sdZCA6N3Q6itdsOeg
TLSH
T120050295736408F8ED6B423ECCA58915D6B27C2A07B0C75F03B4362A5F332A15C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 de71dbe5bc5062e953a1fbef1390fcbb42c0c7e21a4a9763f90286a6d981bbd4
MD5 b58e44609aa4fe89fa85086e71d58ef6
SHA1 c20156063b2ad1536a4107419636673e9df57f03
SHA512 9bf33e6a649fb12f70d98e4d78c67c17d208d8d391f38d63fac37e971ec7215eea00bcbfc65f818c7e8273c978192e9483037366381aa8b6aef9caeb1e708481
SSDEEP 12288:di4e7+RdTfgwCHKy7GLbbdIvKf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitT:d37d9CHKy7GZVsdZCA6N3Q6itdsOeg
TLSH
T1BE25CF90B3E810E8F1B79A358C769511DAB67C591B71DE8F03A4261A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 55c482ae9ad3baf052a3e037d325060e2d0064255eed4e03dbb81129c2df36ad
MD5 d2134de1b1b8e731dd00382cb0fc9132
SHA1 aeced229c2c563b8a07eeefbd24e74c820eeae4b
SHA512 86904c3bacdcf2f7ac51e6e0fb69eeacea9cf45472455fc55a0e7145856b34c34294f3bea5631f1dec0bc35151f6c05d1667a0d944458353db02d98263ffa9c2
SSDEEP 12288:/pf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:/psdZCA6N3Q6itdsOeg
TLSH
T157C42305223D41EFE74E17B898E0D2B8D97E6E2C64E1A7B3D57134189C358EA8C3A173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f766db7d1e738b516976d242046d383b99a141b0d36125e7c7d1dac5d0118803
MD5 e28b0dcdedf0976bb8eec6f388565318
SHA1 7baa2c141d8202f9fc9229eb19f6604df332407a
SHA512 2aed4bd8fc667263a4f3f93152760f9e6fd7dc11a9fd92f32d05690c41fd75236d20b7668034061957ae96ca91658036951941693c1714ca6b7e17153fffe2b7
SSDEEP 12288:nHf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:nHsdZCA6N3Q6itdsOeg
TLSH
T162C42345223C45EFE74E17F998E0D2B4E969AE2C64E1A7B3D57134189C358ABCC3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a4a4b1d6a7e3b129e02246846e37745f0bbff1b8c886f99893db6a5a42d1f48d
MD5 932714c9ae30666eceb0cb8df55266a1
SHA1 0ed32d63158b3ed566f3750851a9456fb4c4c081
SHA512 68d0ecc854823bc518e2f5dbdf7fc979a72e6d6440f44138345d7c11973f8498643bd89a8d4bfa9ad8869374d476b5a13c15b9658beef3283b4ad1de560becbf
SSDEEP 12288:hKf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:hKsdZCA6N3Q6itdsOeg
TLSH
T1F7C42346223D45EEE74E17B888E0D2B8D97DAE1C74E1A7A3D57135189C358EA8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 a08fbc49851db48cba350e8d7a716cb90ef092a3f2cbfa99b86930e1d29ab93a
MD5 9efa28f3dbc9ecfc0457a48278f4e51c
SHA1 97bb0f65f84de72984f67059ed23349af6d96cfd
SHA512 8e755e29ab68de88fffb17b1293d6175511a5b69a0f8401437cd056eb2f48c17e7a31c6e6a6c6077cac6c997713c2d1bf0c889fb0019bd558289f4dfdd5155df
SSDEEP 12288:wsf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:wssdZCA6N3Q6itdsOeg
TLSH
T177C42346223D41EEE74E17B898E0D2B8D97DAE1C74E1A7A3D57135189C358EB8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 f8fc3e5b8f0497b3682a48d3b4585bd2d290469f9e8e92118df7d6021d325a53
MD5 ee502ea078b74896d853d0f439de274e
SHA1 6763ba4497876df4ef85227f56090e4f4f6224ef
SHA512 04cd55debbce8dfe1901e2cf31c35a78a8d20951c7f96d5ce140d5ab1e4a0f126afc2c34430285ecc6cf7aaaae8ada225a1a02f3c899a9be2db5811f02b67f20
SSDEEP 12288:ipf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:ipsdZCA6N3Q6itdsOeg
TLSH
T15CC42346223D41EFD74E17B898E0D2B8D97D6E2C64E1A7B3D57134189C358EA8C3A173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 8f35371e83bdf0e770a16d72a3ab62e618105f4ba1ddca6e152a2299bf50152f
MD5 4992c597180b907e92b52331c218b8ae
SHA1 be9e33d2482ff4ae81f7bb89d8c27303f36caca1
SHA512 f578d86ed20128ca1d7be8425850490b2105311cb3776e41101486fc07d0ac559295481fec8a7a16cb05bb62bb9010e735d851a183fa21976f063cdd14f02691
SSDEEP 12288:Wkf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:WksdZCA6N3Q6itdsOeg
TLSH
T187C42346223C45EED74E17F898E0D2B4D96DAE2C64E1A7B3D97135189C358EB8C3A133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 98deb727252b5a4be44607302f749e5226138b2b2e78328c4448f71be3b38360
MD5 0389aed85a439138dd6593a5c38a4ce3
SHA1 cbaf09325d3cf81f865c9e364bf68cbfc6c4198e
SHA512 e4cdbe07a44492d67ddea5ce0e089a8171f1c1e9c83076555c47cd27a4889586d628f8c7c16f419e38b520c182b2213d51bb4b37f91306e33e946bfa8f189533
SSDEEP 12288:C+f3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:C+sdZCA6N3Q6itdsOeg
TLSH
T19DC42345223D41EFD74E17B888E0D2B8E97E6E1C64E1A7B3D57135189C358EA8C3A173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e669a272b1026f06c0b40cd748f71e4caf4ad839ae2df4a3773452f612c70643
MD5 fe41c1a67081efd52509fd720347afa2
SHA1 cfb29f3552682765a303e449f4664028004f625a
SHA512 f97b096b4164f244242d3320e8a16b54fee6126232a1ef2a2d8b215c3b83524d19f965801ab24c18763ccab8339a91881b1be4161aefbeee0de00f3ff20f59f3
SSDEEP 24576:Tfwvok9RX6wkyAIgsdZCA6N3Q6itdsOeg:1MnYIgsdZz6N3Q6itmOH
TLSH
T1AC35CF29EBDC44E5E177923C88B3860AF6B178681B71C6CF025A536D0E37ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 14dc776a8f71100b4ab02b53f6ff997d6de1fc859be1ad7f8c8e054b03e0cdca
MD5 ed8bff266fb5cb9bd096889d0add852d
SHA1 189b670b2eb175e357b7377ab5966a2fc0c099f9
SHA512 3c02d760ee8a9a679776b6ade70a6155e005829efc192261f8ff80cc8038120ed9b911e6b0f6cc29b43ee7eac2ef64d862b61c44849c5d0503431e4a565a2c6a
SSDEEP 49152:4YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tsdZz6N3Q6itT:GySzPGdt6N3u5H
TLSH
T1DF066C96A16801D5C1BDC1B98B1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 35229071e122dd5e620b3f75e458ac838c447cc93162b2927e97980999697dc7
MD5 5fcc8256437c9222f570092a16e2b785
SHA1 a5f4739f051da0cd8a867697a23fb88bbb6f2444
SHA512 13e559a0acfac386e845999a8cb4e45fe0c5d5346f0decaa7297164df2031c179dbda2e94e3a2e80ae337116008507cd17f5bd8a70bcc18dad0c05f8e8b75b78
SSDEEP 24576:647Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYjsdZCA6N3Q6itdsOeg:647JUQj1irIhCnDHUPfF/9sdZz6N3Q6q
TLSH
T12065AF1DA3EC01E5E1BA927885558A5AEA71782D1F31CACF1270437D6F23ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 81fc1a0b8b6589278a7b3e9dcc39df30924eaa53502f238d2670cc276443430e
MD5 b84dfed20d66d8931b631cc3a40dd61a
SHA1 f28ef7f10b0b5cce145f94008ebfaa71e6d14cb0
SHA512 fe2d1b10ec2a9df0e42db1972fe3c12ddeb329681ddb4d4b8a93e376e25667536ce6fcda45a2b005d5a6e7d01cf1d626a5a79eaa5125bb83a503d1f2a0cf92aa
SSDEEP 12288:MNsfcf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:9csdZCA6N3Q6itdsOeg
TLSH
T12BE4F00AD26802E9C16E6279CB918650F7377C2893E1E3CB92D0F53D1F365919DEA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3a1a3311028900f0700668851c9d52305bbc4f6f42aa1a6ee10b1dbdaddec448
MD5 b39f72a4463d4cac09b6b4a303c327dc
SHA1 6ddd395a383cabd1b0de088a7bda45381d8fc326
SHA512 1e9419c75556fce24c85a23ab5697b779fe64e9e25ea9f3371662e66920337bf47784ad161233bf2bbc7586104096f0ced10653757d82ff94331c2f93f88bb42
SSDEEP 24576:xr+jUPRdg9+iZKoEaxKjcH2PQP3bDhIbD:wjUJd9XodojcGQPnuH
TLSH
T1CC452740762AC78FC6A940325E76D6CCA7707D41FE05AF0773C9873F8476668BAB6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3236424a5d452c9922ae15e7567b782bf2e38bbc18b7eb78cab92f9fb5caf0c2
MD5 73b6b8d28902ed90a2e9ec6a85b4a994
SHA1 2a2d54284beac2dce15d2017566bc0bfd207f7b9
SHA512 fc6415e3672a5f345b6304ce0cc1052c9203902f762564421f2004dd43945122ad84518faaded3f3e440bb66e69ebc9c6fe595a635fd509ee0056a4601eec704
SSDEEP 12288:/ljmsQ3MiNi5OKcbiwixhpX3j+DZ1XwQ6oZIL9SyJy9SyJ79SyJrU7driQz4loDc:/lj5QtsAFbMjDa
TLSH
T11A553A01A5A7E31FC9FD5033427286CDAB746C42BB453B0573448A3C9877ABEB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b41a6b2822c11b02c8c09b4946863b8f3756530f2b0bd5b160c00de16dabdaae
MD5 0a2bcd09d034ac3453fe80ef095da14e
SHA1 21cd8342979c803a5001759363986ff4463a2810
SHA512 a73239352a78b1dbc4e3f8ac1c08ed9585cfb2174a1a66e9ab57a4462eb746f7bffb288f28516dd0a51c8e6c01f2e9fa27c81e12849204451ddba1517e656ec7
SSDEEP 12288:d07Uf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:WUsdZCA6N3Q6itdsOeg
TLSH
T146D42306233C859AFB6E17B444E4D234E62EBE2C5BD0E6E3E52135589C358D6CC7A237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 36f35005f18a5620b6144344d0ae5784df5a77c7ee7b6fdf99252bf695d4a589
MD5 add3185fc9ad8da269cddad3909188d5
SHA1 5c7e3d5393af2a92d73698e64f1b8faeab0305af
SHA512 9d09a6701b93600af5cda98ce3b80c95bbd5cd04f9c4da2da4b3293aa167a90ef68ecd0a5f6396e6e7cf036ec0dbd1041420ac36c63bbffc49abb809ad21e3e8
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYysdZCA6N3Q6itdsOeg:qgb4mBIBhGFjsdZz6N3Q6itmOH
TLSH
T1D165AE1E22EC02F5E1FAD2B8DDAA4417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0c4fcbba96800669106643a130cdf8e642e6e69a1da2e73d15e3c50ad7a178e3
MD5 0d077be13c0e0eccfe99898d26acf916
SHA1 d603b8c9334e177590384c7ee0998b07aee32824
SHA512 3ab86b424da24e5bbf796a4ed6bb1d6baf39637d462064605a5ffe90bfdcb12368e759bf59559bd87761bbce8df622f3beadc9ee77f63a81fb0a212b606083f2
SSDEEP 24576:8G88u8FpJqH1bzria7/mTsdZCA6N3Q6itdsOeg:/7ZFPqVea7/qsdZz6N3Q6itmOH
TLSH
T11D35F16573E401F5D47BD13889828663F6B2B8250364EFDF07A88B551F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ff641a94b3c2a6006a09155c1714265b879fbdffbabf6f657e79975604c2a2e7
MD5 14da3598e42970ba9289f6a77217d23c
SHA1 cef714bb406c7a8e4c5dc0a266aa94606d6a5dab
SHA512 54eb3f34440c4476d0899798da4f7e2f49fca47042addd1744f53b9c37a0dc00b10d1e128f87bbaeb9fd9bef537234fbfaeae29a5589e79033621329c90f8f82
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfsdZz6N3Q6itmOH:yG05lO43bFdt6N3u5H
TLSH
T177D5C06E62EC01F9D1BBD17CD9C6860BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e5d86a6879626512d0ada75f696b4ab524635a8387b8f0dad030f0e592f3440c
MD5 649f246df4a8017efe3393fa774b57ca
SHA1 edaeff2890926e44ae6ad50da39a5da99b953eb6
SHA512 72afa2435c0c45d165a0c9bf2b4527889f54c4467236187a7a06266289e65a5c178a99f665da3666eb714b9199debddfb1d256847e7e0f8d1f44ca0b4c01aa7d
SSDEEP 24576:Hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidntsdZCA6N3Q6itdsOeg:/a5POZ3+Jt2pasx2+mHsdZz6N3Q6itmu
TLSH
T10365AF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3fad0e248875e1751f31e22f05c4f25c661afc426358f5c39d92930941482b44
MD5 5ae56c41f688e9e8c5b34a9aa137264a
SHA1 2b373a433f154d7fd088d2b5cfca934b17aa7084
SHA512 3e012bc031d7eebedb7b4884877ec0fa9028ecab8f11b984f0ae99cf8c0b6082984aed3b5c352b802909184cfa557b47309b3b9b3b482ed2ec450e66f4d79dab
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7Fk7sdZCA6N3Q6itdsOeg:cNc/zEOVHFKsdZz6N3Q6itmOH
TLSH
T1EB857B1623E901E4E5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b86b85c17035129f52c2f771ef572b66a30f0398e66971b2e42644ffaf1e2a84
MD5 9b5d0916222cb21af8633e5d4378dba7
SHA1 6831c95a74b2ec7d15c6f0a28a01bde0e969caf5
SHA512 01d0548d63124567edfbe920cb5a4c96e2af6c89e693a497f1a42a22df0656cac0fcde9debdd1223120ecb3da23a35838cd711fbf6c7be14edfc993437d09759
SSDEEP 24576:f8kNvNnaFeYhJNtmZBmgsdZCA6N3Q6itdsOeg:f8MwBtOmgsdZz6N3Q6itmOH
TLSH
T1F355AF6E76B846E4D1FEC6B4CD238512FA727461173293CB9290C13E0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 99c31b5f2036ae15589213794c9352d956fd2bd7afe96b85b1b1cf1c1382e0b8
MD5 7e2b099f5af4cd4ce3316979a6aa7063
SHA1 c470be5b014c01142a22b520b8c692a1ffce57ab
SHA512 f1898563824fd552461d4e1820297a526aa986eda2df1f7fa65cb38c5008358b6cb14a3407b80a8215745c6467585c20b18ade007c98251270726259339264c9
SSDEEP 12288:8HvUrBFrEjwaQvf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:8PUr+NQvsdZCA6N3Q6itdsOeg
TLSH
T1B605F11F22AC18E5E77AA17C89828719F771B8661351D2DF02E0917E4E37DE8AC3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 b7ada05b7bd482d29aff67a099f466348e2f5649976dfabe88702170896e6c21
MD5 0fb0bd7780ab52ba4f72e4475bfc953c
SHA1 34c12f78b5d38c8c2c871b13732b755ac1b7923c
SHA512 1af734fa473d1ce5fb1c12dba679b5ae852791e63da899a7912f7b5f674399cbb50ea7f3e932a59088b82fa47be2b1f23bd63fdedd404debe5cf7048f6b659c8
SSDEEP 12288:oQcMxWDXN1Dp/fshBItT1IQgAIf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5Qih:qD3FHshBIYQgAIsdZCA6N3Q6itdsOeg
TLSH
T19625E13EE65C04E4E57BD2BCD9A38606E77138AD032166DB02D091B95F2BEE46D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/412-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/412-92-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/412-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/412-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/412-86-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2152-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/2152-38-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/2152-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2152-0-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2152-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2924-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2924-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2924-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2924-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3556-394-0x0000018BF6EC0000-0x0000018BF714B000-memory.dmp

Download

memory/3556-317-0x0000018BF6EC0000-0x0000018BF714B000-memory.dmp

Download

memory/3924-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3924-15-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3924-23-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3924-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4500-131-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4500-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4500-134-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4500-125-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4500-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4736-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4736-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4736-78-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4736-292-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4752-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4752-41-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4752-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4752-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5104-99-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5104-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-105-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5104-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-311-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5104-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5536-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5536-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5536-277-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5536-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5820-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5820-52-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5820-44-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5820-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5820-55-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5860-118-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5860-112-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5860-310-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5860-110-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6104-307-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6104-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download