880e1deef0d02f0280e6b8652636d16a2ef38813b4f1992afa66daab6800e21a

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 4.1MB
Sample260825-apy7ysdn5v
SHA256 880e1deef0d02f0280e6b8652636d16a2ef38813b4f1992afa66daab6800e21a
MD5 d18ac8bf8160e9e1d2a6acd36f1a63ed
SHA1 8c02c6a6bbf3b3a8f2f9dc79820a05e5d8837bbf
SHA512 ef1187e25e4640e344fbfb8bc756ded43a4e228351bfc64419845fa77ea282f567d5ff8c182bd990885b8be6d247188b32bd7ebbb896fd89e112f341dadec9e1
SSDEEP 49152:5STEw7JU7QkgAz40a8AzyRoB6NYhuqzgITFV8SquBRhc2A3ue5I8U1QqpN755Uaf:WEVq3FOc5Pix8EVy
TLSH
T1F3166C2EB35845E8D5A6D5BC8A468506F271F841CB2156CF22A4875F2FB7BE34E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2440	elevation_service.exe
3260	elevation_service.exe
2328	maintenanceservice.exe
5852	OSE.EXE
2180	PerceptionSimulationService.exe
3304	perfhost.exe
5520	ReFsDedupSvc.exe
5888	SensorDataService.exe
4064	ssh-agent.exe
1560	AgentService.exe
2944	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5a692ec723e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c10fad112834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8712e142834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010e8ee112834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aae5bf102834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036d0f5512834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3cde8512834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b12fdf122834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004edbd30f2834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4192	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2440	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1560	AgentService.exe
Token: SeBackupPrivilege	5520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5520	ReFsDedupSvc.exe
Token: 33	2944	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2944	SearchIndexer.exe
Token: SeDebugPrivilege	2440	elevation_service.exe
Token: SeDebugPrivilege	3260	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4252	2944	SearchIndexer.exe	103
PID 2944 wrote to memory of 3312	2944	SearchIndexer.exe	104
PID 2944 wrote to memory of 4496	2944	SearchIndexer.exe	105
PID 2944 wrote to memory of 4816	2944	SearchIndexer.exe	106
PID 2944 wrote to memory of 4480	2944	SearchIndexer.exe	114
PID 2944 wrote to memory of 3780	2944	SearchIndexer.exe	115
PID 2944 wrote to memory of 2192	2944	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2328

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3304

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5888

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3064 3056 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3008 3012 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3064 3056 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3008 3012 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2737bfc3b23cb7b7349f607d182e64fc15951471d36f1c4b692d693d1bdabfb6
MD5 feb6501ed6361336f15cbf9caac7799e
SHA1 b0578d9727bcedacba313f703575bef958cd7e2d
SHA512 555ad9bfaff675384505164aa9ede50be3f7e8597b91d8d500a2fd057d8742b205836445d4a5b649389bf24234af38df5589570939f95e090f9fd459242fdc17
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4x4x8EVep:b3q6HjBbix8EVy
TLSH
T123D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 44b3806ace6b20f62527b461c350bd0961add0f8c3aa9fc4315ce5d899602fe8
MD5 38e787f8df8dc38acdb99886e85fa13a
SHA1 2cbf4f8394fc22661f51a72055ac6fda2d900373
SHA512 46399ceee9aa287b4ecd366ee8ee64571c3f5cfbf84805d5a4fa560798ed7f90be059b9372f5a009fe41ad343b7c3288403d4bf334cffcfb57e1937e60ab13a9
SSDEEP 12288:T1XLsswWkxy2lRq2czAv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:JXYfDtczAvyxknw4FYnshx8OfVe247
TLSH
T18C75F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 5fba66cc87f8f7947333581f148bfd5fd45819702c767a71733190ffa938c14a
MD5 6e5674d9dee3e0359cafb6dc1f9c1708
SHA1 56741ea45f2691477642dea04803db4532f95133
SHA512 4f139335ebe2c37aa8fd4bcea0439fbe671f499a2761817ad642f2b0e496188ef1639edecbf5d544e9a5b7f7e83556bfe47550fb1bbed89b1f6022ec66babbb4
SSDEEP 24576:y0Le5ji0hmx1rMGyxknw4FYnshx8OfVe247:yPji0A7Ux4x8EVep
TLSH
T16695AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bd52b26cbf8f410404300570adc059872ecb38a78da19d313dcc00f5d2cf71a3
MD5 36cdd707e52499fa61be441c420bfa53
SHA1 55c30a06ed703d84ab33a10e2ab0227c63d1ec79
SHA512 c92fb18392bccb3e289521159066d1175d18e90271322d2145ef21c3dda74659d5c06c39b906ed53da84b8db7ca6d10c1223ff9b7ac6716d4b9d20e89744e757
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyukyxknw4FYnshx8OfVe247:b/ezSC6vUzPvxHjygx4x8EVep
TLSH
T17E756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0c7bb0bac23f9b54e8dc44efd73f9d66adfae49c06cc4e5e7e0dd2920fd6daae
MD5 fd5fd6b89c8a6c5b4bfd6c0f0ec0690b
SHA1 93a17bc5a3a3b159e5b7be0a432f4c7b3f50c674
SHA512 cd54094318978f44aa934b66d7f32f3805535f33a0cf4f2e4a4d43ee229304bf7fc037696f4f3a39fb229db7215734bfafd0f90adf9bb6622e9947e3e903af84
SSDEEP 24576:WVbqPb88hv/l+67yxknw4FYnshx8OfVe247:WVO88hXl+Vx4x8EVep
TLSH
T1A3559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 343ec5349b1f7979106d3069d3cc5806a7ee895f703b301fb0b2a7adb8c5a723
MD5 eac2339b1245d40c05f13e03ca7e89ca
SHA1 26981361fa5df7015bdeed9b526e6d1f0a8e0e6d
SHA512 75bbca8c7418c4bdab85953e930c6ed5da119f7b3a5350a6a1f2913cf285213a7ada16c8fca1ffabe8fd71562e4310e74d3a51e0aa723a6042ffc261a1f7d987
SSDEEP 12288:8NS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8NSyxknw4FYnshx8OfVe247
TLSH
T1B465237CA7DDA4E1FA5E14331B7572622616BDA4DA74C11BC778B14EE0F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d614b4d9746d739fe7f4684dae58e0e40419fc8e2466064393dab08e21958727
MD5 f2ea27666f9a94adc32b1f19a1b7cf23
SHA1 7361ec0298094719258460005fe5cf36ae7f30d9
SHA512 b14740e7a8a7154afc2ba24579d5bbe473c436a5eee42a62e4fa32372af0366217ac8d4e07733f4648f7c408905c914bca5c3bba917968ec1095dd11b485b48c
SSDEEP 12288:AeBNUbTVO86UD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AJIUDyxknw4FYnshx8OfVe247
TLSH
T1EA75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 604e9af293bb07427bb70988d2998cf8755562501b0e7bc7e5d8043f537dfef7
MD5 54f7131a6bf0f11bb4f18384a69bc229
SHA1 9119d5804244410cd224894e83214b94053dad1d
SHA512 0128f42821ca2a53b3991d01b85fe0a094409bf3ae7c38479b754231ba2230597150f05949eb27886e3f30d58e10c99f365c2172fcc7a4aca4a4d270f11a93bd
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:5QvGAdlCEL8c/yRNw5Cvix8EVy
TLSH
T156267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 9588f262debbf35bb13208c8eae306b191bbb54d8c98d215f2fc8f74ed4851b3
MD5 0157ce21cde58e469ede059b3c617266
SHA1 c0cc3c24f41794a622ae859ecc3b17ce7f40e911
SHA512 446e030010da4c928eddf1200005c096637c44b340b35acc97b407e4e50167838e7fa9fc62c5dfb4b001dcc786da738f162dd5685033bc3fe6efb2834334a1e0
SSDEEP 12288:6AwSfxL/2Dc3LDLLmt0LDQewsAjB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:P6ewsAjByxknw4FYnshx8OfVe247
TLSH
T17B85E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 35f0f12d0f957208a894b056c389970fddffb686f2f476b8dbc62fb004eec5d9
MD5 72839ebb341246f72191a0ba3313289d
SHA1 bdb36fc7a6369d84e42ca55ab885a86e39b18598
SHA512 1728635fa4342bcd8aaaa874d573ece9935b1ed78b77fdd589802c2b684145a9287de251b10f475fc12982f3e6b94bcf62a923f2321ce485d26bcf9e424c49ef
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHx:PUEtQevvqc2W1cpV2EI32
TLSH
T1C1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b3839176bffa6b8a60d181063adae3c618e487fa516f45f0f478bac26eca357c
MD5 5edacc9e727b5a012d3943c817a70aee
SHA1 be01b8e77396aae07a9b588e9e6a8b387802adcf
SHA512 a73d547680c6a689ed2bd2cf8c193d46a3bb9cd4cedc6a4488581d6f2234616be82b6764d253d7f943f1f104800ade118262aaa1fea878363b796d4ccb441222
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zkx4x8EVep:moqtVjnmLix8EVy
TLSH
T184D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bf172fd9cac059cc2ca4323525f02339f32e20d2e15c77c4d4f785d2776e48bf
MD5 c50688b7eb538b0ec3279942694eab5e
SHA1 c77100998d8e408bf6796644565a47f47c9e9fd9
SHA512 ce544c45125556f183730f4b805be3e059a88b96e381d9595294a0b6244ab38d42eebdeaa21a17f535f90f32fc94375be6f3e91ddbbc55bf1cac05b8695b6010
SSDEEP 24576:4AhGLJIFoiwtA5l7S53Iyxknw4FYnshx8OfVe247:4AMyFoiq57x4x8EVep
TLSH
T1FC35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 b1554cbb3dba134fee1fce070ea03a5586bed597b41d196534d5ed70af94fd63
MD5 09b4c24fd3f480a1cbdced9b2496328a
SHA1 3a3485a9abb19161ba66ef2c678a6616fa94aa95
SHA512 222b75bd1051feb19a2e44bf4e7aa3b3de9f0c3fa1134078f34f16b2072a4d23f77db251b61926dc4ea038fc4ead8b4220fbf4cfaf9ebbacdbcff572b24b9308
SSDEEP 12288:jmw5HEjsChN4BFgl0WDm+CE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:iwuVOW1yxknw4FYnshx8OfVe247
TLSH
T1FA75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 ed9bd7f04abd610467d4c77978b9b83855a5664ff9b583e24e7ec7dbe22cf151
MD5 4bb2b8cb37d400573862512b89f1d351
SHA1 ff50821e50e0a06c614f0688310890e256381090
SHA512 60a94a2f1af8ac59d642699dedb3d564f1eebda7328f97f25d716c686838c5f078c1407f644c41ee4e6843650a0eea1e3fcb7642dcb6a94b0c2d226ba7c16bd9
SSDEEP 12288:4FZ1Iyx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iZuOyxknw4FYnshx8OfVe247
TLSH
T1776512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 80c6400ced87ab48ba90bb0ddc7bfbfc3431de21932408c91579f9bb87690667
MD5 107249f140e72ba2c43614e02551b906
SHA1 ab906cbfcdedb514c3a0d115e6eaa40e25834262
SHA512 1dcfcf2ebf20fc4c09e64de649f7d5eec9d6be4ec5c7a934ee314ed6791f582175ddea5e7e046f27a91da93668035a0b4bbdaf20117c646954233922e7aa0c46
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:wQRQyi36YOcPQLvw2gAf+PN3Cix8EVy
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9822eb9d248ced062c0c0d9fe351b3fe03327a8d2cf4ed79bb2891206eff6f93
MD5 44e64d8f411971489bb064b2e54f389f
SHA1 cc1e4fae76d344e6a1ccc5e30d0f4dc31ba0821a
SHA512 8eb197fc6f5e3ac8d09e41f2c1c78f442ab6cf816dbc44c4d58749874042c5688e88244f0ca8ac3d73eb26976b480f19e27375836658e42662f61c38d82aa1c4
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:vQRQyi36YOcPQLvw2gAf+PN3Cix8EVy
TLSH
T188667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d59d4fc201fcf21e953df2394880aa7e88268e77aabc39be9c64314a356dcd04
MD5 9d15b6eaf38a3a02cb4b3a7271875ecb
SHA1 6f4511ea3a2a782ad21124d2f0ea377a82c0ea1f
SHA512 d8a97fc78632a0cf61f8bf3847bfb8e9336778aac9e0e806ff64a4965bc81884cc8fe51b644521736a2fa971334a4ecfd2fd55f639098484c084d2b6ac43bd7e
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0eyxknw4FYnshx8Z:368Qg55nhheWu7PNU3/Ux4x8EVep
TLSH
T1DCB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6b026edcb9646c910b2e3b869c428bff1e35e7e2354b6b37a4864866fd281ca8
MD5 7d8cded0b1b4c9736980b564ded3aa1e
SHA1 8376be6c8e122d71c6840f303eadd6e66630a62c
SHA512 2f917ddd3e615d2f53c16e42c9bc703113285f2f05cccea67fc9188181fc8d7ae9631fc4198d03ce40f91282ebaa256a5836f38f5266561e63366514a9d3267c
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99K:0y5112gYy5azzVvL69nLKnhZNix8EVy
TLSH
T1A5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fac179ad802e6357809b9370ef2a19652e3cd936b34d56780f770e8e6d13266d
MD5 b302d649bebbd8380cc1d827888812e2
SHA1 dbd0e087ee0037f9ac0661396043b1c2953321ba
SHA512 323f03d107affe839113e8730fd09c0a9af7799cf77c198c6a78997d4192f72beec7bb7c2f75a2d38c96fa0e9bbe77b9c7592e9c101b1aadd19fe57a69f14653
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfx4x8EVep0:4u6JmVxd2dfix8EVy0
TLSH
T103D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1682ed312a79cde02fdf4b5b9003f78e3583fc9bbfbc43ebea0d1ac509dce2b5
MD5 3d4883b1bbbb8fe98c032418f91c5b20
SHA1 114b4c8aebc8b5d5ff61fa9fd264866ec04e998b
SHA512 ed95a0747d75696dca9594934eb2481c40368320b6080383c7f2a8a454099464d64308a5515a61c837f39ffebf0d7346f9deac9a1be74a2fef88135ee3075826
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4xmx4x8EVep:EmifPbRLix8EVy
TLSH
T1BDB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a1ec16233d5bce28a7fc426984195601e6bbf32599a8f7c385081fabaf4585e1
MD5 076860d4692e571c7680689b01410134
SHA1 0ae135887da1d3e3aa37f2563cd6f47ab2560b5c
SHA512 c913669150aecb1262f00d93b808b279ac7b2b42ce67ef3d1e531e24f4d37a40dc7ed987024404bd14e0e10059cfcc41b8d1e85ad20b625b1368a4bccd8ab53b
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqBx4x8EVep:c5dKTi61Bix8EVy
TLSH
T10AC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a8b48b376687bd2287375840df6e7af1e22862ea59146b7519288256024f827b
MD5 400badb2758954a9783f80d9252ff798
SHA1 f4ae8e24be089d6a82e1efd11832c7725330a556
SHA512 4cd2ecceb0aa02dde65a35eede67b21eef49314e1d64facc009e900464f763039ce5248b53e81d10d3e3b0e2b4188c42d572a102805d87d9ed76ea5a5af7d664
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wax4x8EVep:3X2iyphnix8EVy
TLSH
T18695BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 fd81efbe346623582a0f49a7ef8ea90e4f072748bdb6f16743f762459dd71d8d
MD5 1965016e2d51a042a1bea52f75303e08
SHA1 b9aa911d148eb25bd83980498206f901fc5f48b2
SHA512 769ee377b3f1a338a8aba23d949ecda02c897a59877986099206cbd22cf6b83d36b15bc74ca1069faf9ed04bef344e8107455c6f6af824d19ace005ce3f4a95d
SSDEEP 12288:U6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:U6yxknw4FYnshx8OfVe247
TLSH
T11665237CBBDEA5E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8410ee55018843eece12748a667d8be42f95528efeeb21059ebe518cff85339d
MD5 46a2fdf992b42e9a78485ca212a3e5db
SHA1 21afee0f279d2fb95d06d768295d48c653517afe
SHA512 c98f0c06ea8d4e424ce5ad9b676df4eda4abd75e1fc548cdf07237e6bac8f60a990b439b118f3e9589ccfe431a6dc74f70abf26512ac384280bff3656fd2680e
SSDEEP 12288:Yt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ytyxknw4FYnshx8OfVe247
TLSH
T16D65237CBBDE95E2E50D11734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f2fb6e9b594afec0a67b259672a42b01661e02f30cd28c744cbc18ddf1d6d769
MD5 62cd5bf959b81cdd18a0ead3c07cb5ef
SHA1 6e7b069d3006d5c751cb779e8cf5f1d99ea78514
SHA512 5b605540c34b67b0ea8c7dfabe189367454de2654c391c23cfe64ebc8cca756f0cfc7526ed5bf3dcafc707600918d951b167fe54d7ff97a2ec0836288da5e87e
SSDEEP 12288:aL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aLyxknw4FYnshx8OfVe247
TLSH
T12E65237CBBDFA5D2F50D11734B7263626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 442db8498d4b9aee1e11fc33a2c812a24491de056ab830430956575533e71088
MD5 6ff5b67313cfff8703c79f3cf39b1068
SHA1 6ba31b82ee46041a0538781033454d89f0c1ab13
SHA512 fddfb350c10b980fa996f09216c0d30990ffd422c88093ab8c595144ad747641439b4e98178d81c486fbffbd5eb1948563fbd565e9d2e72d5e1c75932829a494
SSDEEP 12288:vVo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cyxknw4FYnshx8OfVe247
TLSH
T15465236C77EE50D1E85A51738A726222B365B8E5E731C35FCB24710EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 625cf1e479854fe73676df2f26ece8589d2870214af473d92488cb2ce08a64c7
MD5 2476732f9b04203ca2f8cc18014d661d
SHA1 0a61f2a56f57e41761039146eb641092148527ed
SHA512 f820332b16289fa2911a40d0e477e4e4b3dda52fae87b6af2b3e7a961c33d939c1556995a221a19406079e75b128429f765c810a447dae706226e1e322f5a1c9
SSDEEP 12288:1A+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Ayxknw4FYnshx8OfVe247
TLSH
T15D65237CBBDF95D2F50D11734B7263626609B5A5EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f11e601e6cb814972f4ede2a81377aeb497a99bed28c09665d55e723dab331a9
MD5 e99fc32af9964e469cc95a3027f5102c
SHA1 b4ee5249fa5d16f7f14a2bbd1a647278a9b39fa9
SHA512 e0e1d0c05a0dfde2c5dfb4f5c2df46e07071a3bf1314eba6e87a1b39fa5af3059c8b71ddb0698fea5e0cd54d730daab5695360da790f3d86f1ee4c2d51265b93
SSDEEP 12288:7J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Jyxknw4FYnshx8OfVe247
TLSH
T11665237CBBDE95E2F50D11734B7173626609B5A5EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 88c15d58f5ade5bf5c1297450523d68af3daf22027a49cb82a955dc75ac89466
MD5 6d7984f383b9fd2818efcbe3a79d2d71
SHA1 3487f17937d6d1ad851c909f591109fe7c6f055e
SHA512 566dd92610daa69be27fd1e88ac867c4d209cecca2627aa11b0633dd5e14fdf730526b051739bb621bc05cb44f45f31a44400e594472d82d75e2dfed5da8dcbd
SSDEEP 12288:IF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IFyxknw4FYnshx8OfVe247
TLSH
T10765237CBBDA95E2F50D10734B7173626609B5A5EA75811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3f9dcead504a22ae8e8dc34083ffcdc8c3c547d50b40b62ac5bcc561ec663387
MD5 6a5063405e62653d3bec12b4600bf9ec
SHA1 af34f3aefc078689636ffbb6cb64b7692ff4332d
SHA512 cf2f2ebd48ee6c0204a6e6e1121e346f39b6a4dde7354082a81c1e38517d6d9d256cea7dd21c5c118c41a1c09bc90c80fb013fc2c3dbf9c124eb168ba65ab87e
SSDEEP 12288:CiZwbZzzFEoS2cPvyN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lZMdzFVSONyxknw4FYnshx8OfVe247
TLSH
T1D47501A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6eb2f8b8a9fd6e3d6ab9bcc5b226eb316f46acc10d2e0103db44ea47aa30c044
MD5 a56153ba03f8007619530193b4a8323b
SHA1 e1aee924226be6afea869056c1f8a61defde4648
SHA512 185ff4037ba4fb2f14d833c5c7b4c48ff927f8c0d84ad741c428a9787606f65f5161361397499583ecc1bf58c8f21cfc7c348f432961d48ec797d78880223d0c
SSDEEP 12288:I++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:I+yxknw4FYnshx8OfVe247
TLSH
T13C65237CB7DEA5D2F50D11734B7163626609B5A5EAB1811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1d862b52a651410c09e1ccd4b7a36619dff4703a17904c1d3fc3240163f1ce51
MD5 f4876bcf1f24b34a9b402834199d3365
SHA1 f92e4a0c5d9e526d7be7fe71c78a62dafa7517e2
SHA512 3b8a58ba3c8f5d2e5d9b49b252f5eb858a6825d16aaf503c37ac13328e0f052614cf12289f9e511af23c27579ad3533e37ef7a53e46fb0adb23a58d4347d39b5
SSDEEP 12288:rC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rCyxknw4FYnshx8OfVe247
TLSH
T12C65237CBBDE95E2F50D10734B7163626609B6A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3e1d510e89c9a6900b807e6a25588a5ea036e04a4b9e0a1c2f705cf60423daeb
MD5 029ca28f9489d5c33b0b45f0a8802897
SHA1 d3c7a82a8ee010b79e1e83b0f327bbd429d019e9
SHA512 28c992f23d6cf2fb16376b9c481d53387ebab194f9f70be0e6740eca056a627a78b0e16dafc267f2eefa4cacbe8283d7c1c2cee1034ef827b29efa3f372bf3d7
SSDEEP 12288:VyPz5L8x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8zyxyxknw4FYnshx8OfVe247
TLSH
T14575125B73E530F5E13A423689621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 4bd733e0cb80459413cee4b60cb4f60a465901b29ee1089deaafa0bf8b9b9620
MD5 004527163d305e663a553d517dbc1db6
SHA1 86e0dc968cc67811bc12374b3f7ddde388cc4d32
SHA512 0359882e6773751ee86240cd2799702b7bfab9387bae21cb06fb1ca2c4fce125d7956d10bcaf3be18e535fe1b9237ca3bf8bebd62e9e8f9711cd5bc0ebe41098
SSDEEP 12288:X++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:X+yxknw4FYnshx8OfVe247
TLSH
T1F56523BCB7DEA5E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e63a3827aa5cb309a81595cdfeeb6a4cb65af977e6ceaef8f76e0dc7b8af93be
MD5 d90ca0a584d57b97065119ea19c4b12d
SHA1 b0b69decdc5761cfa896c35f1d727502acecf89c
SHA512 e2e7c7f242ad8ff62ab4fdbb5a257a5df47a9d0a839e4fc381ab48f3b4557d9c482e2f8815e018ba3ab2447e9bb59a337a5fbab0f9b02d2afb9751ae7e4c1881
SSDEEP 12288:Y++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Y+yxknw4FYnshx8OfVe247
TLSH
T18E6523BCB7DEA5E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 df0d71b1797c26823c0c3dff4ac6012085d579c683b1d3f20f26ca1663ac193f
MD5 5b5ad323d60b973cc9138a83928fa311
SHA1 9bccd071af80c2348498667668822d62149c7f3a
SHA512 6ba38f487db8ba62549675db211112f6760af0f10cf3c2e91d4c436213b2b66ce322bf9598691269e02f55c37aaf8b9bb428c49648180074e290920b5cb3a792
SSDEEP 12288:KyPz5L8x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xzyxyxknw4FYnshx8OfVe247
TLSH
T18275125B73E530F5D13A423689621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 de8f1e0ab48e5f8e8835b387fd7e0615ac49c7e50f7903186a43a0ba17d49f4c
MD5 e48d493023fff91c10aa950d1be80545
SHA1 46d065d0e9786ab8faee9c85f1ea77bed913de70
SHA512 981acdab92d5f8e56c71964a0a1666b3550e4946b4611a656d6ffd97cb862bc6db09864bb5ab1c139d9537fd5d2f08b7aa18551d68952acac06b75cbeffc6e6f
SSDEEP 24576:DTGaLl3z0zDbyxknw4FYnshx8OfVe247:DTFLlj/x4x8EVep
TLSH
T12C7501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 f95b6577b9dfc764836f4eac368406b1ed8c2bf5ecb0a7b1d51130be7cebad8d
MD5 86eeec6e835a535838a5c4ee0c9c123a
SHA1 1cb270ecb989703872d6c339b124e4ca6f0184b3
SHA512 ad60993f80774fc45fa494e98c3cea3da494e48478ed3b139712aa33b997580456b5c8469ada7b3995a71702560601a20c78ef7a45a817e54756a492f7fd0351
SSDEEP 24576:W3Xd9CHKy7GZXyxknw4FYnshx8OfVe247:4Xd9CHKya8x4x8EVep
TLSH
T15B95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 0b0083fb79629878a33e98947da7f57cabc2b30b03b9f4aece8a43d4d7e506e5
MD5 caec547f161f9e20323f9c2231560fe1
SHA1 4b720845e8b4d08a371001c58ce204a633d871ab
SHA512 f7f0e926976443334fb6ca1b5bf303af6ae089a2b9a0943269ef370add05fd5e05cfdff0759f16f616e41ec3e8b4e8eb53fcdc6a9628c274f36cc2cf11bb8d9f
SSDEEP 12288:Vr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vryxknw4FYnshx8OfVe247
TLSH
T10265237CBBDE95D2F50D11734B7273626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f8f5e02d12af7b37f8ef5a99e94681e70b1b01d3942ea0f8ef5483e3afe00eb7
MD5 771444de94f468425363452ea5fa0b15
SHA1 97a22507a924bcea1c992bd2eae0493ef8cb2a18
SHA512 6725d89c8b50c3efe89f912746b53bb578891d519e5d0d365e5c98c5299ae6a44ca8803f6bfe99d8b64ed764c0939d75db4adfe59092eeaed0dd9ebaa4741a85
SSDEEP 12288:ER+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ERyxknw4FYnshx8OfVe247
TLSH
T16E65237CBBDE95E2F50D11734B7263626609B5A5EA71811BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 5e54637913e0c0dcd2c312509b715928c430062d3578fda734d257c0642cf874
MD5 97ce6b1643b2b17b8ff9575018fab15c
SHA1 4e6750f6bbd152b788e9c4fb33ee3e7bafa68911
SHA512 07db8361a9d0d3ec101b232fd8e967c5d282158af6cdab7b69a0b0d4bb18c0fbc270fcfa19cace1f4a78f2edf7ffcbc8fd2c22c87ae4f6aa2ce1a8b79f1951f1
SSDEEP 12288:58+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:58yxknw4FYnshx8OfVe247
TLSH
T1DE6523BCB7DE95D2F50D10734B7163626609B5A5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 69bb026b34c0c935b3c173325265dcd7cb32a8f388794093cd65da34b3cc5627
MD5 085393d36fe1a3e6adc3ad1e5c0d52f1
SHA1 460c777f40d4e1f312d87a1bfe3e1f95178e388e
SHA512 24e1d14e13eefb0429495fdce1deb4be0d255f8570357eb1242af4b660a520b2a17effa4740c484790132d36b4858b09d25dfddce4b834a1ea39bd918151c729
SSDEEP 12288:t++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:t+yxknw4FYnshx8OfVe247
TLSH
T1D86523BCB7DEA5E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 05812d1ed44e8ef52d7334440f248c61eb4a55fc406cc665634e8494ff583408
MD5 72c859347952063907ea7fe01ae13544
SHA1 efab05139a65d810032c9c6e15509dc6011ff29f
SHA512 fbb798306d806abc09af1ba68265e11fd4e35f4995372e832efa83adfe611a972ffbafb45d5edfb9fdc6a6e31a92a0cc7da39a6e26106c98088958dd67a0dc58
SSDEEP 12288:7r+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7ryxknw4FYnshx8OfVe247
TLSH
T1CB65237CB7DF95E2F50D11734B7263626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 0c74b44138ba7e0a4750ce963a12bfff0e541bb3b0e60aa0c09c3d9bc36c6af5
MD5 b7a0747e165fc74345c59207c61a58d5
SHA1 3a62bf780f61e7bb7d7f677d23123b870d282d56
SHA512 9929ed717ab2c40e805a0e27db999b2240a6d78eb6c43c71ec009eedec68509bbddda832f986a3f383240d18a8280ea83803d4e19bbd9c2ea39baf0aa771a0d7
SSDEEP 12288:tW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tWyxknw4FYnshx8OfVe247
TLSH
T11565237CBBDE95D2E50D11734B7163626609B5E5EAB2811BCB7DB10EF1F0CA0A01E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 d217e89d33f2d9bbde0211d17ea78b153d440dd36e094be419504374d0450e02
MD5 60f54ce6692dc902d05f6348bd181e92
SHA1 13be32bbce032e4db3a54563db08f3e4fef4268d
SHA512 450d8b36d06f020ae82135f6d3c8ea6bc4fff4dbfc92a9c53a0eb2be053b7e0159558ae2619850e6a01e383adc06ac23a6fd4712525d2e1e7a3f61b72ea66e87
SSDEEP 12288:dA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dAyxknw4FYnshx8OfVe247
TLSH
T17265237CBBDEA5D2F50D11734B7263626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 791e008632895192a500e22444a2a49a8b03296e4f7b3127c057f723053483f0
MD5 a833e4dd88670116a114f1e89314a836
SHA1 28a588d11d7d98545a51188c66cdb459a85cb08e
SHA512 b95f63019e7d49fe43db19b4895cb8644c30619bf50e3ff6787e6e49bb9e888b01a0b447696fcd80f8542a48e30f847d850e432d116608896a8546dc09574267
SSDEEP 24576:kfwvJk9RX6wkyAIyyxknw4FYnshx8OfVe247:NMnYItx4x8EVep
TLSH
T13F95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b66ab229f4358666e7b23b923a095461bf37630a88e2b91a15920320e71413f6
MD5 deb6eb2c482bf9ebd93a8d5b095e6016
SHA1 f678d787adb3b13e3900f1a84b6e84d1c286cf71
SHA512 de30fc1868f14191bcffd695915dff2a5d04054237bc4cc8b41bfebd1fd085c97c84e6b92125c5304a777d5c3bc4e1e860e885b7bce181473b5f287af95dce98
SSDEEP 49152:4YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06x4x8EVep:GySzPiix8EVy
TLSH
T139066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 893ae631efdbe9b61e70aa13cd5d94c489022b82398c760db23faad45fe57426
MD5 90b7630f533380ce4733a33b3c8d97cd
SHA1 caae62abafb291c274b1dc581d27cc1be3bb0f84
SHA512 cb95f36559b14658468bc71ae6a894cedd2299ddddaa49f662085d992a547a76056fee312b496842cc0d830567bceeb46e368712bd575d235c98d59fdf993577
SSDEEP 24576:647Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY9yxknw4FYnshx8OfVe247:647JUQj1irIhCnDHUPfF/qx4x8EVep
TLSH
T16465AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 4df573a7938ca3f4be6fcca2175f619cd474bd19e6cd5b4dd2e772579105291d
MD5 4c027e1bcfa1e90a4258dccb93823dda
SHA1 eef97f594368d1d9a02e0303325cc33d79c91446
SHA512 cd01af9e6bc9202b90645c97798cba5f9e3a8a7f5c0880e87e43483aa1d00c4c72ff95a92cd1dd2f67626c1bbb13ed901e3ec97d763fe061bf7ad1991e4c1d0b
SSDEEP 12288:8+sfO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UOyxknw4FYnshx8OfVe247
TLSH
T15F75F028E29842E4D06E2236CB625641B3237C6597F1D3CB93D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 87339af687883d5f72efc571009f604f79a2f2ae166f3d47cf64795e1c17e651
MD5 548c4ba5ed778956425944ea4705fc10
SHA1 4ebeaf72a82db3782f24acda5e4db9cdd16e09e1
SHA512 266b0ba19800b8c951e6427d7a8cd6c045a6b9310225ee0ae2015b851b021a5c8785c7529d0b5e68a00e0c2be10de059e4890d41cc5b5177df8e9641b379017c
SSDEEP 12288:lzklU3fuGnsX8tGx/6supeHDSnNyDARMYf3VCfLZMKqd:lz8UPGP4LcHDSNyDARM+3OLZTqd
TLSH
T12C452941762BD74FC6A840325E32D2CCA7707D01EE45AF0773C99B3F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 34b17ce3adb0a7687e2e253032978876c6ced0a0ad6aaae446bcb8efbdd7dce3
MD5 811d32cee639bd4a9e5b5ebe8e40b6cd
SHA1 82bbdef13d573b8b7ea537210cfc91a01c194066
SHA512 4fa0cd2e8bbed58581ef5cbdb2302b2930a055c331880425720802a22449802b1893ef9a9194c58572e7336901c316eaa4377873be073fb334dd7e868cf36e5d
SSDEEP 6144:00dgu7zYDF+AbgtHCEJ0GZNHBvPSdkI/ZHZ1wQPVVhXhD9tMxKD9tMxqfW2utgzg:kOiEliphHFkQsv6S7
TLSH
T19665E941A537A38FC1BA6032073A5B4C7BB4EC16B7456E26B3C8153AD86A715B1F93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c9baba1cfccf0164f08eab24dd970b631c5af99cfd423b0fe875ef7d4ab5dc87
MD5 ab648964272b28fe78003581d6c9cff0
SHA1 00550691ce8f206a292316b7808121ca51aedbce
SHA512 662c513af4c5b0641d02883a1a02c15568c0ee3d15fe054c79ea16e1d8675fb5575eca871725e2fcfb48450d353c741dbae0e3d19f800edc9d21714ad6f611de
SSDEEP 12288:t47m+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Smyxknw4FYnshx8OfVe247
TLSH
T1C465237CA7DEA892F86D15730676A231320AB5B49B70C1DBD728B14EE0B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8a8e6fed1b42a9ac9f32f899198bbbe4a6d1ed787171f613ad3a7b5feaa006d4
MD5 dc59aca94a9d0814c2625a381cdb7cdf
SHA1 109337225fbb9d5c21319a05c7fd174c439c2df0
SHA512 374679f9e94cf75e98b11eb82c3d520b3b450ad8855d5d5ad6661ce45f400cbbe9184133bbcf33fca3898a3df1e3fe78769d41a800f72262f7a06b4ee12986b6
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYkyxknw4FYnshx8OfVe247:ngb4mBIBhGFox4x8EVep
TLSH
T12B65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 4e18b59c989c39c9cd41170c9f71e897c9c4d8c5ed383ca891cb10a052e46c98
MD5 e3f407910a1514f13db25685192bed86
SHA1 0628ac7be9ce97f3d930461a1911969dc72e922e
SHA512 6a33c9f935f90725cf116b878151b42defab5e48106ba96f94619fef7990b80ac3d573e7bb13bb77f7a10d56792552c785dd5b878263462fb21b7015acbe817c
SSDEEP 24576:6G88u8FpJqH1azria7/mNyxknw4FYnshx8OfVe247:B7ZFPqVla7/3x4x8EVep
TLSH
T11095F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6a77ca1f8943eb430baad88e5b2c7a8f6dc6e9423e88d8703fb1320934151b4e
MD5 1851c48888f2a9604dfdf3a2fe4bf7e8
SHA1 0194355bac29866e27e2343ef2072fd7223a370e
SHA512 820d89c988736df47d239abc7a9744d36113a76643bf29b5f06a61f8f6c91e1193f24d35e7ea1dd3becae2b28b5b82a637469861c54f2e92c885ada8d86d6d94
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMx4x8EVep:tG05lO43bFix8EVy
TLSH
T165D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 652d37c7f84ec922b55c3f630894825a08842a280f571047255d3a7d8d7d6f3b
MD5 21ba8bc695767a6081d341c032b0a94c
SHA1 383f870e6221e6ba2003883074622d84f8d36e77
SHA512 8293702ae19c5028bb791cfdce28a651c8876f6e82d691f36999e533da81ec510046b3d7ff60ba141bcedb2674aa187d813b8b9557663172c445081379ec8f1b
SSDEEP 24576:vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnPyxknw4FYnshx8OfVe247:Xa5POZ3+Jt2pasx2+mUx4x8EVep
TLSH
T12065AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 67b1f0fe365d25803edbc287ab7a8ef8cdd00afd3eecc55bd491e14bc72a447d
MD5 10091223e7f87c837a90bfd0e443605b
SHA1 a7d33cb6c906b34f08916cdca954741ed3d3128c
SHA512 3225d5dee2d2a1b7bb219b583dfaf14bda27062a31a5b9acc3fd8c71f71c4c348082a506dca1f36407e6167b56421a29e19bf829277e0393d0767971777fda3b
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkVyxknw4FYnshx8OfVe247:gNc/zEOVHFXx4x8EVep
TLSH
T1F8857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c0ce7a9788814f2b283f504bfd93ec993062dd135b64bff9646e971978888ef9
MD5 1775254847fbdbd3166b92d1426f128b
SHA1 67a558d7c801a085f6d5f862395e261b0289979e
SHA512 b52a355b466e249d6bbca4a9a6f1ae3ab5fac1c0f2dfdc4212a2db2cd1ce4a6cf8e280c8e7e15d4b504b2cb97572dbe09597af3d6e9110afcab28e56ed0a9146
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBmQyxknw4FYnshx8OfVe247:Q8MwBtOmTx4x8EVep
TLSH
T1D855AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 711e69345aa80e39b03732a6d9139926acc24659981fd7d96af677940c27a8a1
MD5 a578a7fb0b0ead6a5d59a233abc5ff48
SHA1 0011041442416ed3bd723b9859e5b5e2d535feb9
SHA512 ac2456d1f6e37ce041aa94ec71f48813abee1f5e7f612f903dfdc203c057bd645031651de05f7104a4565aabb322f03ca7be02bb1aa70ed4b25cb205df00c8a2
SSDEEP 12288:ZHvUrBFrEjwaQ5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZPUr+NQ5yxknw4FYnshx8OfVe247
TLSH
T14F75F12E22ED18E5E67AA17D89828319F771B4621711D2CF02E0917E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 6af816e9d2645b98ab6619495c46edcdb3211506587e261fb89a1b61376da4ed
MD5 6261da3bb7af3f467953f21699635167
SHA1 ac0cdd2778c0b66039d47c8c249076870e7c530c
SHA512 c59ef0611785c5913bcf1e37a8b0f43302b98d5505800c6af2453d9643fba2952071ab09a30b10cc34db46e7c0fe577ed6606d34a623316a7f5e6d98106a9489
SSDEEP 24576:FD3FHshBIYQgAayxknw4FYnshx8OfVe247:FDVHeBIAA1x4x8EVep
TLSH
T1D385E17DE79C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1560-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1560-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1560-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1560-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1560-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2180-77-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2180-71-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2180-69-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2180-297-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2328-56-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2328-54-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2328-42-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2328-50-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2328-44-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2440-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2440-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2440-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2440-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2440-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2944-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2944-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2944-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2944-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3260-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3260-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3260-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3260-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3260-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3304-312-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3304-87-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/3304-82-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/3304-81-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4064-116-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4064-118-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4064-315-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4064-125-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4192-43-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/4192-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4192-8-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/4192-0-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/5520-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5520-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5520-99-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5520-332-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5520-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5520-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5852-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5852-280-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5852-58-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5852-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5888-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5888-111-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5888-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5888-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5888-316-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5888-105-0x00000000006B0000-0x0000000000710000-memory.dmp

Download