stealc | 882af13f7942fae48bc2d213940f8900804ad6bf2d1e0034591faaef9ee63b8c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample261002-ee8e4agf26
SHA256 882af13f7942fae48bc2d213940f8900804ad6bf2d1e0034591faaef9ee63b8c
MD5 c0ec9eaed4cf3685c479f94deae882bd
SHA1 047d2cac9208e88f33671c80b5a460289e9b02f0
SHA512 3200aed5db102085c7b0479fe4c5d04a116684d212c4f1be26f640d6e5a6b950397e353834a353e3ba99a7e4ef384ae97013bd1a092262a12d88ecffeb10d63a
SSDEEP 49152:6tY4be4yHQp0+6N/zdzQiHZTTOtjDvdpiryXkp8oL+bzxGMzva6ZU6CENlc7dpJ3:6Va/rUtjp669CEN6rV
TLSH
T10FE57B5F52AD00E8D1AAE17C86468A0AE271F806C731A6DF16A4475A1F7B7F34F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/1244-49-0x0000000140000000-0x000000014030B000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
3496	elevation_service.exe
4316	elevation_service.exe
6060	maintenanceservice.exe
2512	OSE.EXE
832	PerceptionSimulationService.exe
5488	perfhost.exe
4812	ReFsDedupSvc.exe
2508	SensorDataService.exe
2864	ssh-agent.exe
4612	AgentService.exe
5580	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\57b40d2125f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e75263802152dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cc049822152dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e51fc1be2152dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b0a735802152dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
3496	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1244	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3496	elevation_service.exe
Token: SeBackupPrivilege	4812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4812	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4812	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4812	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4812	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4812	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4812	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4612	AgentService.exe
Token: 33	5580	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5580	SearchIndexer.exe
Token: SeDebugPrivilege	3496	elevation_service.exe
Token: SeDebugPrivilege	4316	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5580 wrote to memory of 828	5580	SearchIndexer.exe	103
PID 5580 wrote to memory of 2384	5580	SearchIndexer.exe	104
PID 5580 wrote to memory of 2072	5580	SearchIndexer.exe	105
PID 5580 wrote to memory of 4776	5580	SearchIndexer.exe	106
PID 5580 wrote to memory of 3872	5580	SearchIndexer.exe	110
PID 5580 wrote to memory of 5236	5580	SearchIndexer.exe	111
PID 5580 wrote to memory of 5532	5580	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6060

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2508

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 97bd5d257a540c83e8b685206e06a50427aaf8ac57172aa9f031e413b553f4e7
MD5 7f9009f770e2855dd192662d44f5f904
SHA1 fb9b910d3c5ad36a7e50e9d89737a7b0b3302630
SHA512 c23a600febef5fbdfb6c39bb0caec284b957677a421949ba0ee5dd2551cfb3802caebd1739810e9c2b82055f2e8b8e641be7b8436c98b8363a4d875b05dd0e42
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnz6ZU6CENlc7dpJLrQWd:l3q6HjBg69CEN6rV
TLSH
T17FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 86bd4ee04c37181f823a83739d31e34043ce48de3aedf6b1842e77fb1ec9677f
MD5 5e9cc51e98868fe45ab2b75720268c1f
SHA1 99fe0831bf3d1f845780d19b7840f5bb51622ffb
SHA512 404e3aa30208b38ba3c0c748b9afef5ccb7ea638baafe50f66f47b7faaacd1b3bd930b0d1b045d2235ba2b080ab306094f5c527fcbf0b3cca3f273a7555c6704
SSDEEP 24576:KXYfDtczA/+L6VMRCPU6CENltmVVdpx7fLrQWd:Rtc96ZU6CENlc7dpJLrQWd
TLSH
T11465F12867E408F5EDA7427CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a54c951e3c1b6d0c907c959e6382a64749f77880843d86bd96f2a544ba1a2884
MD5 61865700348afdf8388c432152008867
SHA1 36d77f0be9b5ba2ad3514c97dd3d95d978ee4d6c
SHA512 1444c71863fd5793d619f89e5a41a08725832d1986bf5ee2fa17b87791535c553987306d15570d2afe9a30eaec5d184b61db009a68304ca40f79a4376e3b0228
SSDEEP 24576:J0Le5ji0hmxirMI+L6VMRCPU6CENltmVVdpx7fLrQWd:JPji0Ac+6ZU6CENlc7dpJLrQWd
TLSH
T12C85AE25F6744731D073C0B9C5D2A69EED7230865B308ACB4286D77C2F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 94535af6ae171b15674b94cf8b62d850e63cdaadabb273fc6cc330c2ee7ef81d
MD5 bd56989a8827eb082032a0a26715d991
SHA1 9037d2ed100eafaf769b221f1037d83f09296451
SHA512 10f59d1983c0bd32a55d2781b3d6c1a447d0e10c83d2871789563990df843dae2c53aef31a3cc5a4d7f136cc253c0e5355398382eb4c550cfee81edad52720d9
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyuW+L6VMRCPU6CENltmVVdpx7fLrQWd:n/ezSC6vUzPvxHjyy6ZU6CENlc7dpJLL
TLSH
T17E755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ab4480042e2e15091fed1abd3c2fdd2650d10c5ae4d3f948f17f40788638fc2c
MD5 c6202075dc4ee3eb6dfe423ed2347bda
SHA1 cdd3d62b597725a317abc5ef9914a0e351543951
SHA512 34d4462ce1d5d4810aec511dbc641b1eee1101ac57f5bc234a207e4b8cd8079aee92244320778228b2e41b47fdf3ca05b664cfafe3aa417bb3b9c81e8b858ebd
SSDEEP 24576:eVbqPb88hv/l+6r+L6VMRCPU6CENltmVVdpx7fLrQWd:eVO88hXl+r6ZU6CENlc7dpJLrQWd
TLSH
T103559E66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 93122748c836951f66a71b6f6e714d005992d171cfab61939127d15363ef27b5
MD5 90c8ed07c802629ccd02c4f8641e7c3f
SHA1 142b44234f375ba4354de08144de332b6a1ff457
SHA512 ba862cde2e20e242b02143f038a1aac661156c326d7ed8438b6a683358880d9806fac54ca14d46d5bf86c8bc1f98ac77b9f84cb00ba56babe2cdf237cfc3753c
SSDEEP 12288:dRn8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7t:dR8+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B145233487682D52DBF80238E1E691F1AD6AACD55B00AD1EE2777D0F0D398B4DC5B22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 eb9d60eddb9752aad0f22b84d71fa523b86dae845b9175e0f64f13bd72cd73d1
MD5 767410d65fadfb51fcc345ebc774cf52
SHA1 400669fb1fb6c51f9ed36003822f5ce54938c71f
SHA512 aeaa23f40888dbeef4bae1aceacb03594ace49a7e01b822e3c49ef71b14f770ab9fcb4588c136a6cd3afaa62df4707de65ec230a27221476a8b6a6dc40363bad
SSDEEP 24576:rJIUD+L6VMRCPU6CENltmVVdpx7fLrQWd:rJIUg6ZU6CENlc7dpJLrQWd
TLSH
T19565CF3BEE28FCE2C27A4DB85A91C640E77278704F51A7CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 73c4cabf0b88a1bb6dd4f8ff1ef69e4d1f943550c893f7f2642c5de2b96d20ca
MD5 23681612322eec2aae3cd35ae9a62c9f
SHA1 6e76dc8793082ef87f8de7aa99fb121693df0eb3
SHA512 247e105b2fd4822a4089f914bc1ae509fab90499fd26f8d8c5f3fc417603ba20a08765e47282671cb88f78e77a3f6f64eed049cfd03cf06476ff2b44e52f348f
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:HQvGAdlCEL8c/yRNw5CV69CEN6rV
TLSH
T1C1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dbfede5fba90cb46971a93dc003db94cd83828903e5c8dbc6a037a4c6f470c8e
MD5 94ad39320508d388c55dc17ca2cab3e8
SHA1 d3971f196d2827049807921c3b4fe555b7963771
SHA512 53a7218a553c53c9b23fe1d6dea7f695d6fbc7d3eeb2255bb598e7f537e7419cee2a8f5be2a36362135b02df5e107ecf1f1f59ceae7ab10bbca089ff529ba539
SSDEEP 24576:zdewsAjp+L6VMRCPU6CENltmVVdpx7fLrQWd:RljO6ZU6CENlc7dpJLrQWd
TLSH
T13275E031FF74E432C3BB0DB61B36C716582DB9604B511AC3E3A89E9E49342D12776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8306feae2bf06628f7d0fdcaa043c74a886f134717cfe60b7cbbbaaf32eaa080
MD5 d9cec587e24ad102862865899e92c4a9
SHA1 554aba138435a6cd75d2ed0ce4dac40e5e61f01d
SHA512 23da8a474c223ee11bb31b36cc416a561a3c9ff00ddc9968eca1a09819dd1cf28a5cd8162353554af73d45144ebf439d27fd23a8eff5238dd9bdd0856e638a81
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmIm:jUEtQevvqc2W1cpV2EI32V
TLSH
T1C5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6ad8c8d4b2127fd70ca7c559070b2239a6684850b1cb2f06b182039ace05792b
MD5 b017878e3e699a8de9920c795909fc24
SHA1 5026f1581c100a5ab91c5a0128dcee6977df5856
SHA512 8f77adac4e75a44ce419ed7873315b964cf170e0d0dc58eb1f68a54bc60d5ee490f8dba947570e0560f00bbd022519d1123d61001dbde1f6076eb160479833e2
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zu6ZU6CENlc7dpJLrQWd:SoqtVjnm569CEN6rV
TLSH
T170D58E1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8c036a945ac05d52570ac1d0814f5128e855f3fa17e44c88882c7809c5496d47
MD5 5d81b245313ec083af69b20b22233535
SHA1 ac82a8cfb2f1db27b4e5a4c2202b113d6aafee9b
SHA512 b5418c887c12e2d041e90d83297329960a15655f388c3c87f3dc8eff28f7a289cdf6bdd6e74f201a332c5e44ffad70beb9f3d14307aa994afeb759ace04f54d0
SSDEEP 24576:XAhGLJIFoiwtA5l7S53i+L6VMRCPU6CENltmVVdpx7fLrQWd:XAMyFoiq5J6ZU6CENlc7dpJLrQWd
TLSH
T1B9359D81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 361d01ecbe3a12b5fc578d3521f6f6130fae1cd0ba099892123ff0921a5c1a10
MD5 55fa2a4aa6e912f546db199249222ae4
SHA1 bd91da6a373a983990ea1d1abc4b3e8c0424d4aa
SHA512 21cff67d99892ea25b66d8b244fe2193aac0e1b7624fafaa57e72760f2085336fd5845d2818f1a36a580791e2b08479deea197f72d2fb89c3bc056742c1f09c2
SSDEEP 24576:9wuoOW1+L6VMRCPU6CENltmVVdpx7fLrQWd:9wDOt6ZU6CENlc7dpJLrQWd
TLSH
T16165F14967A41CF9EAA74238C597C136F7F2BC422A21DB1F5360C65B5F37260AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0399f9c4138802ac0af4656f7c16ede7776adf4c2b02ff97abe221af26066f3e
MD5 c55601eef28696f1c103b9476046a52c
SHA1 32345b557e208f8ab84d0ccb720f64b42e09ea24
SHA512 c826f1d4ebf20616112814c8d37da4af190a0befaf95eaff2bbccc996e6f7b26fe28ff4f17f48aa2db27c485719d3e28e9a931084c03deb9071df288c93df21f
SSDEEP 24576:+ZuA+L6VMRCPU6CENltmVVdpx7fLrQWd:r6ZU6CENlc7dpJLrQWd
TLSH
T19555126913E834F2D2E6023CC9E29655E772BC96273147CF5236566E0F37AE45C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 56c62560764d4642d32fab7951c20e7f9085a3ed702524c69fbcb2f6cc406833
MD5 fc5282e150689e33b838383421cb1353
SHA1 5757690883e010552abd880f26f01360eaf93b42
SHA512 ca7a452a3e195931c998df141c7bf5ed5cec62689e882696eff0c25cf681abeabdb005c81757ad08cba1073944a14d70b913970d404585a59f8caba937b425d5
SSDEEP 98304:1QRQyi36YOcPQLvw2gAf+PN3069CEN6rV:MQyiKayX+PNkIm
TLSH
T18F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 60679f87049e21682b6de3056fdf25d57c6b4befd6d103f678bbc724575914a5
MD5 26512f37efdf393a96e67f208ab12121
SHA1 16fe00c1570aac5300d1559d9f72942597101420
SHA512 e29e72bec520a17753b6d588a05e64418fed21f7c8bc24bc1705b28ae1411672f354e4efbbfb99ba961623c893242fa269f03722c6f7f8dd36c8e96ac39f0c16
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN3069CEN6rV:NQyiKayX+PNkIm
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a9ab4ddfb2822dd17fe98bbef02911176b5f79e8e32cf303dbc330a6345bd11
MD5 3b1ec26c8330ac8be927ed9a33242be2
SHA1 9be1b976443538a01b0b0c2a093909b521ca0459
SHA512 9da2c7a9019e6f4ad72d83c1aae75cf36bc090e6ceb3f2837d7357c3ffcac48ac1dddc67283f5027d63ed5ef021e654e518427b197633f68074b130ab9f066fd
SSDEEP 49152:S68Qg55nhheWu7PNU3/+6ZU6CENlc7dpJLrQWd:QthWRc/+69CEN6rV
TLSH
T199B54933B2F60099C44DE1769F4A872196D27C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 00e4be5ee38aa2075a49a63c46b90518cbfdb961e1931e7ee70d289be311d8f3
MD5 a16b23c6382dc2b8f48f00f865958a74
SHA1 3c86f478701caddeae45fef9ac400746959caa90
SHA512 6d9c171bcdcb56f1022f3312354c0ae657b8b2e8f1017c52775b2b72f32d551065332854d08d1010cf429a1142d1dcefd3c077f8a607dce13f7dfdd1ece81c46
SSDEEP 98304:jy5112gYy5azzVvL69nLKnhZD69CEN6rV:+LIHmWhxIm
TLSH
T1A2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c86a437a436bb37ca26252342ddb196b408621ce73554e18a63ab70e55d75eb2
MD5 a1c40097f5bc2ecfc2c26b6d46dcd280
SHA1 f01bc43ecf3d5d76ec48bec3de854cf65d43cfb6
SHA512 25980009a945bc7b1524d7057bb28a168a1fb8ff1cc4de3065b5bbf539c5729bb2a694230e561d801cdee6010a9d42a2baa8eadc868ab856889998a9425ed54f
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glU6ZU6CENlc7dpJLrQWd:cu6JmVxd2dU69CEN6rV
TLSH
T1B1D59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 440cde0631ca25e5d77359444900f17f2012f916d575757b8f567a9cb176649e
MD5 af25c7afa39ddf946e041896cace01fd
SHA1 4a576896badff8c67e7952312faff10ecdadbb0f
SHA512 ab53c003d5ebbfce4d1401281e60f764a7e8d272d72b4a23c1675ded11b994d68b79eb5739b45a901eff445b0ffe18a8327901d1aeef27186b1ef7aab3a069bc
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xA6ZU6CENlc7dpJLrQWd:emifPbR569CEN6rV
TLSH
T105B5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 91bb8fe41eb5e5ad53ad2b7b26a2de1c24906fcc49270a04094a41f1c2568217
MD5 78302519ddcc97424529bb4fd4e708a5
SHA1 d69167d7175765bb9c07395f381f6c544271eb2d
SHA512 d36f9516c39ae93df5dc8c7a1ab5d28d4beb87e371fc2d83ebc6ce1a1b75651f19fee8d1edab1cf1a9b2e7f09cda1cde3914513c1dc252b3462934cfa7f707f2
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqf6ZU6CENlc7dpJLrQWd:e5dKTi61f69CEN6rV
TLSH
T137C5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 595b739ef9cb6b0ea33f0d5cbc398e350ee953c77a9efb1c5c2a448cfb640996
MD5 32cf2e17a9b0889ea8274eb27e6ba0f2
SHA1 30526d55210c121d20d2c533a70a96f4bd675781
SHA512 5d52c5fed18f7f30a92cd7d62f375367a006fcd7e45d548aa0f2b423d66cd9c328075026ef91d825557d2bab94e220f40dd6d34aa44e0b62b1e16fed1d0965a8
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wM6ZU6CENlc7dpJLrQWd:7X2iyphN69CEN6rV
TLSH
T1A995BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 52889e9628c66bf892f81464c193b1befda9e5df8b8848ef3d7e221ea75ef428
MD5 fa74d971fcaadb67aefd0c2ecee5d154
SHA1 a51544d857214932afa03a2d4f0ddfb15d6b2d1d
SHA512 8cdc4f6ca51401c1f3406c1f5616fa2eb25683077b3cc469f40fec246a140cca3f402fd4d6e88f94fa5e407692a0593a1e8fdd34347a6519b0ae36bbe19fd05d
SSDEEP 12288:df8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7n:d0+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14345233487AA1D53D7E40278D1A291F5A859BDDAAB005D1FB37B781F0E3A8B41C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9e748aa1716cb1fee97aa0507364d917b20d95e9ec1f19205fed519318ba281e
MD5 cf30661bb0f214d7f089a44138d17573
SHA1 ca82a5ad01f977487a8a4d0c387aa239f6ae5b1c
SHA512 8becff209f78c02f43875ffdfec8f5cab8f27ea02c93eaa1f04426b2e87b6571b1703852314e03fbd9125a36636ff70349b629d5b55ee895e996040691e18b21
SSDEEP 12288:Cu8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7E:C9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D145233487AA1D53D7E41278D1A291F5A859ADDB6B005D1FB37B780F0E398B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 08450df54fbfa4378643b523c7ea8e9af76686293565fa141f84eae4c01db00c
MD5 fcbe4faa29561011c31f1ae09cec9568
SHA1 b3523aa7e11aa0e84d790637ed62bf24340a01af
SHA512 f9ddaec9e2dbad3207cf29c2e9a5661f67684452e07181e9181cb7f4d52651602e8a88d02c396959832b07b4a3f139addd811c85e6ea106799a3d303da455674
SSDEEP 12288:f48+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7E:fb+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18445233487AA1D53D7E41278D1A291F5A859ADDB6B005D1FF36B780F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f0ebb43dfb1fd56150b978eedd3b582fc47f32a89a1068af26ef01b27cbf87a8
MD5 f4a600f74b4e583c8a025b432f2842c5
SHA1 c9a5a807d6d31ff0eb3f28b4e78933a5da18a721
SHA512 c6e5f4887769611c8b1445d0c098db35aacfb3b61be0ab00100804a8ba267668d0163e5615324a8e1cb9d6e6d2d154c32010bb55ac268f24417ba3b0bb873214
SSDEEP 12288:tVR8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7W:q+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17345233447A919D2DBF44278C5A291B1F975BCD6AB105F5FE322280F0E31AB46C3B728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d5ad6c3197f537fd603b6dfac1984f909cfbc53a8d31111398ff8757c385fed4
MD5 d0ed989e41bbafe87972b4255d5da94f
SHA1 cabefb876ebe2092eb9cd3e9636cfd175e0169bd
SHA512 63b358c3f7aa95855a9391593ee264b2bf654667e5ba000633028e6c0bfcbb5e38981aa5d9bb4bafded64da89d4b711ff911aa8f3803bd9c87af74df89d561f4
SSDEEP 12288:dZ8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7m:dK+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1C045233487AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B781F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 40a5b669e726e1dc4a6374ff071ef6b6cdf577477d5547f48a06c56a5143849a
MD5 6cf7a37c72d4cb44ce6cca0e60932b8d
SHA1 4ab117e945df2ba994bc75157c1cda7fa7e248b6
SHA512 9a5940beadbb464a46bedbebac1673cfc4d953e552175a8dbf60d0946b203f39146c76defaae329d0772b98324a3d61edf90f78f31f5b6069f949cdc5aa48fdc
SSDEEP 12288:h68+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7m:hh+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1A245233487AA1D53D7E41278D1A291F5A859BDDBAB005D1FB36B780F0E398B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 03e66e0a8d6a6a5f2b81de619ad3698005168c28b7bac96285f187539a97417c
MD5 9936fca407f5855cc67b63af450ca60e
SHA1 8cf1d610641b8bbbc15fd4dcfd11bc21481fa954
SHA512 5396384baf0396e952188467faf2fdf035ec0929000c36c87d773f2676f847a3a39491b7a65ff333a7909b5c698251001aead77dcbe114113ff16ca808d372e8
SSDEEP 12288:AW8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7O:Al+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1BD45233487AA1D52D7E40278D1A291F5A959BDDBAB005D1FF37BB80F0E398741C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7f63e92287d1e72f0fa786675a31c34433850ff07b7c4d8ae8b89a572b9560a4
MD5 6539ee0ad72916ee0c7a5930ca737745
SHA1 4b98307c3304774d8f9ccb05bb6844682ed0b262
SHA512 cbef95a9930392bafaa568da61625a60f71f6c45598b55f87acbe385fd1dc927f875d94bd41e567abae37c33b679a10cb47f06adbe92168771dd47954d8e3c82
SSDEEP 24576:5ZMSzFVSOd+L6VMRCPU6CENltmVVdpx7fLrQWd:5ZMSzfG6ZU6CENlc7dpJLrQWd
TLSH
T144650265B3901CF5EDA7423DC9658956D6B27C5A0B60CA1F13B5362B0F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6402b900699a8bcd500c351845e79645f28f9ca85233c80e0682a37883bab453
MD5 3244ab7d91e43a1b86c4e5ae27c2876f
SHA1 96924b1aade23af947dcc93f940ff5c3af444f35
SHA512 b5a33b24f01497244798f1ccccaba0b6b26e3fe53dde7a0e5d02f19196f31fbe6b94b8401b8c7b15a706461a0f31f58f3bb3ef68ec3089fa54b8fb6634518d85
SSDEEP 12288:yj8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7z:yQ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1C045233587AA1D52D7E40278D1A291F5AC59ADDB7B005D1FE36B780F0E398B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3a64c656fe6bda03e5b63d473d33c458de20f9b339e3dadf9737fa035da0eb77
MD5 d39db897440d6971a7de08ae1982a99d
SHA1 46f56b6440370623496e02d719ebe6e5180adeb6
SHA512 48facf79c31f6d4ae95ccd62d498b2d8f7a64d640f14698b7f82b15f5476dfad7840e48faa99f2d27364f7fa703c35757718339661e8feb26173cadf6a761dd0
SSDEEP 12288:KX8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7i:KM+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T15245233587AA1D52D7E40278D1A291F5A859BDDBAB005E1FE37B780F0E398B41C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b1dcedba740cdbecda37cbd1a529e40b3c3fc3e8c0a829f7f945ab9219f9f21e
MD5 579cd9d898f3a9ae1bd983f9fee3b962
SHA1 3255723d88984bef77a4a2d0cb22f8cebd073130
SHA512 8f42d1a1183e21d7cf0c2396f56aa7a7dabe83fcad9d41addd1ab1d9f1b33a1d8e177e431028e810363b1c148235a9973a88d6a6741ce07711919ba5cc70844e
SSDEEP 24576:hzy5+L6VMRCPU6CENltmVVdpx7fLrQWd:hN6ZU6CENlc7dpJLrQWd
TLSH
T14A55021763A530F5D2764238C8A21A52F776BC761B208EAF53A4563B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d5961336e8f6eca1f8dab5d9f736efee91c11c39974f0ccadb7cf0ddb2ef4ee3
MD5 1b91143d544d375b95d7c613f30dc669
SHA1 7232fcea0c32d76c7826aa6fd71f744c3f2f9c72
SHA512 8c5fdd7a3b1f69e36b1a792b4098a35f8bf238b79cae3cb6bde39e8b6cb2733b4a050afd9ad0bd1e643df2993682471cef7c5d9c3ac09bca265ead553f7819ed
SSDEEP 12288:aj8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7o:aQ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17145233587AA1D52D7E40278D1A291F5AC59ADDB6B005D1FE36B781F0E3A8B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a0ad8324b987b7c973a6b67af4c851402cf0203bafb07eed598ecec9b3a55e80
MD5 bb7811b645dd6d5dc335939bba064067
SHA1 a352eee99e070e883bc034af326902fd93d6dc07
SHA512 406c22e20ea76111d38b1a4b9628d1afd454331b4e90e7b51f116475945b391792ca66cc063097238cadef3d9827079b98600bc25213474f7a16d86ea1bd9bba
SSDEEP 12288:Zj8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7F:ZQ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1E145233587AA1D52D7E40278D1A291F5AC59BDDB6B005D1FE36B781F0E3A8B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 62fef9e40ae6edcd7bcc17f1c91d3b63718ee94f2569b62ba08ab2e7f4144a0b
MD5 9886fbe9209974eadbc679eae24b9eee
SHA1 bdc021e8e824d2e288cfae6b4f76f48893ecb68e
SHA512 6723997e941bc2959efcbb9594149ace4fcf18fa19587a28b1310005e8b4f07ce1fb292cfc6461138a89fa9414b2c131ac713d2c770c300e178482aea0eb52ff
SSDEEP 24576:hzy5+L6VMRCPU6CENltmVVdpx7fLrQWd:hN6ZU6CENlc7dpJLrQWd
TLSH
T17155021763A530F5D2764238C8A21A52F776BC761B208EAF5364563B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2ca78f1a3a659881eee48bb80af00c87d18786c39c990b4e2e55dac5e07fdd9d
MD5 72e11f5d8bfdcf26760568aa7a0f0149
SHA1 7e231b7499c27183c70adace77c06a6c96ceedf8
SHA512 0f508179e3acbfbd40b13d85c2a7924a86e33f42e201f82ee9809dda0e53da824128c3cd6df679f65718a94612401340c920609707cdf476d093026714a139c0
SSDEEP 24576:STHaLl3z0zDL+L6VMRCPU6CENltmVVdpx7fLrQWd:ST6LljF6ZU6CENlc7dpJLrQWd
TLSH
T18A650264B3901CF5DDA7413EC9668956D6B27C5A0B60CA1F13B9362B0F337A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 cde364f133a44b3fbfc0bac973826554fc915902ce159ca3f7423cb45f6f5e66
MD5 a54054af733f2ec14268fc648f601241
SHA1 1b193836c01c0d10c1bb2b86b0dc77236d864f9c
SHA512 679ffddc3116c0d871e2856e761d15af0e99e856c3dd58c02fefea17d0867f448edd6181885373c34301ce7dfbeeaa109e9e344a60ae8c19fc719f38e2e9dd4f
SSDEEP 24576:P37d9CHKy7GZP+L6VMRCPU6CENltmVVdpx7fLrQWd:f7d9CHKyaG6ZU6CENlc7dpJLrQWd
TLSH
T1D875CF90F3E414E4F1B79A35C9768511DAB67C9A1B31DE8F03A4251A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 22c43c2617d2f57f0945666e81554f80dbd02662ba05904abea2a9d10cf0faac
MD5 e6831e5f4501dd1ad8da901dd48d80e9
SHA1 46f71edca6d1269aa232a0bbf6041e5380e98c95
SHA512 58c3e7ada9f86aaf9d069ce5989bc3c4d60ad588972663942a82618d61c3ab7d43411cd09628fbf0a3af3becb080b8fdbb8d10c9d99c4099137ec60c9a1bafe8
SSDEEP 12288:hY8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7u:h7+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14545233487AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B781F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e3e7adc21296d6aab8675a287dffb38d6e14da4bdd7a5afc8cb943e427f84297
MD5 c376726aea00b8f2e84be53a7f864f1b
SHA1 bcd9d6ac8b2d74d123b8bde8cc545b075fed4fbc
SHA512 e1c681847086408b7dc7e2554ff5f482e76f3fdb6b1e2dcb0c37a96413378c1653e5f07f7d8282198b09cdfd97bee260563a1e4a9b0f98317638d9ce994cd613
SSDEEP 12288:Ky8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb79:KZ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1DB45233487A91DA3D7E40278D1A291F1A959BDDAAB005E1FF37B781F0E398745C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 630f91355d3ce33893b6d85a1fc1a1a1d33081d00a22d2ed37df8391e0706848
MD5 5ed6c16141470beba2621dcd8fce528f
SHA1 797f6b7ec7ad39ef542445927d70c109e1ed9b46
SHA512 f06e333e03f2a2e4327d8411ea4db3da23e87fbee1a05d12e0f22238e2fb43af00a954a32875492065dc0ee98d5eb3524185d62eb61a0701a28e25fbe28aabd7
SSDEEP 12288:Yl8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7R:Ye+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13745233487AA1D52D7E40278D1A291F5AC59BDDB6B405D1FE36B780F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7f4a361b07a02a24292fe78cf4bfde3c92b2c42277a5af5d7431f250adde70c7
MD5 45d0a76257564c170424306f5478d018
SHA1 fd81486acfbf2b1b8e43288a0844e343cc880454
SHA512 0b4ee29d2f8184f666314372fe08b1cb657d495c7c677ca7c7643a9b19e6cb97e4316f44d2802dc79b8d85484c40ade36ce6d54cdffee5bd7193a12d47dfe33e
SSDEEP 12288:Nj8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7S:NQ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17445233587AA1D52D7E40278D1A291F5AC59BDDB6B005E1FE36B780F0E398B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8f5086705113e7d48e3099405360d3440520bef6842dc5cb2104026ec2eb64d6
MD5 2fcb85f6dfc5f335056ecb50d5812e7a
SHA1 feb9518f42dcd8188c94dbf7aa29fbf92ce08161
SHA512 dbc2fc0bb5da72fda5ddcd1eb1ebe857ca527e5e8d1a32bc1f7c5361ff2d284b3794f61437f5d8d8dda5bdc8a96a40554ed2c13e6c1b51ccb309562c66f996dc
SSDEEP 12288:gY8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7m:g7+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19245233487AA1D53D7E40278D1A291F5A859ADDB6B005D1FF36B781F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5241136e8780be1700861ec417a4a57a2dc411b00d09f6ebb9c7483faee24e39
MD5 76f509e615daf7f828cd2a8e25c4896f
SHA1 f762a11a68916df26aa85707caf98ee30ffff1ad
SHA512 07952cd8ebe9c2c96a4279b5047c5c6a3a8a328f16a7b3a333192ba5537fa995194197afc0ea38560843667bfbc305c7e430067a93f0fc97b789e71deee19cad
SSDEEP 12288:cr8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:c4+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1EE4523348BAA1D52D7E40278D19291F1AC59ADDA6B415E1FF37B780F0E398781C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4b1700e678c4b9bd306c8936d49524f9eb1cbd345236921c88d27a2053522ccc
MD5 ffa244c7ce2356ddaee1744868dba8da
SHA1 cbe3d11d00cd3042c3c4ae607cbe0f3e5d24a3e0
SHA512 ab650ee608c1196e1ca2c6958d28f8935be1472413f19d5aa6bf257fdd0aa78762e6d44aa75a6a0366ebb9a5aa7812137a1e9820157e3f313b22277526423072
SSDEEP 12288:pZ8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7u:pK+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13745233487AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B781F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 daaf6a84c64508008a0e40580ab529b6e6fbd013127674b1d4eb740c5bb59b6a
MD5 c8aec8204cd9cfca12c7339bdf495e94
SHA1 2cbfb97cfa0670792e3026060f3305916f439469
SHA512 e0df6841d5fa8b87be2fd46b5d6442fcabdbc23e905a38e68e6c9e7ec0c84be3c8c42a1c8f3912bf62004f7b836fdf3241252a1d0ed25e2ab01804c8b1793bcf
SSDEEP 24576:Wfwvok9RX6wkyAIc+L6VMRCPU6CENltmVVdpx7fLrQWd:aMnYIj6ZU6CENlc7dpJLrQWd
TLSH
T12E85D029EBDC08E1E1B7923C99B3460AF6B178591B31C6CF125A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f67dd38395865a4d30c564fe3fd9cef0912391f6c911432cb42ed5751cce486c
MD5 9f3fd71d333e48cfca8ce5ee75278b31
SHA1 598b48b3ce100cd48c2e229a59d80b7aead0c101
SHA512 28313be78aec7a9d348a89cd46d064e695a4acd7e433a2b23f6b52ad72a2cb99b873facfddd4cc5579de61d6e92d97d1b99a2613dcd070c2af56e52860549990
SSDEEP 49152:3YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0s6ZU6CENlc7dT:TySzPU69CEN6rV
TLSH
T13F066C56A1A801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0dcdf27098a541b9b32fff240a37192e6ef40557286658aef793364c986971b4
MD5 5a8c764716a46ba2e81356cb8d62fada
SHA1 693d2ed3935972bfe8394ea8a6428c31f60cb70f
SHA512 bbb30ce3c667606a2739ddc5f2ea55901900cc4f262aaac3bf1eedc6c750fe3ce49b272c5701a90623d9c7860b60174db2c4b1da85533c1be6a758d9eabbfb99
SSDEEP 24576:O47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYt+L6VMRCPU6CENltmVVdpx7fLrQWd:O47JUQj1irIhCnDHUPfF/86ZU6CENlc5
TLSH
T11365AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 447731773dc4a8a24e8a19b61d824bc8a4045649594b9808023807a44f63213b
MD5 36c73cf092342784fda9dae849c201aa
SHA1 b7f2c892fac28770de933dba2573c48184e288b8
SHA512 4b5c2862ac69a4d3a995ecf6bb3ed421170d40d24c28e65d71a09b3df1048e83389bdd0e1d2735f9423a648feb94ce805de0fb8c9dfaa004752d052b86ee4af1
SSDEEP 12288:fNsfz8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7k:8A+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11B55F019C39802E5C1AE2278C7928691B7337CA597E1D7CB62D1F43E0F366A05DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 65f41bb276ad0d8b0a067edeefca5f10522473731d9ca1c789211fa738e6e7f6
MD5 a752d51d40d6cc7c041d0f4080458d9b
SHA1 e74da18d6ba8ab4c9948f15a85410ecf66cec307
SHA512 45059a862c218b841d1ebf7607a1e93727d59850824e5c0103252c33bb68009faa616c11422a9bb9c04d0bdd2dee6cb13483181575d15c93ce2e74a3e27a84ef
SSDEEP 12288:/cGuU3fTpyjpz8BCAd8anJd2EMUz8HQer4M7F+r38GWs:/cNUP9MIByaJfz8werpR+AGWs
TLSH
T1C7352810766ACB4FC66940322E33D2CDA7707D51EE05AF0773C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d81583f6a1bf6a4037b46fecc6c31f1461c21777f51a64470587e537e6a50010
MD5 80bc1db636eb3dad0008a93bea195f02
SHA1 4a90068abe7a6bcc86685fdd3cbc7f74914c2538
SHA512 e48db98ce71be45442a1f9ff9383f199913dc2df768b7c00e667e91ea644f1d2e62a8c0f123daf0acba95b66a60fb439fd63e988fdd59ee4559546467a60a346
SSDEEP 24576:+Aaka27a+Ia66ywO4rIKznjfzqUdy/vxUaaZF:+fj2u+X66zO4rIKznjfzqUdy/v2z
TLSH
T1F655E7416137A78FD1BA2171072A9B4CB7A4EC13B6095F27B3C9453AD82BB51B0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4e4ecfa4a7379f98d88b9c7bd92a1347188ef1de930c90bc6e81368550f69a79
MD5 6fe9d7eee83a31de7e424a4f1e6e618e
SHA1 caa7c333fa32e85b501c8113d7ae80154c1103ff
SHA512 2215e8b7c3a28132b024b2608d546f6e7f2433dde37783af1c5ea05326d2731031c8fa356d6fe42570a90b1735d5d1af88f53b6020846ca9947db98bda132370
SSDEEP 12288:SM778+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb79:vo+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1E445233187A92D12EBF8127890A69170691EBDEA5F0099DFF226750E0D39CE45C7B31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2c963946f2f60307c66272ab17c140e8ada72b6ec023de6e9a9d1636c485f4c3
MD5 133d66c229b4cc542e0f53243572de5e
SHA1 8f5ae601037b37dd063a021b1bccee6abd2f4fc7
SHA512 9bcdd07861ac9b1de8e13dc614e583cb3a0dffe3f298e2ccb225f8a04ef9ac15be2db99231a0c7abdea65d1ccf7942c056f50f8ae9813ad1383131a11ef95624
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYW+L6VMRCPU6CENltmVVdpx7fLrQWd:+gb4mBIBhGF66ZU6CENlc7dpJLrQWd
TLSH
T10565AE1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5dc36c4d3f67d4c860ef74825c767e38e08f1d260746f1c9538e3f874a8966df
MD5 cdc71ca73031fd06167179ee0092afe1
SHA1 0e55a989faceaefd4f01fd286ce8e5077fa4bc19
SHA512 79997f99c2c0b1cc3e69c89064361f6253595256cf00aa6fde049af844d404b1f14510d65ee5a061c99eadaf19fc17896b2e416426e9491937fd9fcf5b8a8add
SSDEEP 24576:lG88u8FpJqH1bzria7/md+L6VMRCPU6CENltmVVdpx7fLrQWd:I7ZFPqVea7/96ZU6CENlc7dpJLrQWd
TLSH
T10A85F16567E101F1D47BD13889824663F6B2B8251360EFDF07A88A561F33AE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8c293b6067e13c1bc18e16e2e4f9a693cf3b63396ac48eba0a2fbdb4fd3a02ea
MD5 03e7d821a2b103812c70a2d464d100ca
SHA1 6746d4e409c0516953b9fb89ca9fa96eca169e66
SHA512 af0d0839958d27650a0cb1c4b41105c3b79a7cf7914645e88c167f341df83b69bc54d4cd0b25c903e2228e3f3eea8f8170254d5c0095127604cd1ae3d9a4e2e3
SSDEEP 24576:0PUr+NQx+L6VMRCPU6CENltmVVdpx7fLrQWd:0JQG6ZU6CENlc7dpJLrQWd
TLSH
T1D765E12E63AD1CE5E676A17C85828619F771B862171196CF02E1817E0F37DE8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 540f10c5a32bc13be449e7b6fa0137e4d259f577606ac09c6f5062227a6bc06b
MD5 3a02e5f0d6b41ec90cf9e82c342fe790
SHA1 995fba8de35901b30318b3ca071d9aa6fdd476d4
SHA512 1691a21cf04c064b1bec1b72565fc58139f921b6889fac64bbf001b17e662386a8ba15824477f784b1d1e4ea7f9606ea77e50d7dc86a0e3c7f87ba07f31a043e
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj26ZU6CENlc7dpJLrf:HG05lO43b769CEN6rV
TLSH
T1F1D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6d688f14ac75dfa2cf1c4a318dc6c5add9c48020e2e67041057ddad71aea14b1
MD5 d5889c7594e190f9e2bdc72e7fd225c0
SHA1 9ea15040bcca931d900cfe9ec02734f6e56f65e0
SHA512 7a3570fbe727c4d09dc7ff17e68e1317be288c095ffb8df8898117bd3ec74390e402ec2841b7c1e21db3a005ae3b15fee531e49c9d610a6621a048efe3b8898a
SSDEEP 24576:vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3+L6VMRCPU6CENltmVVdpx7fLrQw:Xa5POZ3+Jt2pasx2+m+6ZU6CENlc7dp5
TLSH
T18765AE5EA7FC01D5D5B9D17CC583861AE5B1342653319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fb238d5581b1238576a83b1f83496b5b54504bd4bf5403dcc72ec5e05dd76598
MD5 49bb5609cdec22786ad1bbfdb4a9f028
SHA1 d670bc6ebf20a6878d7b5efedfb9a448a4d89217
SHA512 299b1f7483e0d07b631c7c7fd3eb2034b96a7c57ef278d735e69ce8640b6352b64cead73de5057fc14a44962487136a35320c46da02b0a50f0483d99c2f1b703
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkV+L6VMRCPU6CENltmVVdpx7fLrQWd:1Nc/zEOVHFd6ZU6CENlc7dpJLrQWd
TLSH
T1EF857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ed3d82a5edcc9e655e4b19502e6c354ae8df43e02a19c831cfb7419063b6aade
MD5 ed3f9708f9b389458dd729e8fe1e3375
SHA1 485a8b827d63bd8232c9825f5cec5bdbf872fb20
SHA512 91261ed28f3a9a739e9afa4717cb6fbd10b744d91f67ca3fe1a02c0dd355d0e5db5de270ef2cb66302b201d12df4186ce46290c285712da6c5c1811dfa1d5561
SSDEEP 24576:A8kNvNnaFeYhJNtmZBm7+L6VMRCPU6CENltmVVdpx7fLrQWd:A8MwBtOmI6ZU6CENlc7dpJLrQWd
TLSH
T11A55AF6EA7B806E4D1FAC6B4CD238512E6727461173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cda702e7e4a960dfef1ca21c18d6ef8b1ac3ea010db81a2b49d1f4c8d953bf5e
MD5 9b69be0570ff38fe7722801ba06e545a
SHA1 560d62c98f9e25335aed989b5e3274126c2a7649
SHA512 a4c5e8c7c7f62539990effa7a39236b86a1681a27e0c1310329480839299b0a13c8ec9bb2e6cf0a737af1a47bf653b0bafbc4f9318801f1f703bb33dee606e00
SSDEEP 24576:vD3FHshBIYQgAU+L6VMRCPU6CENltmVVdpx7fLrQWd:vDVHeBIAAL6ZU6CENlc7dpJLrQWd
TLSH
T1CD75E13DD79C04E4E57AD1BCD6638606E77138A903216ACB129481BA1F6BEE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-78-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/832-283-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/832-72-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/832-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1244-6-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/1244-7-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1244-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1244-49-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/1244-8-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2508-316-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2508-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2508-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2508-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2508-106-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2508-112-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2512-235-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2512-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2512-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2512-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2864-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2864-126-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2864-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2864-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3496-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3496-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3496-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3496-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3496-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4316-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4316-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4316-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4316-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4316-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4612-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4612-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4612-140-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4612-138-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4812-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4812-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4812-100-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4812-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4812-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4812-330-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5488-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5488-89-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/5488-84-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/5488-312-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5580-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5580-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5580-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5580-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6060-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6060-52-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/6060-43-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/6060-63-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/6060-67-0x0000000140000000-0x0000000140214000-memory.dmp

Download