f955ac01734ef6b4b8f9c7ae259c32ab5ce7f4a69bc23dc7aa77ddcd7727515a

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Size 13.0MB
Sample261024-l38jbshs2w
SHA256 f955ac01734ef6b4b8f9c7ae259c32ab5ce7f4a69bc23dc7aa77ddcd7727515a
MD5 69500938f2ae29e2f95d5401fe9ed125
SHA1 f2c87e3faea6920ca8a79ede226e96e4af509c80
SHA512 4cb1c889e45586bc5f8122da773113b25e3a456958ac02aa235669914023bf4f9edae460f57805ea2330c051f3c95d8ad6b40ba70a73b294ff107776b98d1d1f
SSDEEP 98304:q9fW1/nEVQ9GNRCMZ1ZABVdD74rjVOnJE84737JRLmOJTy:OW1/nGQMNeQrj2yHJRLZJ+
TLSH
T130D639257B4AD4EDC56AC0B097468A726E72B0DE0F35BAFB45C486383E249F41E3D784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3172	elevation_service.exe
936	elevation_service.exe
812	maintenanceservice.exe
6060	OSE.EXE
4680	PerceptionSimulationService.exe
1860	perfhost.exe
2948	ReFsDedupSvc.exe
1140	SensorDataService.exe
2808	ssh-agent.exe
1220	AgentService.exe
3864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\166f82fac17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2320-18-0x0000000140000000-0x0000000142583000-memory.dmp	upx
behavioral2/memory/2320-86-0x0000000140000000-0x0000000142583000-memory.dmp	upx
behavioral2/memory/2320-187-0x0000000140000000-0x0000000142583000-memory.dmp	upx
behavioral2/files/0x000100000000932b-128.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d00e92639f63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090e677249f63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da7753259f63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009da16b259f63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ef9d9229f63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2320	2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Token: SeTakeOwnershipPrivilege	3172	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1220	AgentService.exe
Token: 33	3864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3864	SearchIndexer.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3172	elevation_service.exe
Token: SeDebugPrivilege	936	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 6020	3864	SearchIndexer.exe	101
PID 3864 wrote to memory of 4308	3864	SearchIndexer.exe	102
PID 3864 wrote to memory of 3344	3864	SearchIndexer.exe	103
PID 3864 wrote to memory of 1256	3864	SearchIndexer.exe	104
PID 3864 wrote to memory of 3160	3864	SearchIndexer.exe	106
PID 3864 wrote to memory of 1824	3864	SearchIndexer.exe	107
PID 3864 wrote to memory of 948	3864	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1616 1612 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1648 1660 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1648 1660 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1616 1612 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c0c0e63eac249b882ebaa684bd7cae8b6c16a1817e09324b0c40e15f24fc25ce
MD5 564fe030e1fce33a1d4423143f1be632
SHA1 79c14d76a8181f293d36c648706dd0a9330f3d29
SHA512 2101de3f043eea7aaf2006f7ca454bdb6942e8b6cf7f41de637f4b3758df7aaba4fd3b232f24d92ab7b1f6f4ef15e116c23ac2053599f13f5a38588c5dc82a72
SSDEEP 49152:wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvQ/lFTjN4:a3q6HjBvLm
TLSH
T1A4D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b77fe44e6ae66110a083b1f2f7c8acffa3fadebafed1461f8ae11c08e63d3d15
MD5 acc0f316c812e7d8f72cac23c08427b6
SHA1 4a6841eeb48ca57bc6cac764d74023cce9decd53
SHA512 81e393ab9b8891b2322d7eeed3dbc21c2f7111e8e72b64a2ec46ce4c1ff5e7e5cc1e663bc8956c6b4fed95a2d9a9f450f2b18915873d2bb6f2369823ac602e63
SSDEEP 12288:N1XLsswWkxy2lRq2czAgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:jXYfDtczAAnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1DA65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ceb018cf8efc7244186627761bb410b36aa4beced8d16a3c405bf395a80eab8b
MD5 007010c798ed277abe0b41f88f40fd26
SHA1 83a7dc39bec569e485d15ad7a79e9ed188999c8f
SHA512 cd863a1df7a21e5519e1ca690e28a69cc1972bc77483ba424524a8e962696b683b4a1f640562ae9359f93f330595994bfe7c2e3ea3e438d52e00d27a6b77ad90
SSDEEP 24576:K0Le5ji0hmxLrM7nQ/tbw/2Mkjy6Fr7g0ok:KPji0AlGQ/lFTjN4
TLSH
T1D2859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 923511746acf1686a42971c60051dd38a69150e3a94b1b9756dc95fc330804f3
MD5 c0f89616b086cb37066f8cbcc16a9e14
SHA1 6fd8ade3237482e1fa8411362a3717bb68df8a71
SHA512 fa9fe0cf505d50277de0ebddfdaada3c59c3526a507c6f95628236998fa7db593967060a0515abbf3e981f5ac689108fdf9b84075917e870caaa4b825b40ed83
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyu5nQ/tbw/2Mkjy6Fr7g0oH:Y/ezSC6vUzPvxHjyaQ/lFTjN4
TLSH
T160755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 39470aaf9b8256b027ca9b1ed722bfd171fe8412c0ff8c09dfa0b5a649047f8b
MD5 d3e4ad21d28ed7b0e215d6fe974fc99d
SHA1 d9b28a5b186b013323d9f496f464b044a8037f1d
SHA512 2d088a3677a96a618508df3d19011080a24ade51b63a75112414d8d686c9124b4d7c82293fbdc9e9281fff6328272cdbb38ed8545d0c284a6c91609e9e4a814c
SSDEEP 24576:KVbqPb88hv/l+64nQ/tbw/2Mkjy6Fr7g0oK:KVO88hXl+/Q/lFTjN4
TLSH
T190559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fbfc8cc081610fbd998489d04f98d4d2ddb8a3514215db9b7e48fbbfe5b9c010
MD5 b01893659681323a65540dc963d7ea1b
SHA1 a1b487bdac57ed8aec5c93d5a6f3397fbf727fec
SHA512 6adce8eba33882d2952f3c2cb22fd09e89fa19ef1e3784c0bc46213f48c50f9e6a92988ea9e75a8cf945e4b6d17604d8399810b7e170341f924b6414307c916a
SSDEEP 12288:izHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:iznnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1D85523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f722a47a8132b83644352f8eaaf39a111e7044d0882c0ac5c843449426d40a07
MD5 074c0a9cad7363dd9e331af8ac1353ce
SHA1 7dfea22785dcb613366581a6c3c0e81f0897d207
SHA512 f43fa518b3d60cef845f7200c6166f9aae4ff53b488927574faae68a25a85d7a8e0b1cdafe46d73e346fe3f7c6caaad365dc46863ebe405e97b55dfdc2593156
SSDEEP 12288:NeBNUbTVO86UQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:NJIUwnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1F975CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 235db21821328efb92e61bddb9ab5bb4d783c1b57d6dfc20c7095ca976a74784
MD5 6cf33b8ca165882cfdd975d698f72db6
SHA1 2b6b4ca000d46c3e72dee85087a727e9c1836787
SHA512 4f08faff867af35227f1b89773a11090811ee9bcce1857d9a9505d4abf948ad72dc2f284bf443f9394946acd675e464fa1dda7adb62be57ab91c477405e36468
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:tQvGAdlCEL8c/yRNw5CeLm
TLSH
T10B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 039e1d32a0a4993764957d6e6d9be18bf939300f6400c4174aa5eb0c4969ff47
MD5 39f6972995ef9d1a4bbdbba3808af9c2
SHA1 360d06d09d4a4fd6c90c2fd528e808a9a701a06d
SHA512 39baa8722365b31274734a2cf2c3a6138e0130cd27f67702b1b0f18ed5b98fbca55d9c07b8970209ad294237b90ca3d38e74319ce5a7683b66e54c8679b46da1
SSDEEP 12288:2AwSfxL/2Dc39DLLmt0LDQewsAjWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:LQewsAj2nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1D975E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5638dc851eede7eef07a64c9f52213698b6a3a8106112f9d5298b4c44d51a3ab
MD5 cac1f0dafa1d8442939b84c70c22bf8a
SHA1 ed5bebe61e341850570a7c10295cc45a686c23ec
SHA512 9a618b19eaecda920034a6ed09528213c698175680accc33e72e5314ae8340ec2b623f59c5e23fe01a0a63268e0059103e710e52c6e3942bb7bf64d209bd68c6
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZL:LUEtQevvqc2W1cpV2EI32
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 31f7113ab65e3a1a993c9815e6a66f72b201fa037915e4f5758bf9f0ad01e876
MD5 83b8519dfd5e1261f4782775d80130f5
SHA1 146c94700f9cf61b1dc5f4a726e6896f1cb68afb
SHA512 2c395a4cc0dd6626d2a5e9f073f56f02dbe9fe031a42619a9583742d3bdfea86944332aa13ddc84ae5c8a1aeeaf1723a7f00106526c36e81c9352f959b9ef8f4
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zWQ/lFTjN4:ZoqtVjnmSLm
TLSH
T15DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 006defd1e1111f4852e1c03a3c1b28504d22cc8e1ff34ea9742e683fe1f6c5dd
MD5 2eadc05ab72f8b409f3de9221abf1f2e
SHA1 cc0d3d20d754b621314230378a07d2dfbddb6f96
SHA512 20f12a09fdefcac5dc2a133e2ee1dc13162a487e6ba0d39ee051318b570d13063e5088cb8cb041a2cafad6d7830c2392810983623bf1711cbc007e083726d9f9
SSDEEP 24576:ZAhGLJIFoiwtA5l7S539nQ/tbw/2Mkjy6Fr7g0oc:ZAMyFoiq5NQ/lFTjN4
TLSH
T11135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f602d09c4164b7107f1f134abfa76c79ca949e026e6ec20d37a1c03c4584aea3
MD5 05478767f9b479b7686168404b164b85
SHA1 6d626d4c872bf8f83c19961f4a90de67fa08e624
SHA512 900d757790d10269fa7d7aa5ec278c3662c55b0d19336f1d2c19a31d1fb88327c9be247721b0af05e6f31fc49f77a3f51c5fe35befcc2eca0ee36f888b59b4d1
SSDEEP 12288:Vmw5HEjsChN2BFgl0WDm+CVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMx:QwuHOWunQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1E565F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fb953aa53e3c080b98d4c0d14a7e4aea659ab4ac52f5d0f4c0372b300d6c054e
MD5 9555a3ffaa6430c915c98d7dc7e07f76
SHA1 7ca0a8b10ae6c00cbaeec97ae9b2d4a1d89bab99
SHA512 11a33d65e134ab53d7f4aca2737f37eab6e138e3dbf60d7e7ed4c339c0eb1ce873f1c8b2e74e165cc8238e4db254a37971b9e345e6b63a115888bdc4a123b2a3
SSDEEP 12288:nXZ1IyGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:XZuznQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1CE55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5191d5287403df40d7d8855280faa4c6f5381e658f196b6d754c0ff125fc057d
MD5 529007f3dbee164fb1b27b6777f20b77
SHA1 72a4713d219da668d5b3ad55cf65a35cad2a602e
SHA512 c9e520f04ba2bf66d0852c560bff986526f42f0de914ee0a2fd07cef8ea538580d19ac0d51de5c98177077888f32f994f0cdd645c236f055e6b75b06825e2c51
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:/QRQyi36YOcPQLvw2gAf+PN3nLm
TLSH
T172666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bda39a9fd985cc002733c37f581f4ac42ebad57f2292bfa0546c56763a697c98
MD5 3abaf7d17ad10ecfbc84a289c49c3023
SHA1 c4532f86c5388a88f4a3d093500c7553524f5c5b
SHA512 f9ab1628fa847a52ea9b96d34307f7937b344142affc932178aade8ddaa9c27c6e96b97610d8c5ff2d8a12d4fe3a6fcb200e807cb505c0a95c91b80d6b34a290
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:bQRQyi36YOcPQLvw2gAf+PN3nLm
TLSH
T1DA666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cc83fd56a45e6cf5f29c8a7f5466def195a6e359312d5506f2b4f5a2e5a77f73
MD5 21811cbd0d0f89d6bb9e55d18bb243d4
SHA1 84267bff0c243ca8a4d071ea04ac8acd90dcb212
SHA512 db4d4b81249bad3543c08c293001fb71e6b4eccedb88f21efd536ab0a752753c6f93f32ede3c3fb589a54766d79003db12d35460ac8230bf19844a0147908055
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DnQ/tbw/2Mkjy6P:768Qg55nhheWu7PNU3/GQ/lFTjN4
TLSH
T18CB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3160783f51439ff609a9219c236e532d684a3d06f3ebcc73e16eace4f42bd2ba
MD5 6800729412413326de6ed31ad0b0fc29
SHA1 3c2c8bfe284bc75ec8fec11e558bd2945ed31376
SHA512 06a03b41721f3ada587a561b29fab4ed5b844f46ee67dd2c71b59d362f55726d46efe1b337ba24cc9beb8b8c3d0c9ccd609e423a9ebcb26c9265b72c842fddd7
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk990:my5112gYy5azzVvL69nLKnhZMLm
TLSH
T11C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e00e000adc290fa125fe61f2a7cae8e2262c85ebf36b4025462a99ab53b0df20
MD5 4ea27b02351074477cee00fe52c0260f
SHA1 9bc234fc774ee19400f7b8bf5ac00e6ebc5849fd
SHA512 61323d9f05cc9ca5e88346ec207b94ca5b2839a4e2f3db2e574b8d1b8fd55336965cb7d0e816c18e8652929ce47ae6595b0cae74d13baef6d4552f201f065a45
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glQQ/lFTjN4:mu6JmVxd2djLm
TLSH
T12BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 020764e87fe255254ea11d043f32041deb4a4c005e4f52b8b93dd44ce32f0b4d
MD5 cc311c31e5548866b229651a1e60a29d
SHA1 4f1270b2d394be9c2d356f4c3b648dbfe97a591e
SHA512 e71a8e5581b203b696626c799b8b2e56232ff709f185bf42b9254d843cb45c703183fb31df637a9292edb527636784fcbbcb8dd1236786c64cc2f5052c964dc7
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xQQ/lFTjN4:ZmifPbRSLm
TLSH
T1E5B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ff2255db2f785ca52c2eef641ac789ee7f6b7ffb30f1d15f7987d7a6a18604dc
MD5 56930d0ce950b4c77b9a7316dc672f9b
SHA1 1a2b71c7843144b1993dc291d3f2647f2035861d
SHA512 8811fd0ebb81219024bd60e84c2c1151fc8808f7fe2492281d1b1734cb78d94951ff743e7a0ceb94880ac871744bec28809a2386932f35fa8dcca42586508450
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHqzQ/lFTjN4:k5dKTi61YLm
TLSH
T11FC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7a394986a8f8bac1741c3eb1736e44f07c82c78bccb49be95a239a9a7b137a21
MD5 10bf730ac0439d4251e7713312c1a578
SHA1 a2d26bfa53c737f1df73523df79e672d71aacc07
SHA512 565a995c67804f65bee4868160d55c2ac40090067c647c700a22db671742a28916c07c35d0691075c63fcc7873339c5561e87302072fbc16326cb43551c88b7f
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5w8Q/lFTjN4:iX2iyphWLm
TLSH
T1D595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 51183355a442eb74c4cf7aacd86794cff57bfd96e8882e50f180dd79e99e0f52
MD5 db2c78572ef3b8ebe22d00739ac32b70
SHA1 285b600d47d8e18e99c1037dbad65a76230b507a
SHA512 d36e2b2b17e9b4c23bdb723b90a81a51fa8fb134911bc814772e9b3d11b4275a3fd0d360fa934666b95093ba31e11b81059c35dfbbf386d2747cc25f2ebf06f1
SSDEEP 12288:sfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:s/nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1DB5523697964F98BFB1706F18C828182A73F0EC6BFD1938E77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 76ac8e24ca14dec8bbfd65cfb004922e69f0aa7c2ba5bebdeca148992c6766fc
MD5 3d14a2d11ef3337e0f51c0084eb06709
SHA1 b2f69de585baf7795b3a2320139a9d88e4950cfb
SHA512 92a71c2b5748bafe1a8cc6cfc7dc8f31fe2abe839a769aea1e418ade863f4d4670a2f05423ab04328af055d4dfa6d152d205b852e59dc06a298a61d207c4baca
SSDEEP 12288:yCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:yCnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1575523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7a60af95ad539fb26bf3fc42273e63dd5c930e8c50b856ed72c5425ec732c5e9
MD5 57871616771baf4b62641eef6baf1707
SHA1 17ba611059fc7a87b7e989d36ca5b477ecbc9eb8
SHA512 98bc0a3d0a384ad3121e2f648debea6f52b7cd4926dad4741c506d81f8680845a73b34a8c4d73e40172d68b4818328d4802a1299572de3851ed0d90e3d31c979
SSDEEP 12288:KIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:KInQ/tbw/2Mkjy6Fr7g0om
TLSH
T1DB5523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 927a89d80ded7f8b332d4a22a2737512c3abfcfa9c2eb8fa7ad3f64b3effe64b
MD5 e40b8bdcd8d167fef8d3de70bf192c81
SHA1 7a977eb1840870f4deccf1fe70d9ef8fe32c2cd3
SHA512 fb88827dc01399bcaef9e98fbf5cd5ca5510133b8ccdca1fc1cff2ad315e925937debb7d3e5ccda07b5e23d6bacfdc8fcb1e7a33dc17fc90c87eabc3d4f24bd5
SSDEEP 12288:tV9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:lnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1A85523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 882c4bb893997bf7b66e0f77e2e4870027c89a78f4f288eab4c6fb265427ffdf
MD5 5a0e0bea83ce78a594109ffd4260388e
SHA1 575c0c688cf9f87c1182a183453d0da659b1a08a
SHA512 fceeea8b273a1a4844e7acec684a6765da6f5a5e8297d518e89ec3348b89c8b0b57e414b224846b5bb10e38169444bffbb818dfc88df44b6c0db1a9f41de46de
SSDEEP 12288:9lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:9FnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T19D5523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e46ef277b9c8efe500576ecf3bbcc6f98ad7dcd147360297fc71fd00590fca37
MD5 e62484f96e2bc961f8d8f78c6665c7b8
SHA1 0f2837517f5038b7e856fed9ceb01ec2401e20dc
SHA512 9c9a39058823e3bf3bbc085abafceb3930d106bd6dae5b379eca95a4423d38246d58661973100ed97292ef0a2020baa88a5a190ad2294fc24f42f9725e1a6f60
SSDEEP 12288:DuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:DunQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1B05523697964F98BFB2B06F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cfda82d5a07e94b1a17d7349c092082355e68463f232720c710f297e3b8bf9a4
MD5 f3e0996ba8a07b1b8f44640824fabe00
SHA1 8dacc611f00dc5d6f4f77ec805aa7870b353423c
SHA512 5147c10eceab03b4f8bd1bd042dbdc4ada0caf0018131a75837e18b088136820b0694ad5968e1e5d41ab85216e454eb2065862ddf094f1729c46b78aa588f5f7
SSDEEP 12288:6KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:6KnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1345523797964F98BFB2B06F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 66f1d8a1a454a2e3a7e0c64d1ad1b6f9b25fdb92368cae77365d724dc95339cb
MD5 34a75a0a36905d6d922be960d18ab2d6
SHA1 c22cb879cbd26b330692e3d1ca1daa8317dc8fbb
SHA512 309680c8c95b6e3a40014687a04d79ffb62f87db581b2a341908aab6e86a9b73ffebb43e03953336a9978e0aeddd117b9fb63ac0c8b324eee4c60287096f34f7
SSDEEP 12288:riZwbDzzFEoS2cPvyiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:WZM3zFVSOinQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1F57501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e7b1d99cdb2c380fbf8cc5731a6cb2d497dfb45cae47204e1373452fdb6ef22d
MD5 8fb6bdff4f80b708bb486dc65e599088
SHA1 99313577fe70adc9f0f4e7e979f3309c913b1b60
SHA512 2ddb8085214aca36b6513bff50a2304d37b796887b133769c0bffa749778c93c2c83209b62670882667f90542447392686b319bfc8baab420676298bd8edd4a8
SSDEEP 12288:IzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:IjnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1275523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 13586cc8b8b040ed2835a203776e02fb9900e7a8a0f75e728011a5673d9b9a96
MD5 864f2a56e729266d2eb009fa34ee64ba
SHA1 e38c97c1094f68b8c6337cf4c31355172c27bfb8
SHA512 4b41027ca7feb77fe76fe8639b9cc3b96f0005717ae304a82d3fb771dba042936afa76ae995abc29cc19faa18104b01d3b63db35ffbc34c466e119dc07300409
SSDEEP 12288:W3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:WXnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1395523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e3d82a6677840c87e7c12227ae5495268147845992dbda1e55c504104d6a28c9
MD5 fb4364fc44e64bfcd8639cfc1bdc7c0d
SHA1 f8bb0405f264fa751682ee6a61a93202f83fa725
SHA512 e51fa3b3eabd20408abad7b695f8f4fa9ed8e3e7dae1d68410ecc65c4faf4a0fe70194ba9c4e45bf8af8bab813e22f4a2ad6052dc625c6ec163ee75ce89f6142
SSDEEP 12288:JyPz5L8GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:ozymnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1CD65021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 58a1c6dd49e549c824cefec23f3ed8429ec95eb0be0c249f2d13cb7451685f0a
MD5 6063246bad0ab38c5378fc1013ddd687
SHA1 1a55dc1178de4dded387e6f587feaa5f428ef0f6
SHA512 85e08e4e15b4dbbe220ae5d0a63ca2b8ee320ee58c09f741cade0ce851d0465723c9d56a371329a4164c612a8bc22a2d8ee9c18adfbfa25621cae1e6f42f4729
SSDEEP 12288:7zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:7jnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1765523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 db16559d0594acde16afc241420e9fe7c79816a6d72b9ec3d3a1b8cf7fb954c8
MD5 90de8f7adc2897efaacf896dc189eb59
SHA1 0797a5226b7a839d3d74e02e11b1b059c2d797b2
SHA512 2416884fd251c1c0d2da3094ab18207a2df046ab3228ec415dd455c4ffeeb0afb0f5ac2aea5292ea88133b5e42ab4f8ae7216daca047f2698428d48dc4765576
SSDEEP 12288:hzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:hjnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1D35523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4014110c3542297eaee734eaeef598866117e92013fe13c2bbfe16b33527d661
MD5 b3c73e32de11d006b925f63ce8244c71
SHA1 98a4addc0baba3a34dea1fa0798d6782fbc9d9b7
SHA512 f935b7ff11b981f7b4271393f741f0c968ad2108a17967d99afccce58ef50faf5f156dda85e8950a7e12c0ce35fd64e1103f7a82e606e63fb5bf6f5b327389a6
SSDEEP 12288:hyPz5L8GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:wzymnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1C165021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4b2a5584461b942f4ad213d956e27c0cc1f4a9e8f9700a32d761209c8799f0f7
MD5 918c7954a6085148d018b90b818f37ee
SHA1 1713d8a33a72a509765499d282b3dd0d42012b80
SHA512 dd7b0a9ad64d5260e43179715b022f8bea9c981d74e2eab44527494810c5d7017e21425fbbe5545d7830278e9e5f641d4be67a0101d1ca43365a35a12c549946
SSDEEP 24576:jT0aLl3z0zDYnQ/tbw/2Mkjy6Fr7g0oo:jTDLlj5Q/lFTjN4
TLSH
T14A7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 cb69bfa39a058dc4659b1e1012185e29a7989f5770e048de2edf14325f9b2da8
MD5 a04642b7e6d99183e7b432aa83ae8eed
SHA1 5a774dbeff88e32a69dbb153e54d4be99972ece9
SHA512 fe268dd7ad318fa939722414bc1d7dc2d14edf9880ee5d2b51125aff083246fb6ea21a977dfb067bfc5b7ce5732f8761c03b62edbf940d8b68f91f183731a990
SSDEEP 24576:031d9CHKy7GZUnQ/tbw/2Mkjy6Fr7g0oY:+1d9CHKyaeQ/lFTjN4
TLSH
T1C885CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6dead8f0c3f9fac46c85f323677a6f0f3fea66be375f7b2b7656c191e34cae03
MD5 275f5152b55d3dd620327df8bc4f9716
SHA1 6f3738442a285372b11bc227dc00a684959eeb29
SHA512 ee233841f432de5166e56389a04d4e9b732d458e1f1f7c6e0568c50a876f75c920de9e68deda98104a7505fcb7260f3e634ce3bd75b40a9bc00618cff9c6f2ae
SSDEEP 12288:hoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:honQ/tbw/2Mkjy6Fr7g0oI
TLSH
T15E5523697969F98BFB1706F14C8281829B3B0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 54efa4709590fb54dc0ebe2afafe4abfedc41d39f84f355165eabe4f91fe00e5
MD5 66a8db4e36f8415dbabebc74f3a5199d
SHA1 4def19f80110ed8d5dc6c7f4260456c271417f68
SHA512 3be6650bd272f50999d175ca0ce331c7fe800dbe1d8d138444db99c5bfe40c44638ee2e9795586ea73aa33297644f27a19f48575d255dd7a863bbfa47f006baf
SSDEEP 12288:imGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:iGnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1445523797964F99BFA2B06F14C8381829B3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e494e2ccbd52a4de4defb27e69cbf9dc49b306d0c557bffd9cf8dc848b961b87
MD5 888d3dc5c5ce4a246f3aa1399a27484d
SHA1 d322aea8f0b8b7f407fe918d2db336f933d48ae5
SHA512 59af4bbae786201c1003472e17b3e727a34a75637b25a72f807df94bb5d438e3060e7ede89938e397b2e0c631ba6a12e5607e6ce9bc19fcd3ef08725b43616c6
SSDEEP 12288:YRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:YhnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1FB5523697964F88BFB1706F14C8281829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 bd32ba88a080e8e03086c77e5a02313f31640a1303b7bfc1324af055dafee20b
MD5 037b9ab018c17333329b354456284411
SHA1 7a2fad6eddaee324a3894866765624e9d6dffd3b
SHA512 554b053d29ad05eac0f242f6e5556a8649b2011d8972fbf61a3e9c8ecccb4da8f718135afd885e7c5b49fd09ed8f195422a76ebc3df595346f648242abf9a1e8
SSDEEP 12288:wzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:wjnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T15A5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6c1ec9cee9c102c110b2cb9055a1683de2375cea12f64cff6b148e1bb4a4bca1
MD5 d82b43301ff13bb60fc55b8ac2dbad8d
SHA1 45f17b2eb0e141eb36bea38898cf3f896e12f63d
SHA512 96f3c6caa8452e97507e8f469d6441c888a10a961df6381e379944f3ecedf6ab0f53a0cc3f375e784b109dd5dd6b39b60243327958f3ff0f48bdf15956a5e229
SSDEEP 12288:AoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:AonQ/tbw/2Mkjy6Fr7g0oc
TLSH
T12E5523697925F98BFA1706F14C838182977B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3487dff9473601cb1c0b14a1892107f30e88f25476024fb786e3dbb8330aca36
MD5 4591623147422bc06b39d2b52f43aca2
SHA1 a5c85ac5590189836ed6f0634c56dbdc2566f474
SHA512 4b36713932168c5fe82d0af3ff6f4de19918edbcdd86fdb1a025ef31fc88dee9964061d9fcf66ce3c55c541d73e435eccace1917abf3b777c551b4be3b0a6611
SSDEEP 12288:ZbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:ZLnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1105523797964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 319c36366c7ff719dfcc41b71ce335384d59dc3c4f56d7b37135b7d9872a982b
MD5 da7b84670fa0aea586f023c8e2e91bda
SHA1 9522c9a110cb538934b796445e14c038dc1ae272
SHA512 cca947066d9fdb9a314186a95b832bf981a03aa8fe55fefa96fa962b51ea4a07049cb313d19f54d23dce81761855b8e923a5944c2a09f7a7a9c9615b8d6e0dfc
SSDEEP 24576:ufwv/k9RX6wkyAITnQ/tbw/2Mkjy6Fr7g0oM:lMnYITQ/lFTjN4
TLSH
T19785DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3141286782ee1b68ae390a11d8043e2f03d00a37d2a990d039f5ff0b32a3ceb4
MD5 f83ac994bfebd72423281dba495f146e
SHA1 fef4e37a02499a1ede41b8d3aa77b1d97382887f
SHA512 75528ae67285866cd78972e42619e405a982d1ba3f54af6f78354d3cc82433e8878d60d6a0cd849712fb7d494f4cc45df919e737f6bd2efe839b635cbb00eecf
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cQ/lFTjN4:BySzPHLm
TLSH
T18D066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 50efd5b6380d9af24230d5b83b2eb838ccb27d07a54f2387ec217cfe3da2a1b7
MD5 00bdbd9fd7d26b263aa42b707419eb00
SHA1 aace91468f841ba786b0bee3e79062a6c83acaaf
SHA512 7188a743c6d23d2eb69d65becd8948d172d8fd58f623cf35ac8a9a22d6ff8d54f58e988a85f76c709e882090e53cd7ec7f3b38fc1c44cec3366f99d2bd4eddee
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSnQ/tbw/2Mkjy6Fr7g0oX:o47JUQj1irIhCnDHUPfF/MQ/lFTjN4
TLSH
T19A65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dbd1aab7739b170abf2eec12446ffb6e926d344a91d3b4bcb2ec7d7d1c1decb6
MD5 378cb2611630e3e4a067e33e02eb49f9
SHA1 3d0afa50f66db2abe32c1e7b7178b9a3d05df663
SHA512 2065078b6f9ddbc432322eda38b2472624b11c7328bf9ffb8290753fb0912b5d043eed128b275c3aff3a7fd6c5041c4710cc95d34d654ee6cb9da97cd5ed765c
SSDEEP 12288:vssfDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:DznQ/tbw/2Mkjy6Fr7g0oX
TLSH
T12D65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 5d19042275b451bd29ccadd55f30df6cfb56479e92ba13de4351b768e668040d
MD5 31ba8966e709d4f7bd898d622f6e125a
SHA1 6c6561a1c21508939bdd7da1642081c846c7d18f
SHA512 6357d9c99e6f7e0d8245eee760982e74c8cf7d91172127a6e8850e4f214a18410bb73ff9e1551fe8f7b025eaa1d3d665a6d336132a9762e1e80c1e0e24c9d8b6
SSDEEP 6144:fsBC2naA5ye35jOFugyOotMxrccrU3fPkY0eoXTGmfk19IGzdJrIBVkin8jZ9rqh:AFCRU3fKpa8koE/rIwdZBqeJ37TzlIB
TLSH
T13A350711766ADB4FC66940321E33D5CCAB707D11EE046B0373C98B3FD576A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 1676436c629da8810d25522e4edcf93553c0345aca56e9cfe56649162a596b50
MD5 6b5486eaa1a0ff496ef5df80052cd4ba
SHA1 169e3fc31549d4415b35f531d30dce0170c95f59
SHA512 3b99509c5f4ed1b2a518439b12a3400fe51d4cca517a25d79751ca95eab96e3a92cd86c986abd102a64df9d1bcc7d08e977d8bf1502e69ef1b00603c39359b9e
SSDEEP 24576:QqQithkXB3JJgc+ZV8DLQfvOWBs52mHbfbGh21wHks552Kh2rwHtl9YN9DgGf:xhUZaXCfCh21wHr552Kh2rwHm
TLSH
T1BC45C7405437E6CFD1BA6032072A5B4C7BA4EC16B6496F26B3C9453AD86BB11B4F93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 144cc9f61af086bbe6ec0be35b69c84939aad872587f4dd2cf9aa1066d3ee45b
MD5 471bcbf9d34834980a981444b961ac32
SHA1 ae1a3300fdc5c8edfda6146747369f779d0a5046
SHA512 e533c8e785ca5dc3b3f519598a9aa3a9cf774e87615170390ae11ecf970138356a2126163e96fa4502449e113e744231c1ad2b35650844e698e6b4d41c9fbc80
SSDEEP 12288:K67XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:N3nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1BB5523696668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7cd279b503e2e9a7113f735b3b55caa1c1e59b18aca92e17cb5eb7d1b4983e38
MD5 afc29295ff3bce1665cb35ee1cf94e2e
SHA1 e1676b4faa7c97a0f65b778d6117e11f7adc1ca9
SHA512 644b4ae8248ce0ae6e9768e9947e30569db552028db22b8eb3ed7b9e0c1f758247b29b86cd771be5148499345b5b9f907126047c197e2e1de33ee6c928def4c7
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bY5nQ/tbw/2Mkjy6Fr7g0oM:Zgb4mBIBhGFSQ/lFTjN4
TLSH
T1CB65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 cf1a8edfa35071eeb057c3be250735e88ae95d7fbd2578b264c0ccd47ddac7c6
MD5 0edd3b8e88eae58a250aa79e6d1195a7
SHA1 4a60989f3c0fb994c838e1caebe8186b4ec96535
SHA512 8424c7d93bfc44459e8bfe6fc086a324b36145c6af0018e993cb47a1a78d374ac1b79b5b30bf3be9f52d2df24ab4bce6c52f4155eb05acef79b5ec976037d817
SSDEEP 24576:U8kNvNnaFeYhJNtmZBm0nQ/tbw/2Mkjy6Fr7g0oG:U8MwBtOm0Q/lFTjN4
TLSH
T11755AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6f92cdb0bea459583238c2d58293893d61cd7469f70a4cadbedf9979e889b571
MD5 7e9bff0755476b9e0b0c7807fe4f5936
SHA1 bf56deafdf9be9113ddafcd09efe9eeec52a86f2
SHA512 5ee0f624a1bd279cba5ce35854d2b745b1386fe87a660c70b2e5f8b862ed678b9323d20abdf08c6931ca73e4a12114c7e23d321cf8a5f63a5b18e0824bb507a5
SSDEEP 24576:zG88u8FpJqH1Qzria7/mmnQ/tbw/2Mkjy6Fr7g0oK:C7ZFPqVva7/NQ/lFTjN4
TLSH
T11985F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 33cc69853607d7de04b31d4a178b6569b94a6afc9ff110bf888bbb187876e6f4
MD5 e3fbce29726e0a30abb8fe830547f02d
SHA1 84d33b3f70fd130336737f8f4491d77ddd8a7948
SHA512 e464495983a6e21964cb976cca5f4713e35806beb49afafc3585b9de7e12d714a4718a28b883dca7e2d2c7cfde33c8d23ea2605c01942df7ecdd8cb4a963b82c
SSDEEP 12288:sHvUrBFrEjwaQyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:sPUr+NQynQ/tbw/2Mkjy6Fr7g0oG
TLSH
T18B65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 91537e35158fd3b17526135298288f835ca1ca4ecaea7043d656f159ac4903f0
MD5 dd87f2c93f8688feb046c2dc656d719a
SHA1 56d6955983b3d439617fde6ec22796f697d93f03
SHA512 e07e3cf09a452358bd84737cebc147f99f5cc7a42c5240639d0796f57ff1cbfa61ceb92ef612f1163751a651c6d8d24c146b192d4ff7558740393e1378382c20
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCQ/lFTjN4:hG05lO43bgLm
TLSH
T148D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e2f702179f23c455c317cbd67fb8399b9200ebc526b9a82711e6e7c992ae1355
MD5 3efd120f04e09b79cbd5fb3fc57ebd01
SHA1 2e049f5c12f4ef2ecda6678620fcccad66a556c7
SHA512 24a1349a65ac716543eade3c2c352ab7440cd38ff02b463550bc590112b587f5649192854f527bd84dea5a777dc086ea23da78f8e0c3fe82e96cd4b66189f62f
SSDEEP 24576:2fa5POZ3dpFWVM50JicR2hG0lasx2+47eidncnQ/tbw/2Mkjy6Fr7g0oQ:ua5POZ3+Jt2pasx2+mGQ/lFTjN4
TLSH
T18A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9187019901b15e0e25a03dbe78a438406dcb3e638b24436aefb9e10ac2010604
MD5 d39c3aa1277bf89cbebc25624bdabe6a
SHA1 f10739730188b68528be3efa599239c2c273e215
SHA512 1b4e59559eeba912a8e555db7f581ac1f5aad12ce8f72ff6c134872b23fb797e97dff97694cfcb8c1ce3532371ed3604a1aeaf0fad49fb11848772664523248a
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkOnQ/tbw/2Mkjy6Fr7g0ol:VNc/zEOVHFtQ/lFTjN4
TLSH
T155858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 0b2fc9ba805a8b9ecb6b6aa5e65b85e4c73cbf695bf42e2a9c554b645effc78a
MD5 ea5e89c8860e940fa5fd0fbd7af10345
SHA1 56a164e978c13014639d962a52a17daaeb8b3dad
SHA512 00d7ab7b0c25d3cf1a98f09bc1200a745f91753e1027c3ba0a8effbd86d010eaae60a9941be4ec9d7d8adcc6e13aeedddbefefae389aec17b9b6492bd522ad82
SSDEEP 24576:T6DIIaKngL2jdshRTdG1YxITqvfPkbIcbjLm:T6DIIarSj8RoTCCW
TLSH
T16D25125D63AA01F4D06BE13D96934506E5F2B2B487074ACF4AE4C5BD4EA3ED8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8f6ce87d79a350ec9755c6fac1ce3aac377545f353c49a2fc6d51e6363494468
MD5 28a6c6cb4b774c3ff0f3383c3666688a
SHA1 93976b6c5b9c6f199fe9f95f6d8787d23ae1e7ed
SHA512 e3aeadf0959db2edd5a08cd94418cd3ab7bc994fbdb5e3829087c80152a3a360357d7788879f17de4098dd15f778e8e0a9f60aa75b9eb1058fc9267616dae84f
SSDEEP 24576:wD3FHshBIYQgAbnQ/tbw/2Mkjy6Fr7g0o8:wDVHeBIAAbQ/lFTjN4
TLSH
T18475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/812-57-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/812-45-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/812-51-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/812-55-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/936-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/936-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/936-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/936-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1140-333-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1140-114-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1140-120-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1140-335-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1140-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1220-155-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1220-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1220-157-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1220-149-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1220-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1860-90-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1860-91-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1860-331-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1860-96-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/2320-187-0x0000000140000000-0x0000000142583000-memory.dmp

Download

memory/2320-6-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/2320-9-0x0000000002930000-0x00000000029B3000-memory.dmp

Download

memory/2320-15-0x0000000002930000-0x00000000029B3000-memory.dmp

Download

memory/2320-18-0x0000000140000000-0x0000000142583000-memory.dmp

Download

memory/2320-86-0x0000000140000000-0x0000000142583000-memory.dmp

Download

memory/2320-0-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/2320-124-0x0000000002930000-0x00000000029B3000-memory.dmp

Download

memory/2320-126-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/2808-336-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2808-137-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2808-143-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2808-135-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2948-107-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2948-101-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2948-349-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2948-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2948-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2948-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3172-29-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3172-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3172-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3172-28-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3172-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3344-348-0x000001BB1E6C0000-0x000001BB1ECE2000-memory.dmp

Download

memory/3344-412-0x000001BB1E6C0000-0x000001BB1ECE2000-memory.dmp

Download

memory/3864-171-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3864-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3864-337-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3864-164-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4680-75-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4680-81-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4680-327-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4680-88-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6060-59-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6060-60-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/6060-69-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/6060-302-0x0000000140000000-0x000000014017A000-memory.dmp

Download