24979f48b2f2009ba9fa9a449da74a21229f9f06a7063b92da46adbf166fe6cb

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 4.1MB
Sample261102-wct85afg53
SHA256 24979f48b2f2009ba9fa9a449da74a21229f9f06a7063b92da46adbf166fe6cb
MD5 f8b101ab08433a475281fc04052644dc
SHA1 984313dd7c9b8e3cf5224cb103202385481db5ff
SHA512 fe0945ac5f7f42a697fbf2bbcd8ab08d0562519d50349cd53393b7733035c3d00d26547721e269bc009abca23fd77a40b9701af8203f9b57ce97266e72d1215c
SSDEEP 49152:WM2Adq+iSBLecZGE78+vdhTCBaVGOGrJohW2AWBjlIyU1QqpN755XLNiXicJFFRI:WM3kcDGKjYOc517wRGpj3
TLSH
T12C166B1EB35841E8D5ABD5BD8A428506E271F801C73166CF26A4875E2FFB7E34E3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4588	elevation_service.exe
2752	elevation_service.exe
3968	maintenanceservice.exe
5368	OSE.EXE
4968	PerceptionSimulationService.exe
2008	perfhost.exe
2768	ReFsDedupSvc.exe
5724	SensorDataService.exe
2516	ssh-agent.exe
612	AgentService.exe
4316	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bbd5d3f4e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000956c8234f26add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000513e1435f26add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000226ea77af26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002ae7535f26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e10d837af26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000061cfdd34f26add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003242f233f26add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1624	2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4588	elevation_service.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2768	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	612	AgentService.exe
Token: 33	4316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4316	SearchIndexer.exe
Token: SeDebugPrivilege	4588	elevation_service.exe
Token: SeDebugPrivilege	2752	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 2164	4316	SearchIndexer.exe	104
PID 4316 wrote to memory of 4432	4316	SearchIndexer.exe	105
PID 4316 wrote to memory of 1396	4316	SearchIndexer.exe	106
PID 4316 wrote to memory of 1080	4316	SearchIndexer.exe	107
PID 4316 wrote to memory of 4756	4316	SearchIndexer.exe	109
PID 4316 wrote to memory of 6104	4316	SearchIndexer.exe	110
PID 4316 wrote to memory of 4664	4316	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f8b101ab08433a475281fc04052644dc_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2164
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d763622c8246bd9de8495e92bc4ea67b511d69ec1f74e1b571661102c5c48ef8
MD5 8fbe597efada24008088959793750573
SHA1 ec67f67b6da71a18bb61104b597a1fceadaa940a
SHA512 33521358abc9f0605835e74abc502c2b86c04d0a2640e327f7f043bf23fa7cd85dcccc21f0e7918029f7a9b729cd0211c40ea4ae601c02f010989cb8ce80af2c
SSDEEP 49152:5b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnnLNiXicJFFRGNzj3:P3q6mjB47wRGpj3
TLSH
T10FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9da065a4fdb6c4087097ec3bb7ee4ef85732d583e805299b935cd58bd7418591
MD5 9b7fb9480dbdee6e15bce32b1629a679
SHA1 9d7d17a0c1d63c2093e8a71da30043274641277d
SHA512 691272fccff7ae95977c31e635b70124f097f894578b5c82db2321c53d427b38789efac57c232730d159697760ded40c55c50a4e440885a1a3e316380574b8ca
SSDEEP 24576:cXYfDtczA0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:btc5LNiXicJFFRGNzj3
TLSH
T1F275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f02a6c8c932139048f607d9f66e7c397eb1a4d5d66424e40a4f4183df9e27d22
MD5 ec1b7d3b3f1e6e0eccb198f0701f28b8
SHA1 7376db5a69adf560020fe514c0e77291d6ed2df4
SHA512 0e1c2fc47bea6b9191a2b8e2604b2afe3496559a234d31cfb5ac13e22f47d5d4c69dde74a1bdf8120b93c2d8e068daf20407b57fbe7e22152e1e8f7c7029007c
SSDEEP 24576:W0Le5ji0hmxhrMV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WPji0Az0LNiXicJFFRGNzj3
TLSH
T13185AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1a4cc3b0e1d8e5c96d8c7226b0197ea6f4a2e4683523ec4afd32218b5698e0c1
MD5 52534ea5d4752e62b489805bb9a1e34f
SHA1 0c08d945042d28e2c5805a0a6afd0ddf5eb58edf
SHA512 c4ab123218d44eb5d3e3408d5924768195a32d5f35941f1ffee69e9d400f630ed49ec1d0939d260138760880e6198c9a53dca05ddd10a4913908ff4a50d7a0ac
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWj6q8wyuP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G/ezSC6vUzPv+HjyoLNiXicJFFRGNzj3
TLSH
T103756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 102c9c7e6db99e4fbdaae96a2d2e29c106a42abfd0aed49a955b7875778b2f89
MD5 604ab9276440cbd657548bcaf1b0dfe2
SHA1 21afefcd84b527da0691d88656704537cedcd7e0
SHA512 ecfa991644ce1ae887506e6a709c0f5cec4cdd3b0e960cb53cfa70d27d86b7f09b3eb4997ff9d2b5f5ece5b697ded4ea645f50f90575913c181efec0832315f5
SSDEEP 24576:CVbqPb88hv/l+By/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CVO88hXl+ULNiXicJFFRGNzj3
TLSH
T15C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9b698c43e95e883c69e35bbbd8519cfbbbae33eb1435d06db613c2af25665e0a
MD5 1b5dd945560eb6776f4a16e57039f322
SHA1 8380949ec2bf680170ca519aef03056f430190bf
SHA512 be3732d944a101d4e84c98068285e408c1677919ce1cb1c3a4c80860f104cb1d411cf2b03b3e891e2fe35e79f2efdbfdad73b0e6fc7f216c0dd32f9a4722c5f4
SSDEEP 24576:cGh/TwSfVcYG3K/cJHlnFR+IGNe8j3Ize:hLNiXicJFFRGNzj3
TLSH
T1D35523D3468854B1FBFD003A867A5828B5846E2C8A555DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a83b2fec33f8cd9a176947755dd97640d1db5a3af979aa44fc3af202edad41cb
MD5 00018e464a54f1554de8db4513db6c9a
SHA1 94a4bf76815d191614864319fa616f0dc0e17282
SHA512 5962fb3405e3777e098432728c2f2fb2d1069bbe6d85cea7d2072cace4ec8863c0850cb9cab8406d75df0121e2ea98550e4c93d890bc9f8cd76997282fd02975
SSDEEP 24576:rJIUq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rJIUqLNiXicJFFRGNzj3
TLSH
T14875CF7BEE28FCE2C27E4C7956518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3f4d5ba8dd0127ab8dd25ff69e9673eb360a1f3f133a3c174aeaf2bcbda99440
MD5 321f3950f85fc5de20a7aea9277cd19e
SHA1 55999412b00b432a2908fe652c70115e9d5b4e77
SHA512 420d509ba3257aea33193e2c0940e3185aec2df9bf149ed1f820981e893759ae99eab645080fc3a22ce72e503e9fc0fac4e6ab1be505c251d6781f3b54a77780
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THU:HQvGAdlCEL8c/WRNw5Cf7wRGpj3
TLSH
T184266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5930f4ae5bbf7fbff9d02f3468236399b595dcce2d04d5f0156fbe16f2e85c1d
MD5 bc076ca752c0433d81926085bd9b4fe4
SHA1 2386e3713be5fda83ef437d5e544d31ac52c56bd
SHA512 11d216f27acbc5f1e5e2b5d95acbd434f21e630357db38ac1cd76132d98afec211dc5b098272c5697d3b1629480c088a18d183ac13f6c280e79d5e016078cc1c
SSDEEP 24576:PfewsAjE/TwSfVcYG3K/cJHlnFR+IGNe8j3Izi:XljELNiXicJFFRGNzj3
TLSH
T1ED75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cb008b45a8bc1c63928c12ea24b8034d4f19cd06a29d2de7dab721e98f73f455
MD5 c67b2e73966e91dbe8befaa21f9188a6
SHA1 807ce27b4411f4933916a7a0f952453160529936
SHA512 3a9984e8dbb7e40fb2a3dcedb683222b57362a3894d8b5d33c60ec548bba2af06df29d72f9d42993d5f8a5188797d8a444938873b8cdd9689cb43d96bb51eae6
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHIF9:PUEtQevvqc2W1cpV20I3289
TLSH
T142474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3071f9680265c4ee2336ce180a4f207001b5a10a1b8ce5007c6545d27d53c4e9
MD5 844cf4a7d07d1756da2416866b4c098f
SHA1 623914472918d77b5697b3cc3fc40b0e036d52f9
SHA512 c9775213970ea4a71f966820f7d18c110b8268177073f4d4ba1acfc1b1e314ebfba2c7a1957002368a9ffb719bab345c0968b2abe08391d0b2b7665ed9c85378
SSDEEP 49152:5CbRquA/m2yL5zLfFiV+XenmE3/zkLNiXicJFFRGNzj3:Woq2Vjnmj7wRGpj3
TLSH
T1A3D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a6809c0a423b397acf73d28707d62d5a4b68b52b3d359baf8798c04867c94e96
MD5 2781bec77eb03347c15b8bfa9c1ef7d1
SHA1 4d6c428074367bfc3ca4ef852d1b01a804ee150e
SHA512 52a6708c9928b631fc0eb42fd5be944e1442fb95a902257f1d0a1fa07aa46052b8be2c6ffd29542f67933148278a39229200bf45fa0eeb0de96cd532dbd04616
SSDEEP 24576:4AhGL6IFoiwtA5l7S53D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4AM5Foiq5zLNiXicJFFRGNzj3
TLSH
T1A7359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 8a2a165781cf1b031c195eb7fa15b08c8b868aae5101234f87b5eb3b2ce55704
MD5 fc1aa7740717589866bea5e15fa34598
SHA1 913ddcd56057ed10446f6a51e797e86573eb3a2b
SHA512 6ff900f6ae39f612342956d1b7b58307470f26e3a40c1abd244c0505b69425378316625004f1613c1261444219a1efc4f916d9a02a7f84934361a5d78d3646a0
SSDEEP 24576:xwuROWI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwSOnLNiXicJFFRGNzj3
TLSH
T12765F18632940CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0d935fa9bb6d9fa01d418523f745bb92475c9c406df8f98521f39c0ff510b00c
MD5 95fec01b5c9d8380cf2b9cce5f643544
SHA1 52fc2280190ceb5c55b5301ab355fad7c312d715
SHA512 862322ca518ff07fede7e2dfd55166e4f463e5f4c24d42aad243c0dab181ce723699f5e91330d02d75f52bc5ead21d20c8e1ce253cf4feeaef02d7c86340a018
SSDEEP 24576:KZut/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FLNiXicJFFRGNzj3
TLSH
T1F655129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 47796064c0df91b31473d59a5db30f8f8940b900baea463a8c5e9ad982885c6b
MD5 1a3a95ea10a5690921f6f962129c5be8
SHA1 be3876efef00f7f7da4ee070184e38c3132b181e
SHA512 b44f95888ad8280233794749e2237fe6fe1b6581c17af0fc780d25bdd7ee53d4a0269a14995dd197da6f3e91bd95eb351b58b8e661081cf8f62014b07dfed90c
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3u7wRGpj3:IQyiKanX+PNSF9
TLSH
T10F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 829e0927fa17c5ec0fa43fa02f045edc08faa689d154f2a5820ec5c8b0af5ced
MD5 e75b28f83085727f4412935e5f0fbd5c
SHA1 6e14b505994b340fe0c83a31d961c64cf7a8d86c
SHA512 187b2180ae106918251e2f868babed131ad46adc1e13be9abe7a8be0252b28316726b1206d69fb3ba8ef61f9f586f362379693ea08a7eeaf37803cd330f4d5b9
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3u7wRGpj3:OQyiKanX+PNSF9
TLSH
T1F7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0579f86e161200141fc0e21df16c50aff4e0bde2527bcb1b8a2cbc981b60a20e
MD5 618086dc709209f466f84c5949fd41ae
SHA1 e6804661647a28e4f222c3db3a37e142442f863a
SHA512 8e4c3a0f4914f61a50ff920835dd939ed1ea64054f9aec31bf6d7c01d2f02eece99c0883a32ca067bbc7e44f9bc43d53ca6c07d8ea670c22915b101452145531
SSDEEP 49152:C68Qg55nhkeWu7PNU3/0LNiXicJFFRGNzj3:AthTRc/07wRGpj3
TLSH
T11AB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7f035307f5c586329b80ff94f0411678477e2d66011abfc26f7451d0545be4a2
MD5 af58a119fb4693dcd9d04b4a3b07c390
SHA1 d31a83755e196a57b089e3a0989c65abf21a2c71
SHA512 faa94c5e09d691e9a9a5c7e2f2e4baf4d7a3cb1dd6227587c61bfc4516b92dc447895fc086f0ac0062b3b213330dabb300767ac8f748ef303a0722dd945bff7f
SSDEEP 98304:Ky5112gYy5azzVvU69nLKnhZh7wRGpj3:zLIHRWhvF9
TLSH
T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 13684473a2df28d9d47d3b4ba47ed27d73d4f5d3370786f5a504ca47b3debcd3
MD5 8d81212290839a3d7f02c3260ebda4c6
SHA1 e234057562c14a3d05ca98db82600596cbaf2cdc
SHA512 b50e123535ea451464865c24acc252b1cd53aea356db6d46af3f729fdef37bada329f6fa900a42fb89af29bf9bb73bd919ba828b3a909d489039234bdd229de3
SSDEEP 49152:0B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glELNiXicJFFRGNzj3:uu6JmIxd2dE7wRGpj3
TLSH
T148D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d083166f7be8f8ee9bce3ef2aee86a8d0504f5c9b62205f4657de31a09c61527
MD5 047768048bdb858f33506173302910bc
SHA1 89fa4daf67839e1290da35374003b52a5023a3a1
SHA512 a38652cf01deab8c4f6dee29d22698d08bd835ff34b5de1f062fb4624b5dd2cd07438c74b1c02175589110edb097561f03739cf9f06b151c2213526b98773dd6
SSDEEP 49152:w1hpsNoJpF1A67U44CwH7R4xKLNiXicJFFRGNzj3:wmifPqRj7wRGpj3
TLSH
T16CB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bdaa1c831c61fc737d910c81d92d1239e1e68de72319bf4f5259545e766588c2
MD5 6bbcd7b685688bbc2d872d6ecadfe536
SHA1 0a62a7e7349e74cc441f56471a8a35c175adacbe
SHA512 e069a0a91da2564f513dbaa3f0c3a2a791aaeb8f8b5272e41f910e6405f1fbd1e07ccd76ae2f7b388513429cf3bdb4cae6976b5280fcb52b1cc019f030093fae
SSDEEP 49152:USuZQIY0Be2KkRVtOnks6NMHqtLNiXicJFFRGNzj3:G5dKqi61t7wRGpj3
TLSH
T164C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9b4712f2f33216d9157ca7add9d46a13054ffd3ef00de276476e652c9a9319fc
MD5 0ee815a167df3657fed4f2e9212c2d26
SHA1 5402d7a239d6134954501b3b8020421065fd9a10
SHA512 e9aec0d31739419ea24fca3ee99fd442092a1fe5639b903fe3aeb411a88a9c5ef7a11eb04b791e5c4a8df06c320d70111e2b4b8e3781584f819328e56bd6da39
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wWLNiXicJFFRGNzj3:FX2iWphH7wRGpj3
TLSH
T1C795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9b07a157926fe33bcd0b4773d54f00a350a825945b9d1e2423b907a782be4c91
MD5 5cbe70b7344c599b10f24b4df766917f
SHA1 374092a97c63eb5e65a094e4bbf9706a71487b66
SHA512 40bee718c6c0bb850bd41080333c54098f3fa090ce9f6155e2b0a0f4de9e36fa8432f95c5058a0796cc954dbefccb81028831506aade9182917779e1be1ca957
SSDEEP 12288:21iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3558955B1FBFC003AC6754428F5882E2DDB5619E3E348391EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 472353664165aa402bd924a4a099b8bbb357776c8eb2beb4683ffd0923b5c92a
MD5 c98a0a6221b09c4d15f136a27cd784da
SHA1 37ee28ab37298351629ecec8bc5bbde33132dabe
SHA512 4183b4f8954ada7ef19f8efe27d2d2ec5dd8c0d241d3627bba6615bf64c8bd8c7cd3f04e0a35a92527b38a141bdc146a183273434f0a57c05e0b8f18f44fd6ac
SSDEEP 12288:rGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3558955B1EBBC003AC6754428F5882E2DDB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 730b201d22bfba226b66df40bb4f274efc788d71b5516c900cbc90beb40c4d6f
MD5 3a4f4a8de376cfbcc7466f3a04153baa
SHA1 11c4a7b4e6b50b959a63130ce72701fc418153c8
SHA512 d670ba723d1afd0327b3b9ff210fe09142054cd905c727981c94a47f8a685d682e623f9c6245a39531cf96d6255a8f934c18d8891c02e4d03186e6ecf9628d98
SSDEEP 12288:CwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ci/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BE5523D3558955B1EAFC003AC6764428F5881E2DDB5619E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1b7e906b6a4473b61be127a0137e6b9d6d00641874251ad18e8ec9e12b0edb2a
MD5 7cd01c9af8024b00d8653d7033cce29c
SHA1 a7684f9a58e921e743d170e01a957c7dbde0d171
SHA512 398b47d31014af2f948f97a94c508a13dfac97fc2636e1635cdff4e18212bd4dd86f33c14ff80bc4db9d9f735c3a2dac2e3695b33b9b7bf13c0d356f354368b2
SSDEEP 12288:0VXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13C552392168901F1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5A35FDADF38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8b460f074dbc03093acc971079c49e4b9eb5fd1a7e94bab52a7f351be5cf1dc2
MD5 1b8bae009e23b1a6e4e2a03fab7ad33d
SHA1 c307350d6669684e17c712f548656da0be9a4edf
SHA512 e6e8434cd33ebed2b6cf72e1f5cf6d7e6f03a29e57e64e5a2546810284d7a6f52aec09b94772d8f54d207267bf8ff8085d444f1b28259ed5804bfbfbee924aaa
SSDEEP 12288:afiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ar/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17B5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c8db641d67082578449151d4fb8509be7e23f704c374cc0408bb90c3c3074efc
MD5 5e1be73f34798a8cf0e8709f55f78dfe
SHA1 2be672c80df3d0965602a81652360db19df89c75
SHA512 94da2a7ee89d8e955905fa03927af3ceefb5737a08b3cc3565ca3197b8c16c21968b0dc29d5d48af236b655afe6368faa7f840a7b62775a3ca62f8766ebc474f
SSDEEP 12288:T6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3558955B1EABC003AC6754428F5882E2DDB5619E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4857c9f2ad78742656a0d9e3e0ba1687a72c004faea38bff99c00ea6841f1e00
MD5 f51abeb510712523acd6b5c7f986d350
SHA1 9672e4dd5153cf3879ec0705f91db67accbdda6b
SHA512 7c8eea94f49f774534fc5c46669d650573f73d35cb4db8198130e633504c85673cea0f5beb6caa43f20f45631d64a1dfe212b902faa6d5297af2fa53a6aaa9de
SSDEEP 12288:tOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3558955B1EBBC003A86754428F5882E2DDB5619E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 26015de2cac140745c96ed392c5886712e32e95569a58bfd52df5e56e3fa2d13
MD5 4f945c38d062ce2cfed0bea1ff40c85b
SHA1 22e1e8a9cd4f3ec1821354a3f4cc76859c801149
SHA512 17a4de920fa3d411037e90273dc0b7e5956e5a797a6dab78dde12980c06819eef50555f96e09e337fa5856d4db493045f818956d32707096dc706e2af4b25644
SSDEEP 24576:FZM3zFVSOQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FZM3zfsLNiXicJFFRGNzj3
TLSH
T129750295B39018F4EDB7813EC9258815E2B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fc1dfc7545f736b8aec06c46333803de7d7a077a82dedb59daac7f859aa24b4d
MD5 7eb5a0010f2160635910fa9a2b682d52
SHA1 20ae3b4406a730a0446645e7b7768ab7f1bbda13
SHA512 fb78fb9c687fe1af0cf8845496dc4cf6934a85140c1f58ee535c94dc539d82b6eed088ed885b9f50a36467ae8d0fc50ac77e850e82c4f1d60121ff46edd8c8fa
SSDEEP 12288:2xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:29/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D3558955B1FBFC0039C6754428F5881E2DEB5619E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ae16a218868dcdafd5d9fcb11174ca12934fc2a7beb51643be7f3f04cdb00135
MD5 c9b4489032489de34f2ba6f23f69ef93
SHA1 a1319215e35b1dd076b97c3e9ccae474e9700868
SHA512 c3892dc0a6c0fcb519752077871c6d47ed0ad0688e8e8d2f0b93f99656f5fa005e5cdd3adbf5af168ec90359074ceb424158d2aae2b934280b11aa5c598efd74
SSDEEP 12288:3tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2622401200133400ae7f84a7999063a6d4722ef53b6fe4a0e02b584655a03276
MD5 8e25c4f580e741a6e3ec73aa12a1e01b
SHA1 97b461b9276cb7bed392884ac5ed3b7a9e8660c8
SHA512 3fe0348bb5e5672ebb0e6073c0a7e520af86233c1270b5437ee901a1234bc38eb0bd4c50b7cf9fece2731fd922279c7d23f6e0c6643f8fc14a9a802be2a3b351
SSDEEP 24576:FzyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FHLNiXicJFFRGNzj3
TLSH
T125650247729530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a04d5eaf9e52722789a18c608e037469e677b17606b862e72492232200b9b67f
MD5 4b0cdfb453602eff78fb5a86ea37462b
SHA1 ce3dd49b30a26da783af76894bb1f77e6064527a
SHA512 09aeafd5b4dd244a929e8682056a29f27374098c79a34440aecec184525439ed7417a2ef7150218bcc9b6f9f1a0c5c3b3744516b2acbeff5efbf38c34e2e7e53
SSDEEP 12288:XxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1445523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d45e73bf6eb9ec72ae4d4a3233da36c5e6280aa731b9fd5a8b9942caf3eef3a5
MD5 7f2643b0185ab2c14c854b4df3e44b83
SHA1 b3e31d2d28fa5e25f0e3ac710c6bd4aa8ce2f348
SHA512 c73b9d700e9038b6fb12e92a51354d0cdbdbdf09b63ab655ae9c35a716acbbf87d6cbf106961e0a5b2b156d4bd271914155eea04c9b426ef28e122eb5db1c4bb
SSDEEP 12288:hxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1365523D3558955B1EBFC0039C6754428F5881E2DEB5619E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 275779959751ee26028632ceb0badacbc7ae2c0076e1b975c077ca0eeac28e10
MD5 c7f3bae0ded1c9a04cd848a97811fed5
SHA1 668c983d1eaf6c06c479eb091e533a361af71fc3
SHA512 f00fe21f03b78088f4a499ceea004936f0ce87196fdfe17f43077c7d8b1e06d2bc4272057ec03c34310dbff951a2c6f32d8eb93b1154943f93da22a4e22f07e5
SSDEEP 24576:VzyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VHLNiXicJFFRGNzj3
TLSH
T160650257729530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1d2ae1d58d2f87864b834af4fbff7ea101a12361931d1c04c8ec8b34075dbd3a
MD5 8726a7962d972e342e84fee9ca7e89a9
SHA1 490a092a1738bcd8e0f028ff9838608e60ed2673
SHA512 22cd218e694159de3d3fb334912068538d4231f010d7095ca78927a9da207377fcb9f4044d18d77e3042bff987c7a9501e50edd2da25123fc364eecd06bcae77
SSDEEP 24576:+T8aLl3z0zDS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+T7LljPLNiXicJFFRGNzj3
TLSH
T1537502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ea34e6a2f00e86791e21df00cdca91a65c443774ca81f30122502a5dfe47b846
MD5 3688ae109206082de8101a85eff205d8
SHA1 d0e379b9e2bea253db69af18bbdf9c2d42ce7ecc
SHA512 ed1195613385b4bbf66aad0a3db34d1d414215945182454643a41e067cdaa2efd47d0dc2eacf7e6a12dda83734c2f733762c0f46145dc5af15fed984766759db
SSDEEP 24576:J3rd9CHKy7GZO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Zrd9CHKyasLNiXicJFFRGNzj3
TLSH
T1BE85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a31cde0f68bbbd67af52dba767cd403eca6500e46ba694c120523610cd0f0a10
MD5 19a18d51979c1895c4ae0b609a7a2c33
SHA1 7abac56a2e4bd0faf369c43c7b071aa726e3d8cc
SHA512 06f416d014c1b5a33d5442d9abd8e0b7add44acf8ed6a1f8aefd8527c394a61aab125169d51f886ce8627bfdbd5a77042a687c1260b724ea15880e79033b4bb4
SSDEEP 12288:LQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3548955B1EAFC003AC6764428F5881E2DDB5619E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4336545d28af6920b53c6fe2d41ee0f388fc47eaadbdca6f6d2a598057303515
MD5 0e7b50568099e7b7560fa87fb1ba3f6d
SHA1 6f15b299833f3ed74bed8ca1560e5548f8262eaf
SHA512 179ac17df1abbf0d4cd82457f4b4657e75c4bca4a5af0715a38081bd1fef5e32f09e7394369dfe84b08205c9d4f932b5c30fcf31478553e1424c5bb1aed7b176
SSDEEP 12288:aSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D2558955B1FABC003A86764428F5882E2DDB5619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 612017ae467429978a26c19e44f0407bc09df3492f114e81675ffeee98397c1e
MD5 02cdc0770810b64ee585878192f79267
SHA1 16baff6ebc343c4daf9712c9fec6a5569b594ca2
SHA512 588304f97561286ef1cb4a56658d8c35e8b846472a17c958343899fb01f798c043416698ba0aff0ea748883dd88c98d6d98a249a309f922589d4d0d1d8d02208
SSDEEP 12288:SjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C5523D3548955B1EAFC0039C6754428F5882E2DEB5619E3E3483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1ed2c920bb1829aade297bdeba6c768136b8ccdbcbb565fba2650e023e5d89d7
MD5 e84ad2982ca7d8a45966589b0c056bbf
SHA1 aa7ecbd3194c48577c1952b2cd129f349d73fe79
SHA512 5a494d9513af94c3b3d6a21afe081dfd24eb69e98f0ba6d1d29fb26d9d35a310b712d6a797bc319655b9079b32729e4100db40571c2318ce321ef2e1b8923a71
SSDEEP 12288:rxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3558955B1EBFC0039C6754428F5882E2DDB5619E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4898edded39793d6423c4d24c4fa87ee92412e0a5efc194f9e60e5b80c54c2b8
MD5 cbe95a24c649325c7f7a5f34b6221a94
SHA1 e681b78f5d9ddf19cd6ed6d3635a00622c762394
SHA512 730b08659fdcf4321d27b9bf5534201c95503e4f9fb45a462659ac670638a1f4423df12376b31ae35909eb24f761c6bb34407b0be034e4c1fab988c6f5537c8e
SSDEEP 12288:yQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F5523D3558955B1EBBC003AC6764428F5881E2DDB5619E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 dea1175aa3c2a8156ed6b5e961f923dbfd839adadccf76188983fe2432cf1add
MD5 c5c50ae0e65a4698195a9c09ac624095
SHA1 de33968fb62e62a15824e7eef1b52a295deb5eae
SHA512 5bc2b88d9d156dce0b20029a882dd549b174645d50edf7aa3812a04729980cfe97c40f9718de222f9f598c9fc9a7a7f05b7ba1e291b6cbd34e53822dfbb20da9
SSDEEP 12288:SZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1455523D3558955B1EABC003AC6754424F5882E2DEB5659E3E3443D1EA238FEBCF38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 fdea651cd9a183a8dbe0e7deec5004df97a70aed029e91ebea9525541e570e30
MD5 0561660084e9a2beb1ed787f3e1ba56e
SHA1 ef9d456d9bbc2774d97840d3cf2e055bfbe247c4
SHA512 497914fac5355b9e891b6bbd5b57b2e501abfddb844e0a415a65b926a87b94b2d8053b10ed6a4ad5e32d84323fc37e745a854463b5c4c8c7043d88ac06b1c699
SSDEEP 12288:afiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ar/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1EAFC0039C6764428F5881E2DDB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7bd163a1dcba183de419bc009cceecc98632713aef6c87bc1afd9235066e4d6c
MD5 7d261122b1584fb420ee9ec62ef54d89
SHA1 85b0be9adcd15d3a4c10abad81098c2af60ecedc
SHA512 299585919ab51bc689bbae557dccfc5ce2a1ea6a1a1ad6251564bb4390e30155655359af204155634562109f4a78a4bb716bdbf9d4797de025fedf1cbc453a5d
SSDEEP 24576:Ifwvzk9RX6wkyAIB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7MnYIBLNiXicJFFRGNzj3
TLSH
T1A485DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b82cf732044361b261fd72a22b218808fe7a9d17eb1dbe13bc3cbec1c8fb405c
MD5 2f7796eb92d719273c7ad14506e83235
SHA1 183826f573f71ee06182c94c2552a9c2bcb6653a
SHA512 6dd0eb431134c8b86ce8ec2f450b0ce2a2b66a20f6bf87e834cf22b0eb94ed55643c11472a1d9bf72c0aed36e2e1876c4c81adf5d7d08d881350fda8a22f0997
SSDEEP 49152:qYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02LNiXicJFFRGN:VySzPO7wRGpj3
TLSH
T1CE066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 14026016b4f66b7bbb203898b4bc53a27cc8d1356e3f5a691842e0a9db901159
MD5 0f599e5d81d93e267ec98bbac5883363
SHA1 315ac36e5af866fe0258022e358984ec54423294
SHA512 2c0af2944cd2cb5cde7842329529eea866fab852acf82b5bafe674f85e273deaa693023082f58263a5376a0601f3bb0cd132b8be83e96d6e914864647365853e
SSDEEP 24576:o47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:o47JUQjqirIhCnDHUPfF/GLNiXicJFFS
TLSH
T1EF65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 df90289526c67f338304d0aaba4c2f50badbb5d7b28dca20b589ad36c715746d
MD5 0e76929c9d0c37b2bd9624e0c3f006c5
SHA1 039103b1f1c87484a51dbfbf15e22873dae32e13
SHA512 999b3e8a4be1352814c578c4f37837fc314637bbc48f7c3d3bc7e9a6757bebd9cd23b6253f54aa4abd7cad0a8cbe84f97f67bef3bfa3c2b504d67810ff197f81
SSDEEP 12288:LpsfBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10D65F15AD28802E8D1AE5139C7664900F3633C2987E193CB53D0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a14fcc096e4ae2e6e63db537662e53406e9683322c22d2a960c737e88b480f95
MD5 684749d251d4928adc03d7caca423359
SHA1 b2eb4cb5e730a5db654b7c1af8b9306af6a61641
SHA512 7bd583256118e826178fac1cb9bb65402768e10eb4fc0adb069980e8d33a2fb90a5c6e8bd6874fdc5684f9038cae0b4acaf6976ef35bd35b3e4136cf16827927
SSDEEP 12288:qNszRU3fCyIuAt2Ou6qp1obyTpo+OBuGu0+JAJdL:qNsFUPCHuAN/e1oTBuGz+JAJd
TLSH
T1804507407626CB4FC6A940325E36D6CCA770BD05FE49AF0373C9873F9476659BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 fcb1d9b98d7866d70d3e524ad3ba566b70be4bda730fe2c0ffe296f1b85dc24b
MD5 b39804131b7c675bc13b76c94bfe745e
SHA1 7326f8fba48c69231d724cb17e394f4efbe037ac
SHA512 7184f0df76eafbb1580e7ea86c7587b58356d592019c84b85f9bb2e1bf865cae79b4ae8c9ab49708dc976641fb52fd295c12bb37274a05fdab785acf150d4724
SSDEEP 12288:Ghau80NtS5H7CAcZsG9o/yqlqrZ+YctvJ+tra1a7V8aqt3Ls8Q:GY5WMF+A9G+lU7iFQ
TLSH
T198552A0065B7EB4FC96E5037133296CDABB49C06BB853F0173458D38987696EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 619cc221ae639ace3ca7a551fd8974d7088db34f544a7cb72e2b64d7a44b0fba
MD5 877fa425218cb5da9ab35f6025b4d4ca
SHA1 63afb0f38a9ea1f911b6408ff91b8dcac5ca2923
SHA512 95be7331694962eeeca2d6cda1ac5c982657bbc56bdd85866819b1a2e3a6bf8c7bea9ab2a8161b9d27c2fbe6824396463af40c754346098a86e224e7c04e22a8
SSDEEP 12:KNWEEEEEEE6k6WkEEEZq9X/EEEV/lsNGM:KoFkh5SXRGM
TLSH
T1CE425E508BA09F28CE27F83304AC677A4327D9905EC48BBFDB2916A22CB164D4D347B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f34ff56a2e78d2311fd51d4c1e709ef52eaf8963445bfbddee2ed63518baca56
MD5 1de67c08cdecc9f3b3c1f62bfec4c295
SHA1 864366e3954d14858216f099e3e606cd84db9be5
SHA512 120c7e2a832a73cefd07768c6b07d420a5611753ad1a4a24adcc88a32d035bdfba9734d1e96de887999b59c7268478501c3f90cf3aa9f522c9127aaffc2a1962
SSDEEP 24576:a1/TwSfVcYG3K/cJHlnFR+IGNe8j3Izw:a1LNiXicJFFRGNzj3
TLSH
T1AF5523A3528959B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a03d82b0151ea983d6c0ed9d3a159594a7ca5b14ee24aab0b949841ee4349ff5
MD5 14fc20b7a44337706d84f57e5e8e14a7
SHA1 954e11c0f7f9794a9136d3beb5ba27a3784463d7
SHA512 b14e5ae8df4cc041ba45b0f6331e958443c71d4876ac2aefd0892b7f17a21aa1c94e2142e991bcf59441cb7bc611fb4f8ec78a2d79888e3075c2e7a0dd8fd460
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Sgb4mBIBhGFgLNiXicJFFRGNzj3
TLSH
T19265AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 48256b2e1eb163b81ef515e3617e0b5e84e3f9526b5d71e129251b28bb72ca69
MD5 9abc40745e39c4316663400193dfc336
SHA1 f1514f6693b634b8c2495d3fe0f8e407e09728c7
SHA512 94abc5439da4a4bbd3ce754cdbc65c94b8917dcaf9bc4ded1274b76cae60cf32dee202eb50a99e1ec222c5b4d848745c338db1bb813bea03f9565861ecaa41b1
SSDEEP 24576:mG88u8FpJqH1vzria7/mQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t7ZFPqVya7/3LNiXicJFFRGNzj3
TLSH
T1FB85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7ba5d206db83579f7de81f600fbd70f970254847a37481bbb6df2659d20ffda8
MD5 48a0af65bf714a661a4014268287885f
SHA1 0e5e7e164a7ec0661b2ab72914a42d523a629f17
SHA512 e42816375c7609dbe91919171306bbd3c5f7f38b941d6b62db7a243406c00b130826b9b723b07deec5fa1afd882f761343b6767c0d5cf25a817e07894abb7e3e
SSDEEP 24576:GPUr+NQs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GJQsLNiXicJFFRGNzj3
TLSH
T12565F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bd30dc05ad653e24f9563c1a1113379984e9430c6c0f3071c3238d9b7a1235ea
MD5 0622185e1ee71b43bd335d74bbf8c1b3
SHA1 d4383ca5e71380a37ae340212f91aa3fb898bb3e
SHA512 23356c40e3de867384b21647a17472cc83427d63aa9d475ddfdf4466cc214383433afb484a1578948b66987ee9b8ed1e2c6b06d10b46fafc0c55fcebb11fa4db
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcLNiXicJFFRGNzj3:qG05lO43bp7wRGpj3
TLSH
T149D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ac0faf182ec06e4f18c715c54f7b289ac39de27a4aec2852b498e20735441f82
MD5 c5292b9a44989737957b1bd9be0fecd3
SHA1 72dfcd52fc5fa0c371e171e18e5b8d011ab53eef
SHA512 89777f997f762f583d8142af1cbca3ebc4eeb8269093d242b64302d4684638aa91c52f5f4ac04da6ca63a94629ff0d4c3b034837d29d7026ff24b9da90879e1f
SSDEEP 24576:Jfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn2/TwSfVcYG3K/cJHlnFR+IGNe8jg:Za5POZ3lJt2pasx2+m0LNiXicJFFRGNf
TLSH
T1BC65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ea2c3f7743beab602e4a6dadda579a100127fc8f1472cb75cc2b5236b15144d4
MD5 a4184a1ffa655da81309ea3a6b0c420c
SHA1 06d5a366dab9ec316b4e70165831bc820dec8514
SHA512 c383103a4a1d7db77d96455507e8d4bc663f84ea61d44da0d8809832f4e7197b181772c52ee7f1d8d1d5a60b6edb656275b612c51d0c6797fe89265700a10432
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fko/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SNc/zEOVHFXLNiXicJFFRGNzj3
TLSH
T1F3858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4cfa4df50b2555b1d734f6c2077b1d2d492dc11fb87fd7550c552f63572b3448
MD5 86e5aa507b7de91cf047a56ca3e21474
SHA1 066ea4f1aeb22c659ed6804993d52f604310c67d
SHA512 c42c8af900600cf296918a4d26647aa344434b66c520dd3b92a3c2aa909f070dd0ccbf0ac2218a40f1a0a53e99a90f1354e5a8a2ed5140eff098a92cad4a5fd7
SSDEEP 24576:dzkNvNnaFeYhJNtmZBmQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dzMwBtOmQLNiXicJFFRGNzj3
TLSH
T1FE55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3ced4ec884fe6c1994edbda87d4b459c141514c8a5e682c94e6b4a9f1bf5718c
MD5 e2795e38cac67d689faf51bb82728245
SHA1 0b785e8ae76317125996224fbaf4d85fe2ae2bf3
SHA512 c42737fa1678145fb84079d2bce634ec2d26f1333d91d1638e626593f78b93d379de7f1cc3a562dc26b4a39cb51332eb63cb77f3eddbdb74f503cad454d45bcf
SSDEEP 24576:TD3FHshBIYQgA5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TDVHeBIAA5LNiXicJFFRGNzj3
TLSH
T1D675E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-137-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/612-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/612-131-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/612-139-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/612-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1624-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1624-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/1624-41-0x0000000140000000-0x000000014041D000-memory.dmp

Download

memory/1624-6-0x0000000140000000-0x000000014041D000-memory.dmp

Download

memory/2008-83-0x0000000000A80000-0x0000000000AE6000-memory.dmp

Download

memory/2008-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2008-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2008-88-0x0000000000A80000-0x0000000000AE6000-memory.dmp

Download

memory/2516-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2516-118-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2516-126-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2516-119-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2752-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2752-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2752-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2752-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2752-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2768-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2768-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2768-92-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2768-98-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2768-332-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2768-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3968-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3968-64-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/3968-44-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3968-46-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/3968-51-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4316-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4316-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4316-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4316-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4588-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4588-14-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4588-22-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4588-21-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4588-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4968-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4968-312-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4968-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4968-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5368-297-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5368-60-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5368-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5368-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5724-111-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5724-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5724-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5724-317-0x0000000000770000-0x00000000007D0000-memory.dmp

Download