1bedf949ca22b767e4993b296674a03e31db1599e6be074b8051447ad4335ad1

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
Size 1.2MB
Sample260724-k87csabl8y
SHA256 1bedf949ca22b767e4993b296674a03e31db1599e6be074b8051447ad4335ad1
MD5 7f76b1cc5e7afc43a2cbb82a26b6a10b
SHA1 40ee8f623054e583e62f284d87d55a89a37e6dfb
SHA512 e0c2dfa999288f5ba441dcc0cd1bcaa1ddd07bb11f7a8171adf2dc85112d8a93db51f9a7f96f20000320e26ec5b11a37c0bb3acf346ab973244ea7f37750bfb4
SSDEEP 24576:sII1hXI83IXR1xON3ktcPne87HtO/DF1+9codjeWyZxeCE9:HI1hXI8YX/NqR2TPod5
TLSH
T18545BF03F64685ECDA5AC07D872682326532B8C9473166EB21897F3C3D67ED25E7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5912	elevation_service.exe
2428	elevation_service.exe
4280	maintenanceservice.exe
2632	OSE.EXE
6024	PerceptionSimulationService.exe
5440	perfhost.exe
2088	ReFsDedupSvc.exe
3612	SensorDataService.exe
5880	ssh-agent.exe
5444	AgentService.exe
2748	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9e279ac2238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cffaf4874d1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cff3ec494d1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c92526484d1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000583597444d1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075be45484d1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000eb438a484d1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5444	AgentService.exe
Token: 33	2748	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2748	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2748	SearchIndexer.exe
Token: SeDebugPrivilege	5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	5368	2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	5912	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2336	2748	SearchIndexer.exe	101
PID 2748 wrote to memory of 1840	2748	SearchIndexer.exe	102
PID 2748 wrote to memory of 4464	2748	SearchIndexer.exe	103
PID 2748 wrote to memory of 1120	2748	SearchIndexer.exe	104
PID 2748 wrote to memory of 1304	2748	SearchIndexer.exe	108
PID 2748 wrote to memory of 928	2748	SearchIndexer.exe	109
PID 2748 wrote to memory of 3224	2748	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_7f76b1cc5e7afc43a2cbb82a26b6a10b_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5440

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5880

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2984529c18a664fbbffcacbadef9c7d3fce0a92571057c9029e022a84a52cc55
MD5 f91d5322f8e37d895791a6c93de14834
SHA1 03fe5321ce1f64248e5f9c14e3854ef4f5762f21
SHA512 fa8c584b055d5fa5a2e0e8e44572f2f089e3ff851ba520c481f44ec4c1747e2e364d81f51fe8af5a1e1a2433647f29eae0b189096e691d6f071e44a34379ff76
SSDEEP 49152:Ib+632BuPkFKRrdE6ohrstBhuXjfS4LWxnqR2TPod5:i3q60jBD2Tc5
TLSH
T149D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 52777210e27d74d72998a41b1e22e0608e39da087c5b9b91a5a579d3308c3dea
MD5 20d2874106eccfca4d874d4ae2d30380
SHA1 cbd481f8bc59b69b520b4d745fb20126be7b4ee5
SHA512 61992120b1ee2029a2f56ab3deb98f0729823315ab0d4ff9d73a4ee94fb2e8e769f9e41d858bae96df7c8d9261b855d43c904d6b202b9ae5337c9a2ab16e0b85
SSDEEP 24576:jXYfDtczAdPne87HtO/DF1+9codjeWyZxeCEr:mtc4R2TPod5
TLSH
T17505F128B7E408F9ED678139C9F28501E6737C9147A4F78B03E4A9291E336D85E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 de7f501f8b38a7ead8a091a8f6e22e8da057d652da3dc750b4ed73804599459c
MD5 9ef3f1d84b75bc3571ff6c5ac356f184
SHA1 53c78c2c3ff69cff9ae5ef90020f9bc16543cde0
SHA512 0c26524442a7dd87af94cd950d0c61affdc65d5aa1c8a29229c5cde40d68cb0d82808bca49b6ff7eec0246c79541b83605e6c2bee10dd4a8a20e7225aeedd93a
SSDEEP 24576:F0Le5ji0hmxNrMCPne87HtO/DF1+9codjeWyZxeCEP:FPji0A7HR2TPod5
TLSH
T10F359E55F6748331D073C0B9C5D2A68EE97230825B308ACB5286D77C7E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0126d11f3084bb54bf1d584c7c54819e33105680ccae9db344f1451282e3f699
MD5 84b40bfef78ef861d229d91b5fc15727
SHA1 9501bd569190d7ea57b49237ab3c09d967bfe715
SHA512 e215125e87bc7f5a57aef1b92c552f679938e5cc50469d14ede050d4d7ac29c84aba68bfba27c5b31c576b51dab8e0c61e4fb1333d322604546a8eda11848143
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWr6q8wyuoPne87HtO/DF1+9codjeWyZxeCEA:N/ezSC6vUzPviHjyjR2TPod5
TLSH
T17E755C25F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 62aa9eda596b3a8ef95f3faf46979f6d984ce3c212ce708879934808e0b4a10a
MD5 0d195791e41cb27b33bcfa4be416c584
SHA1 66aaa2f2ad685317c2c785cf78569a8da22cebcc
SHA512 dda8061846b971cfabcd3b1cc72069acf77856088d9adcd50012105035da495fbed30b79df5af41585fd67b96e1d3f1bba181a133cbebabeeb679c7b1f1ce094
SSDEEP 24576:IVbqPb88hv/l+bBPne87HtO/DF1+9codjeWyZxeCE4:IVO88hXl+lR2TPod5
TLSH
T1B255AE65F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1f61e12e22de9ef3958b6b9007e3e5366ad27c33c59b54c821dc5a428e829cb3
MD5 d1bf4bc15f5a48a57da7b32bb23b1612
SHA1 83e9e0f221d311fcdd2739c49d0f8db09c081fd1
SHA512 111b4c7ab0073b09a4e2e1f38db6bf04cfbca39fea3747d2a09d9b37c0afcba317924218661cc5430b1772d3067b79a7462d857900ef34c691f31107ec5b2a15
SSDEEP 12288:9jmPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yi:9jmPne87HtO/DF1+9codjeWyZxeCEK
TLSH
T1C0C42394EBA901B1F7A7063306FE894521B15CD0A8FEB757F5867E6D4038D28D6CA223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8024bb3e5c2b98177e2e9dc7a8529326b89c594f215bdca96c3a5ad835d8a697
MD5 77d513df63719abc78ae1217f9130b1b
SHA1 2fbb5bde4781ebe35c8cb74d0c49f10d25d38cc7
SHA512 fafafaf246549be3ec404abfc6d33512fee9e143eff8a27c8377fc4bd853bf78b11938c7d059c9039fea6a7aa2004e5fe4fce7a1441b41fa7ad247fd7eab4e7e
SSDEEP 24576:YJIU5Pne87HtO/DF1+9codjeWyZxeCEq:YJIU5R2TPod5
TLSH
T11805C07BEE28FCE2C27A4D795791C600D77278704F62A3CBD165820EDE235E05E79825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 092b3e30fca73a4cce383791396d3f60149c301b59c8bbfba36bb304e6633295
MD5 5a9f271433f752189323697a14a9e205
SHA1 d10db29ce5276b354c58f6a2e703ffd2ab32e2d6
SHA512 a9695d46425e4ef5a9a3803350fcffbddb3bfe212a14d76fc2baf17b820f07d5c6279b552e395457bb6163551b8303b4cf4f8bb960e9089f5203c6dcbe4bd5c2
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THV:OQvGAdlCEL8c/RRNw5C+2Tc5
TLSH
T163266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8dbea707bbfe82df7bd416a5d2e3faff85806df69461725be42772cdc73d6396
MD5 80bce0046973fd5a74f789d5518f6172
SHA1 658061f261c9d2dbd82f0247eb3398b9381ef80b
SHA512 f8e1619b2004b19969dca7d7bc688a057635ad40f97b24c7299dc6af7642b793f3fbec8a685b843101e62d13b3ff8e066e88bcc2d1a37b6080db246058eefe7c
SSDEEP 24576:tSewsAj3Pne87HtO/DF1+9codjeWyZxeCEG:olj3R2TPod5
TLSH
T19915E030FE74E032D3BB0D721B76C716147C79604BA62AC3E3A89E9D58306D16776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ac1590773dfd5a7ce3ded423864ab447d74806ebb073b4fb9703c47b11320f27
MD5 abec26a8f112367789dfb95182205e41
SHA1 fd6eeeb3b99486352094e6775cc9dd962225e477
SHA512 171aea84a5eeed3285b81f294366ba9d725d9877df2c676c3c6593a59539615608463a48930773a5898707c9238a65ed15478daa669990518147e81ebe384170
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHI:KUEtQevvqc2W1cpV2RI32
TLSH
T102474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 70696a6ca10d243e0da070a51660d78dc3604955d74c057c067d749c8f78534d
MD5 6e6a1a7fc5edc60140cb6f9f6d646c45
SHA1 66b468982e0327f5b49528c5c1c91ec7871b968e
SHA512 3c8e509f0dc7243f0d7fc5e571df3f7a562f5a44fec2e54d65373bbb4f3d1c2722e78640fdafaca596a00cb533862cb9727967668ea69256a3405ee19c5b6b3e
SSDEEP 49152:/CbRquA/m2yL5zLfFiV+XenmE3/zXR2TPod5:Yoq2Vjnmi2Tc5
TLSH
T13BD58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266461E2D33AE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3b55102405326eabe96656c3c6dc62a3f9d947b48b41d0c59081ecc21a7b59f3
MD5 b07ad0c8860233dc0f7676309353bc9b
SHA1 796e0dc47261e92a35bd4dd47c6ff54556e5c4bb
SHA512 3a13dd93354ad433eb0b87605ddfaf908ea7231b88ee44d79f62b5e60895aad2f072376bb1dcb1e18dc4f8befe2fdd74ddd5a59f72091951152edd952c5c733f
SSDEEP 24576:1AhGL2IFoiwtA5l7S53kPne87HtO/DF1+9codjeWyZxeCEG:1AM1Foiq50R2TPod5
TLSH
T1E0359D80EBF945D4F5B3AA7899B68171EAB6BCA65E31D20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8fc9bf3ae343f7d2525c3ef686526317ea16cc3f20bf6efa526a1e6d28230f9d
MD5 7526c6b56c5fee773172a7a3b67a9864
SHA1 24be3eb2ca6861e843d5ba3679a5766ed1c909c4
SHA512 b331a48e4876b0763fe3a09c33605cc50b9d2fa9c4688990f718a18741d931946f1ceeff64612a10d5ddca604b05968931bb98e6a35a44b5471966c3247f67f7
SSDEEP 24576:lwuXOWDPne87HtO/DF1+9codjeWyZxeCET:lwsOgR2TPod5
TLSH
T17C05F14577A80CF9EA67423985A7C136F7F2BC012A65E71F5760C65B5F33220AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a6005781017c06292b3eeffeeec8c2ea824f70b1ef421431e563b87192480c5a
MD5 2d2f5201f5c6cf987bf2df5eca620a3b
SHA1 fcb779fc9b7593208d8c3e016982ba07d85e47de
SHA512 bf640b0db7a2eb4c0faa4037a332f882b1a94d14da9c15bde6029c2245deed57d8f8cf9983c656fa26b0b01060cb6c65e692cee7a3faba611ffab3842480ac0c
SSDEEP 12288:t/Z1IynPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yT:VZuaPne87HtO/DF1+9codjeWyZxeCEL
TLSH
T14DE4139833E820F5F3A3423989F58605E3B17C9123BA63CF655566691E32ED49E39333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2db953d7307e0c4836652ade178338ac8365d5c9e63497e5b4f7e58ea0afcfca
MD5 d2d684a83ff50ef09071957626b12373
SHA1 d8f2d7b37bd3b36d7b01bd54bdd19d974b61e89e
SHA512 d1d6c5bdcab45f7bfe1f59c74bd858823b409fd21b0fac5cfe19ee3a028073f49250231cff23e41c9d1100543615e9bb3c0bdaf0129e63be7e545cf5fd1e8508
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uh:GQRQyi36YOcPhLvw2gAf+PN3P2Tc5
TLSH
T15C667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6a6fb155de910d50bdaa10c5aa60d92b3bc4f35eb977987bd2eb79abf40925a4
MD5 d2d3828368299ddb8da3d0d245376fc2
SHA1 4dff56d20900595543c5245341f5f59d79452b9d
SHA512 bb2327d279462a17dee86f8e3337d5285c60eabc59e0ee89b58a6661436b3b3856739ef7a8c090b214f95e9de5a8adddfd5677d91fdeb53fec84811a8983ee3f
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uh:fQRQyi36YOcPhLvw2gAf+PN3P2Tc5
TLSH
T1FF667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8699678a92f732b41759f00271d46a1c1a2e6984d7c068d1dcd4bef1ab91e3d4
MD5 37eda0de2c123e1249165e6d4013af2e
SHA1 dfbd348d66f6f7229bc927abc81050f6142cb250
SHA512 f3d82faa842f00a32659e2e78b1798662e77b36e5dc8116e07b2f99c85ed804922bf14e725e9632f204484ae0143cc7255dfc5a848ff78810870f9253c134869
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0qPne87HtO/DF1+J:s68Qg55nhceWu7PNU3/HR2TPod5
TLSH
T13BB55A33B2F600A9D44DE1769F4A872196D17C718FE1E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f05e3b12762362ebe96a5053e056e0a6d6f988e70ff6907872b54b615ec0792
MD5 fb7c4064173e81c49dcd02c19f7178c3
SHA1 8f287d926160b67f30d360159d690a467043bf64
SHA512 6483f3ec04c21f975732049010996ab1751af785da7459418b916f994363c218f309ccbe8764f26fef145bf2ea20f20b90ec98ebe0a2ed3258fc4efc5f7323c4
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99j:Hy5112gYy5azzVva69nLKnhZU2Tc5
TLSH
T1D8167B13F29900E8D05DD179878A9232EA72BC474B35B6DF0A5077522E7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 19323dd4c952ce670e5251ed9cf925fec06df2a4667d54f82e325eb33caa073e
MD5 8ebe84ac728016087ca54c67f3680011
SHA1 f0b5675ad45c2dfb6d92f4685077de8de5536893
SHA512 5fd1437d3fd90857367cc9a5b8ee64530efb150ad9b6dd78a35d2862caa16d13601a56be7929a3d5ac7eec4011e9e5418cb51669972d889369fbe18071f47f2b
SSDEEP 49152:kB+taZ3usBWOBr4tEG20bqx0z+n217aau1gltR2TPod5:+u6JmUxd2dX2Tc5
TLSH
T1FFD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073552A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ad9a32771ac1f61a2153e9e9e28d7959b42d167462843da8fe0734340e3c319a
MD5 9796b7684175b3d0d42cc0cd583cadf2
SHA1 b1076a2cb7eb0226af50204c04d185dae13ba51f
SHA512 3c499df1869d7cb7e3b0458b1646c5c0669aa7db863f2c764fcfe8a6036bcd56faaa8aff5df946d079d5a78d5baed46a0393bc16e46071dea748762895d997f8
SSDEEP 49152:M1hpsNoJpF1A6BU44CwH7R4xZR2TPod5:MmifPkRi2Tc5
TLSH
T1F2B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c55973b270994b618d60d273ba97a21611419e6d95b832e124ef4fb71e12a455
MD5 b8ef0589baae1f0b27c880c2b6ad3ea1
SHA1 8b26f65bbc243eac0d7db4db0c9a8d2049b1e8fa
SHA512 41512e181a53921307a36961ebc6253e0be1bf76062f67a8808553ea261512c737a2f80021d4c817955d5a0b51c287e3b631a649ce6dfa0b048b38a0d0a67213
SSDEEP 49152:OSuZQIY0Be2KNRVtOnks6NMHqaR2TPod5:A5dKvi61A2Tc5
TLSH
T154C5BE13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2ecb891bee9cb1ae382a128d6fc273b3e528a2c4dbf1ad9a1c9deb2c569c1427
MD5 4a761e52a2ef366e38c445b2dce17d52
SHA1 f695d5d642e2daacde741bab41de890686139c38
SHA512 54ed791f2c2cf14ca36c95447fb0f74c851cf3f798968a7c3692aff6a28e2043b2a65a65ed8f3b24330a95008bb1d9ce2261cb420d8d2cbbabefd00af6ad03a8
SSDEEP 49152:nhtSn8EApI0figXgiDn0AP5wdR2TPod5:2X2iyph22Tc5
TLSH
T1BA95BE13F2D900E8D05ED178C7568632E962BC150B39BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 45d3552b47a33fcaf85a248247426b8a73b17f75465022395b949ac73fa45c44
MD5 107232b2f85c07b45de113cf8dea1675
SHA1 22c721e483b364d20bf0df4aef9c0d9b2082bc00
SHA512 97426fdb70f479627bb6a638d1b59063a8a6006269d1b5deb84fe00783a568c6910b601874e457e05cd6a6552c399f8603d7e4c653b803c749192ca9bb0f520f
SSDEEP 12288:5ePNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yL:5ePne87HtO/DF1+9codjeWyZxeCEj
TLSH
T186C42394FBAE02B1F362063346FA864921B05CD1B5FF739BF58A7D195034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1cef4012f4cb76b728458fb8143d955f858eef4a1ac3fe344b1bac95978d1be3
MD5 80030eee5677df01286f5686c9d0fa79
SHA1 8676c297618795b9539d4b8ab6b4715340a1507e
SHA512 70e09d57d87ff09c4dd4a92b744a899112aca0018e7171e050feacd1b3aa877932dc814e0194392baa15a7a87bbe8513f632e70b6f1071894ed977bc9db0c682
SSDEEP 12288:PrPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yR:PrPne87HtO/DF1+9codjeWyZxeCEJ
TLSH
T11AC42394FBAE01B1F326063306FA858961B05CD1B5FFB39BF58A7D195034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 dcaab8677e75c1aad61a1d228bf8d7d4640e0b3a2af5cda0bc6b135720a2efd9
MD5 41f813ee48667e7192000d054c1be150
SHA1 f9bb0523fd9f7233b938a9907154cd3242e45f8e
SHA512 73a9815e10c3eb6f9bb6666dd4cf45af6a7c9f8ecd098faf260df596c74851ac6b8235bf716c516782c83c8f6633dc4922c37648b6e79aca6b9a01897ccdaf67
SSDEEP 12288:cRPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yR:cRPne87HtO/DF1+9codjeWyZxeCEJ
TLSH
T1C6C42394FBAA01B1F366063306FA858960F05CD1B5FFB39BF58A7D195034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7cfc1cf3c198e6c6ae23dd2a603e5442087839fda2e9ef26d15a46af47d12a51
MD5 35fb3dfea6c8ba962be078b62d26537e
SHA1 ef1ee0fd6c9e83733be837f02b87fc6c05830d2a
SHA512 3db709b5b3e1108e9d89cc02d77627a84fad98ec24ec0237dea692cc59f6f24f31cd2ca6b2dd8b49d0d8528e14bfc368e50504a0bb54461fb80c5802eabeb336
SSDEEP 12288:QVEPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yd:ZPne87HtO/DF1+9codjeWyZxeCEV
TLSH
T163D42354BBAD01E1F763823685FA8545A2F17CD0A6BFB39FF6413D5D0830A24DA69323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 97e4f74ad549ddad83cfc6aaa3233bbdd5f167f3926a077bd5717a55d2842d02
MD5 defd722e6c93bfb3fb019201f93cfc22
SHA1 72bb6565c765765d94e1ae210745c67ba85523f8
SHA512 4df15989edd6ac0c204241675d5dd117486c79a17f5c7e0e1e874ed769fd56ee69c349eeb4910eead212a52222c8ea68d736f5df36b9d686496fdd496c5f7106
SSDEEP 12288:KsPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yc:KsPne87HtO/DF1+9codjeWyZxeCEE
TLSH
T1C7C42394FBAE01B1F366063306FA868921B05CD1B5FF739BF58A7D195034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3e214aa99a99a70830c8db9f0d57c5a7b23f4912a14252265c233defb25e01be
MD5 8eb4a54c1b257c68abe8a72fc69118df
SHA1 f6787c9a4aff3058012e9a8c107e0ceac4bbac83
SHA512 465c289dfa41fda9d57d6cde4a0cf432a5eb9c12882c149335dd93e0b362b9383c22023b7fcb71307288249099f5ef769a1a54ff669b572a2ec5babe0a466b57
SSDEEP 12288:AvPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yf:AvPne87HtO/DF1+9codjeWyZxeCEX
TLSH
T1E4C42394FBAE01B1F326063306FA858921B05CD1B5FFB39BF58A7D195034D28D68A277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 764210b28da9a195d95630aa44073ab84573d4959a398ca1bafd7be2079a8375
MD5 ee94aacd4f040832a5dd962964b47300
SHA1 894047bc8a4a03a8ea4fa1c251695b10b50db634
SHA512 68f625577c8715fa990a5807f3d9986339b3f4a8316fbb1b2b63cd9f7118bf8ccd5b9a4fb0814879b9df38664d363f41cc4139be113307714222ecee0961424e
SSDEEP 12288:4TPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yX:4TPne87HtO/DF1+9codjeWyZxeCEf
TLSH
T1EFC42394FBAA05B1F326063306FA854821F05CD1B5FFB39BF58A7D195034D28E68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cbbc8e1b783d75aef3d27fdfc8830b07d6b359f40746e7bd7eece66253cc675a
MD5 a7f23c48de8d3a7f1f6ad4592e7bb7ab
SHA1 c8292d006e7a062d66bee99629f7cd1532e94e93
SHA512 7aa811a21b9564f0d5706a39f5a468427c1ab3d978e72ef3ac5efa166af27c3b2682e2dee5813cefd61be65d13b75b5f192f7dd73b269c56881cbfa5e87780e4
SSDEEP 24576:MZMMzFVSOLPne87HtO/DF1+9codjeWyZxeCE5:MZMMzffR2TPod5
TLSH
T18C050194B39008F4ED67823EC9A58906D2B27C560BB4D71F13E4362B5F337A05D2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 981ac8740b91f52584eba778beb415486f2df1e0d9d05959ef47f8f33b579bbd
MD5 8df002927de7b4c0f2bc80c6ba3fb2a6
SHA1 9edc6ca72d49ce1392b63d3bbf9a288d4fe22682
SHA512 889b44c0956f94e4c7c7e73cc854ba6c8a86c9f0e40368bd435bc1329e74766d9f728fe57fd26c1081a1b82908141b85854ea873f2d45d607eb770c6183958a3
SSDEEP 12288:JKPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y7:JKPne87HtO/DF1+9codjeWyZxeCED
TLSH
T102C42394FBAA01B1F366063306FA858921B05CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9bd068a5f7fbbbd02281da5401f8016e14e60a6dc4a9c82cc5c8814464c78d21
MD5 ee4b1f8a407bba59a5915e4892e1cb55
SHA1 a441c2f1effe763035fc6d0eb384d511d2ff4d4a
SHA512 a6d3088f4f2eb35978a8991a29e4828782b4ff8bc07912c589f39c1e25201881d6e1117ed480c76b795b36941196087c0b32daf8ac6ca4f17b72f081e464a40a
SSDEEP 12288:kWPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y7:kWPne87HtO/DF1+9codjeWyZxeCED
TLSH
T192C42394FBAA01B1F726023306FA858921B05CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e135eb245db487c2d126734dd1b5c3a8c5268abb96c9f2b191731180b6205ed7
MD5 978be175221b048ba7ec010236cb070d
SHA1 0c146694833f2f8d90e7a54f28b9ee02e7471b18
SHA512 1b0642f3d504d9333908137d50f5cd3402255801cff6c92cbf7139eec940877942b4c1ec79ab9fa578e2316272f46eedb413a1c4226f88083d8eba5384da7c34
SSDEEP 12288:CyPz5L8nPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yY:fzynPne87HtO/DF1+9codjeWyZxeCEA
TLSH
T194F4024773A520F8E237423588E64A01F3B17C7217759BAF6394267A1E336A09E7E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 33f0c4d2edcd8abe44e40ff93d7be3c6ae6245b2ab79ee679dccba8439d8d147
MD5 12409533ddfce2490d9faf8e4309e8c7
SHA1 834b8ad34b0beb4b85afc764d09cd855d552ef1b
SHA512 6794d8c6adadf546554c5540cc60519288f6d561f480ccda1abb6015fcc1f194bec8d53ac126b3815fba49e165403d581a94d7cbc956c3775ed2af3e1ef3ebd6
SSDEEP 12288:BKPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yF:BKPne87HtO/DF1+9codjeWyZxeCEt
TLSH
T1E0C42394FBAA01B1F366063306FA858920B05CD1B5FF7397F58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 651cf3b33717333da9b42d39fc6fea6fcd671d0146ec7958a4bb7bfbc79a05b1
MD5 6b28d4766f19abdcf19310ea1a6b3d25
SHA1 5c35df094ca70143453d78140c08ef5206c35d38
SHA512 72bf1ab0e2e09d4237d46855a3baa1e4e96bc3e0945b59637f0911c3759972834d5d770b49f6ffaea470089717cd77305c86bb8361fbf6613d53960af5517761
SSDEEP 12288:bKPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yF:bKPne87HtO/DF1+9codjeWyZxeCEt
TLSH
T1E4C42394FBAA01B1F366063306FA858921B05CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 170037ea1cfa29c3c9e738ba5227a0fe919d99d4b79419ccc594edb99ecc268f
MD5 604ed92a1308481eae64cf2af4c3e94c
SHA1 53293ab4bf534141a3304c40eba815c0767f6b99
SHA512 2cbbb7fee02f2a98f4f3af803bc07e09f76ddf722bb94060cd67c7db308e413cc03f5ebf6ef376a0385bd50c8d95fa27e528144bd878a92dd09b911caea4a42b
SSDEEP 12288:qyPz5L8nPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y1:3zynPne87HtO/DF1+9codjeWyZxeCEt
TLSH
T1A1F4024773A520F8E237423588E60A01F3B17C7257759BAF6394267A1E336A09E7E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8596b6cd07b112535b2293ef5b620287416ffe6e6db1ab9b82d35dcc88cba645
MD5 ab1eaf8322a1414ecf91e097cce3934f
SHA1 2418d7e7cafda191591162bdf7d005dfeff355e6
SHA512 118d1b4ac857a205157dbe8a086b35446b5f81260d124200ea90f785be8975a2e3024ebbc7d4c0dee59a7ec5d724a4a47a4dd1c8850f505404fbad13832bad22
SSDEEP 24576:DT9aLl3z0zDhPne87HtO/DF1+9codjeWyZxeCEB:DTQLljoR2TPod5
TLSH
T1FD050194B39008F8ED67823EC9A58906D2F27C5607B4C71F13E8366A5F337605D2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 fd7cbde7625833bc477e69f1a2a43b1d8fa7b31599a6671ed13a3163ed9da289
MD5 58af941a9bb14b8e296f58e1f8b72773
SHA1 e0f9eb9776ad7ce65bf939b5c5b591b866a8c8b3
SHA512 57cbb6ec347d0d8f57f666b4cad8aad5d1e1604bf4fedea61887ea24080551619ffbf2bb827e96b1a47d9ca55dddcfcad381229c33677f299009ab12e2e21e2c
SSDEEP 24576:M3td9CHKy7GZ1Pne87HtO/DF1+9codjeWyZxeCER:2td9CHKyafR2TPod5
TLSH
T10C25CF90F3E410E4F1B78A3589768511DAB67C9A1B71DA8F13A4261A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 73fa02fe50f5be4fcc38d8022655406d6559f1817605610c2360604e557a7b89
MD5 3949b4899d34ad30cac81043a74d752c
SHA1 e22480cf52585b2ba12823fccc55e542e7a1374a
SHA512 90191cbdfd80853d5de181f670549d8b3c1d99f1c79eba5beb3f693432230b544fd1d71db51c014d3378f4342bc42d2e5668e6c90334cd87bcef1a3b0e39cc6f
SSDEEP 12288:bxPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y4:bxPne87HtO/DF1+9codjeWyZxeCEQ
TLSH
T1CAC42394FBAE01B1F326063306FA868520B05CD1B5FFB39BF58A7D195034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 aee6548390f15bea014243216bb04f155e95fc11f43f20604ab0eb35d7e27841
MD5 e148d668c35d463c44d9c7709058065d
SHA1 6fa3adb4b5bebadbf06ce8e8c758b07e7d27b60f
SHA512 474accd114fc877f6b6dd22f96cb0a2be86ba6c842c4cee567ce3669099724ace89469cfe9d46a97a9c3ca1eca21c0844484b64e122b430729e86126372a9842
SSDEEP 12288:9HPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0ya:9HPne87HtO/DF1+9codjeWyZxeCEy
TLSH
T1CFC42398FBAA05B1F366063306FE864521B05CD1B5FFB39BF58A7D195034D28D68A233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 37bcbcedbffd40393a3191b1cf9bc9c3a33ac2808f901c6019b0221b2d60cab0
MD5 3a73e4476388ec85de791566f7bace8f
SHA1 f75ec694f9c8328d4c96810f876ee701b3ff845e
SHA512 c2b98d96391af313d07883de98c4336197a64cdaa132bf818154334d97672604c5b13e4291333eb0dcc8025ef67fe07fa9b0a3a59e547a59c7bb9931b2f07c0c
SSDEEP 12288:rwPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0ye:rwPne87HtO/DF1+9codjeWyZxeCEm
TLSH
T174C42394FAAA01B1F366063306FA858920F05CD1B5FFB39BF58A7D1D5034D28D68A277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 afeddfc21cfeceabcff6c06055458f04429b3dfec1bd90bfe1a5c8b72cbb0c07
MD5 1555cd17c77ef9e7093448682873d537
SHA1 057122623e91fd0eb1cd7f6bc98620a184ee575d
SHA512 b02b98e36048e2cd9e80e46325a2f87cd6c6b8d5656e5840a9f16536a61b7a184e42620d3e497adcdb57e50a21b04998deb65ad2e7f5cf701a988757adbc5f81
SSDEEP 12288:oKPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0ye:oKPne87HtO/DF1+9codjeWyZxeCEm
TLSH
T113C42394FBAA01B1F366063306FA858921B05CD1B5FFB39BF58A7D1D5034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 00ff9aa58778f85ca55a4b3d1eff4a2c30af181e08aa6d22f224ae443222f00d
MD5 0cb5f03bde4c34979eb3f3216373e36e
SHA1 a5185005a929c283cf893319853e78b0d15447f9
SHA512 8721f2ec91da835c9e83e0bf93b42cf69a29007a9334cfdc9a83a1f1a60329807fb7d3c33f58ece8b409f0f33a34782a701c09355e1da12a203a8510d4cf8780
SSDEEP 12288:1xPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yS:1xPne87HtO/DF1+9codjeWyZxeCE6
TLSH
T156C42394FBAA01B1F326063306FA858521F05CD2B5FFB39BF58A791D5034D28D68A277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 f5991f65dd35bc168c56278793cfea385fc2c12b801a6b9a25c9e80dd439d57a
MD5 22e0cd293bd291a481c77c1347180a5a
SHA1 b1ca2d4bfff8e8028e0e5026862531ea87d9b941
SHA512 43064176c4aede0fe51067cdf45726e8015cc11a66b3aee9ffa4b7c3fe9f6a42963918eab127f1b580f831de90b1558f8e4953e91731330e5c9b9b585ee1495d
SSDEEP 12288:3SPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yB:3SPne87HtO/DF1+9codjeWyZxeCE5
TLSH
T11DC42398FAAA01B1F326063346FA864521B05CD1B5FFB39BF58A7D1D5034D28D68A237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 56c1c7e6aad6b84c8152b25ab89581e425d196da3df5e7e0001fb0057ff161dc
MD5 7b266f6df4c193e054d7aefb05537c99
SHA1 233dae74f7373782b68747447b9ecada44e944a6
SHA512 77598f27e03269efaa1a3d76ac60fac923c4f9d98bb82506f8e84e1c66278e4e3118ffd010f5c6beab2226b5cbd689649f72e35fea752ff04ffeb2357e1e3017
SSDEEP 12288:isPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yF:isPne87HtO/DF1+9codjeWyZxeCE9
TLSH
T10EC42394FBAE01B1F366063306FA868920B01CD1B5FF739BF58A7D195034D28D68A273
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0b03871d6cfb6a894dd40545c814ffa9345dfc77005142a14fb7d9fc21d45679
MD5 78734ab9d567016e70b384b6e3e6b877
SHA1 89b28f80109a88f48ad4d0fd6f9b321bb8fd844c
SHA512 985e1aebf2d8b219f9516d7088216e794835e4eae1e85fdcf95e43855494429010cd63cbecb58ef2c9fa058fb6e605d004004bea3b49b2addc2329c9bd3969ee
SSDEEP 24576:Tfwvok9RX6wkyAIGPne87HtO/DF1+9codjeWyZxeCEi:VMnYIGR2TPod5
TLSH
T1C935CF29EBD804E5E177923C89B7460AF2B178591B31D2CF129A536D0E33ED49E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1465f3fb8be98d5283fd196e37a64224a433d193eeee4c39a45ddadf38ebdde1
MD5 a7e8bacff9c31af0238f432aad7897ff
SHA1 acf853ebb43390ed5b19a0f0032fb5c3ac390f4a
SHA512 186e20050049fa50eaf4d6a9f7a71accd306b0e4b7431ccb097f10f44f8adac2ce82d5c5c2a592aa0b0b10a03fc120683e017731b09b504202b0cab21702c2b8
SSDEEP 49152:lYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09R2TPod5:zySzPv2Tc5
TLSH
T1AA066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dfa2a967a20efcad0ccf589d258ea9bb0c38c951f467d1ebe934702989aec17b
MD5 f4bc629dc100e384e8388d2df61c2a7a
SHA1 96187dc36c7dfe3ff95596cfb5f6e5e40c1b0b7a
SHA512 666969f06d130e21281301ed6f5d049c3314523ceec517ca64ea8f212cbceb0c7cb39bcb60612581984451988cd89b735a3ade9275c793d13d3664b96d0158f5
SSDEEP 24576:847Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY7Pne87HtO/DF1+9codjeWyZxeCEq:847JUQj4irIhCnDHUPfF/tR2TPod5
TLSH
T13065AE1DA3EC01E5E1BA823885554A1AEA71782D1F31DACF2270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 984da34917680fafc346c7d83579c8711c6925d4d3fe9e3750db476eedc1cc31
MD5 77852c93717be393e197f18444158de6
SHA1 5c47dc499638053fb29e547573f779088a8ba635
SHA512 752c7a0ae514a6f559459a4c36d6a4d4b22bd3a9663d8793791dc178546a368c76ae1407452ad01e8a0f5f62cf61303220d9f14f8e09a5a51f53189a0858f0a8
SSDEEP 12288:AGsfaPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yw:waPne87HtO/DF1+9codjeWyZxeCEo
TLSH
T1E7E40158E29802E4D16E5236C7A64641B3737C6197F6E3CB62C0F93E1F35A909DEA313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 502401f4925d934ab622f001d5cd532dfcad71cce7ccb62a0a0e173e44863c8a
MD5 8aa703019c78e59c03e159d1acba16a8
SHA1 2da229b804f2a676becf1bb2524c50f40d4b5666
SHA512 bf6380e0f345264982b61ac8168d4d0cc8f268f20f12478b49a429ca03739e23dc583e6fd2e9bf474d2910c54bdbb645a9582d2639c3a2799ed4c7147fac68bb
SSDEEP 12288:7jB3+y5LxSEfkG1aXC1ofpJYef0GOSCoYx1:7V+SXufpKesGXX
TLSH
T1FB453910B66BD75FC6A940325E37C2CCAB707D05EE455B0372C8972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 6c634311929fb142072de1a6b6a26ddbaf1ed6bc25f561e1a919cfc3eba3e67d
MD5 0700b57c021d822e2455b06dddb53b32
SHA1 7cad24adf7d9d40025cf6c0dd0e021671623bb83
SHA512 0d65a9817929674413c84c0038a21bc6d28e98baba02864d9fd19ad566c1ba61897906a7c9d7305462b0ed36e4be914f9ac950a2d760615ef702279393618201
SSDEEP 6144:eFeZJ1LAzetGwPc/f4l4AvtqIoxzIPCx2LhXMKm5pkKjY+hFwUTs4rMjKDexHPjX:zZnt8YC5XjYNdhoEAOPRN/
TLSH
T17555D8815137E38FD1F76032072A9B4DA764EC07B7096F2673C8453AD86A766A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4e6efbbd72f26796c32c7b7fd40bbe9bee9ea786a2bbfb74ebbec740895b6452
MD5 d4050faf054a81c58e427a16d2dd35e0
SHA1 233df7a733ecfa82628d75e46699d8dd54f523ef
SHA512 19710d330ae5f9e22d56fe011aa7cfd6d6c875cce3bdf99d4a1f1886064127ab098be5a15f064cd0dc6d9985ab379b65c20ae6ebbf02e62cc6230bb1acad42f3
SSDEEP 12288:1F7iPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yH:jiPne87HtO/DF1+9codjeWyZxeCEf
TLSH
T10CD42390FBAD05A1F776063205FEC11421A57CA06BFEB2C7F4467A5D5030DA4DEA9327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5c2739534426fca9f06a6e85e69cb842c38e45e6e976ce5350c2e1766a49db6f
MD5 c664bd3edf6842d74f43c2d05593d8c3
SHA1 3ea8bfaadf6b18d6f4f5009b0206934aff28c739
SHA512 8dc2272a01ead3063ef60e65a2980d2e79e6c9729cf3f4f6722160b53b30ace047959f9d7dbcb9997ce982c3cc1cfaf90d054f86f7e6c7aa18f445faee6581b7
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYoPne87HtO/DF1+9codjeWyZxeCEb:ogb4mBIBhGF7R2TPod5
TLSH
T14A65AE1E22EC02F5E1F6D2B88DAA4417D6B278161732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 778f4e0a36f65e276118967a35f4f820d255dde23cfcec76c4ebbcd65a49941d
MD5 b9eba385a0d4f4075df9600f8ef7739a
SHA1 0dbd21d1fb6b4fc1388d165b2c5454b398136890
SHA512 3d6fdcd5592ba37534718328f12a66abf39a831d883d80e0652c70ba9d6ed35a89a201c6878609d24391c8398656c0bb881ae70ec0549b8947c36aa4f9a70249
SSDEEP 24576:UG88u8FpJqH1Wzria7/mLPne87HtO/DF1+9codjeWyZxeCEN:n7ZFPqVha7/QR2TPod5
TLSH
T1B535F165B7E101F0E477D13889964663F6B2B8210374FBDF06A88A551F33AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 713b0f939c08e673b4d46583f433a94e04f429bf7391f30f4568be8dc5b094a0
MD5 510172d6922b90372fcb79fb6abccbc7
SHA1 30aadd3f6449533262af63be4be1c4cfb371c6de
SHA512 fbd6c31ee4b4f6119ee8e8ff0f29c5595518809a5bfa1758c9da6b614297a54de99099ed2fba95d7b029df920748fd6c1599a3bff627ece5fc8f0eba329a0fe5
SSDEEP 24576:JPUr+NQfPne87HtO/DF1+9codjeWyZxeCEC:JJQfR2TPod5
TLSH
T17D05F12E62AC18E5F676A13D85968709F37178621352E2CF02D1917E4E33EE8BD3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 19ab42dc2dbb23a9821f31daf3898693725bf0abda0f546c8dfba5155f7d6dfb
MD5 982baee4f558924d458243a4c51f04fd
SHA1 a335187d064cec847ccc6fa929f4ab1c96d563f7
SHA512 6dc417a7314a8d3b75d635c4ec1d0f6ceb0e35568f4863c4456290171339e8277261e795cd8e3d3d3262b54571619db96a916c0422df1c8ecac8ac447345d3a7
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvR2TPod5:zG05lO43bs2Tc5
TLSH
T19DD5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ac9d16795e4e4572c4278c1e6a403e3368ec3b87bff3fe6fa31bb92c7a34afb6
MD5 1edd47784f555e999418686565e78ab1
SHA1 3c46f1ce2ef5174a9580da46c25216d825f61c81
SHA512 cb4ccdd6a6e6d0671d5a8b6342c328de7ea06a489d24995acee0e0f69b9f68ddf38099fdcbc32eb4bf91b04b42fdb87e94ab12e4fd814992201e3de6685e1104
SSDEEP 24576:ffa5POZ3dpqWVM50JicR2hG0lasx2+47eidn9Pne87HtO/DF1+9codjeWyZxeCE7:na5POZ39Jt2pasx2+mHR2TPod5
TLSH
T1B565AF5DA6FC01D5E1B9D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 24bbd3abb7350094119946e6eb28a60e137e1e47db774859797856ca8e070899
MD5 a83e3c6760afab6b548bbd788c051dda
SHA1 da61ec76d7f6ffbc3003c80cbf78c5bc47263128
SHA512 d236f69637fc9237c94cdd3f031890e4ff36b6cb45281ccd2682be19e75640374dcd5369cdb2342647167622ef9452d9507fca0937c6701b7e85a1aeb962b8d3
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkjPne87HtO/DF1+9codjeWyZxeCEv:qNc/zEOVHFwR2TPod5
TLSH
T1D3857B1623E901E4F1BBE1BE897B9546FAB17865133486CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 67caeef18765025e78bd9b42b18ef4d747ac5c7f96cb39def686c0dae8d67a2f
MD5 511b75f034b31e2db3e5854ca7efb5e7
SHA1 f51653bad7ec316e94ba3fa23dfbe6b5c01f6b9d
SHA512 171334e4dd1508df304b35de7b4d8676bbeeab0c1c3e74ba7296b722eb7fd4ce3710967d80c6a953f9cc6e8a7712af7328315f8e69b0ca52e9e960df3ebee131
SSDEEP 24576:ytkNvNnaFeYhJNtmZBmpPne87HtO/DF1+9codjeWyZxeCEs:ytMwBtOmpR2TPod5
TLSH
T12A55AF6EB6F806E4E1FEC6758D238512E6727861173293CB9290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 aabb7e9fcebf68568ec65e3780c551444c4d05348fd0c6c96d1a1d1b36fd88f2
MD5 eac3a2f2feffa7067c13981e6f22ecf6
SHA1 f46ad822d5064f41bbbb8a9d6c93b4e79ea09b96
SHA512 dfd67f7df21c3af497c2bbda22b428688e5a6540530f52f6fc734076fb9baaa41c93798f977b2a7133823799d80da561efdc6103d5d80dc27382185741cf49fa
SSDEEP 24576:6D3FHshBIYQgA+Pne87HtO/DF1+9codjeWyZxeCEE:6DVHeBIAA+R2TPod5
TLSH
T1AC25E17DE79C04E4E57BC17C86A38A06E37138A9033666CB11D491B91F6BEE46D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-331-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2088-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2088-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2088-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2088-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2088-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2428-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2428-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2428-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2428-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2632-295-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2632-56-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2632-62-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2632-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2748-318-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/2748-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2748-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2748-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2748-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3612-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3612-109-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3612-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3612-315-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3612-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3612-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4280-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4280-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5368-78-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/5368-0-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/5368-1-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5368-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5440-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5440-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5440-85-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/5440-80-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/5444-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5444-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5444-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5444-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5444-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5880-116-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5880-123-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5880-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5880-314-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5912-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5912-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5912-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5912-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5912-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6024-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6024-74-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6024-310-0x0000000140000000-0x00000001400CB000-memory.dmp

Download