2de7d3bd00d3ce068e385857fbb817802fba73037c0c60f708e9369506fa50a1

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 13.3MB
Sample260810-3gqvtsbb85
SHA256 2de7d3bd00d3ce068e385857fbb817802fba73037c0c60f708e9369506fa50a1
MD5 d02936591d0320754e48700d4edb8540
SHA1 19892aa100f5daab024ffe28af3223e83eb4ee7c
SHA512 7e27ac203d5be7664c52ac534ef08a62ebb411e420e88ca02968e534c92c757eb69e958085aedfdc9fd62a0fce90d134ad38dfc9336b066f494ddf0fadcf4b0d
SSDEEP 196608:/Tun686Yu0ywoPnG0MFb+GLsXPV9WzZVp:/S6JYu0ywoPnFs+wsX7Ybp
TLSH
T18BE65B1A22A802D8E1B7D27CCA96DA07D6F27D154F21C7CF06A46B5A0F33AD44D7A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4596	elevation_service.exe
5476	elevation_service.exe
1516	maintenanceservice.exe
4556	OSE.EXE
108	PerceptionSimulationService.exe
5924	perfhost.exe
5976	ReFsDedupSvc.exe
1752	SensorDataService.exe
5720	ssh-agent.exe
952	AgentService.exe
3236	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b340af70238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000290e5c252029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d6e5b662029dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c426a222029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a22c4a662029dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4a567662029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	952	AgentService.exe
Token: 33	3236	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3236	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3236	SearchIndexer.exe
Token: SeBackupPrivilege	5976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5976	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5976	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5976	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5976	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5976	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5976	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4272	2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4596	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3224	3236	SearchIndexer.exe	101
PID 3236 wrote to memory of 2880	3236	SearchIndexer.exe	102
PID 3236 wrote to memory of 4844	3236	SearchIndexer.exe	103
PID 3236 wrote to memory of 2436	3236	SearchIndexer.exe	104
PID 3236 wrote to memory of 4588	3236	SearchIndexer.exe	106
PID 3236 wrote to memory of 4584	3236	SearchIndexer.exe	107
PID 3236 wrote to memory of 2704	3236	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d02936591d0320754e48700d4edb8540_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1516

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5924

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5976

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1752

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 61e5516b42ccc14d3fa5aa635792770cc5ee95e52687c8e5217199a06999529c
MD5 ec4b435799069969d1fd8dfd2b07697e
SHA1 1af34c686c4c7a85315f03f04925e3f0395f1c3d
SHA512 f10138f50c8e21726370fbf557c43f8fcd7b9dc0fceac7cb6e5df66fb7989d7d8dfa1e6660c8bc24df1853aa1e9c39410a8aee028e1f9aaded02b8a1fa160c3d
SSDEEP 49152:Lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnBzQPm6YgA0uG:Z3q6sjB06YgAn
TLSH
T1A3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 5b4aa7d468a187da30bc03db2748f2c0ad62728162f653f33168616d91bceee6
MD5 62e950326d6d63cf0227487125883173
SHA1 c30f6642ce5a143508e54b12b791b181574391b4
SHA512 f330d3039acfb73250ed0dea012ad1f4efff1e4d532d3df71cdbda27dddcb21019accdf7c8baca326c6e45467bb8d5540cddd85d4cc66c063190d1ede7e8ed19
SSDEEP 12288:h1XLsswWkxy2lRq2czAoRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:PXYfDtczAOzQPI9hAH8CzQgAqvuG
TLSH
T1FD750129B3E409F9DD6B827DCCA28951EA73785047A0E79B03B489754F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 e982b15ef0d9af7cd592fbe985d61e95308e8070ec6347601f594ca06d40cd34
MD5 a9b6e8103e3975ef14a9ddb6035d98b1
SHA1 c17cc5a0b4ad2a9caf2425b0bb9ee845d4906a7b
SHA512 f248c3a58d175362904d72caedaebff12dc599202555995daf2041dbac3eee332e13faeefdf9691a55655e5d1944ccba6ddfb83e095787cc015a76020b9eeab6
SSDEEP 24576:g0Le5ji0hmxsrM5zQPI9hAH8CzQgAqvuG:gPji0AKUzQPm6YgA0uG
TLSH
T18195AE16F6748371D073C0B9C5D2A69AED7230811B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a43530bed26a45edfc673b222dedb3a45f87398808421adb6b65f332b5b8239e
MD5 a97294cc6d582a7a6bcb3a3c3edab0e2
SHA1 d1ec45c5d09c7b399108801ef46c6459d8e0beed
SHA512 8383b8b0f6bca71cd2d3f1da5d050673f4d2b7cc948d1a1a01643cbb3bc32baaf9f8adb95f33378d0590aa6ef50f14c8b2ef48bfe0a09bb7cb6efd769fdd7f33
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuTzQPI9hAH8CzQgAqvuG:p/ezSC6vUzPveHjygzQPm6YgA0uG
TLSH
T150756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 61033dc555ba5bc8f618f6d0a767460a193d81afd939559b8d55a2874dc49435
MD5 f9842aaecdb7dd8b42a26472d8e8bba4
SHA1 d41acf42d0c114963f490600460bb671078a9522
SHA512 f59f969f8430dd74c66d45a7bd19ef68a86056acd38608e44a11dc578eb3a317c1735b69b210b2fe1a272dfad87e098bd516d9cf5b3e540223718bc86e1c6287
SSDEEP 24576:yVbqPb88hv/l+YSzQPI9hAH8CzQgAqvuG:yVO88hXl+7zQPm6YgA0uG
TLSH
T148559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 39a07a96487428dc8312783feb9be30f5e4cd78e7d333cd31ebdfb7161e74c2d
MD5 0e79eb6dbc611aa6292c290e5a4c63b0
SHA1 c071f662c87e0536f4f5f6ac46f8f72d295b98a3
SHA512 f0c5c3f125ecd5fca38eae94b5b7b3bb33772882e7ce989102383ea8120f6f5cc7910ccdea5778862c19ece7d7b704f7d4b82f537c7d82140b986d724aaf5989
SSDEEP 12288:ffTRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ffNzQPI9hAH8CzQgAqvuG
TLSH
T1E2552347F59805E5DF5F0BB2586B5FE2087D8DB03BC4A76702326DA68E7F0C4E906292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 2732a35109d6244172a686c890d95266e56010af4850411ef810c07dcf17a4cd
MD5 dafa1fac274bbbc19aba2dbfb956f322
SHA1 ccd6c79e9da95e1df66df3e09ac4fb89040e1009
SHA512 f7002e4a1a9648286cbcd6f2c350a7cf627590c5a1f1f80cbfd12712e0db6ab8e9f6cc2196409c7f63e9204823159bc94f1a1caed19042becfba333ff54088b5
SSDEEP 12288:ueBNUbTVO86UURQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:uJIUqzQPI9hAH8CzQgAqvuG
TLSH
T19175CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4f2442dfd609f082bea5063692d1c55b36ff761243def32bfe03b46396a1069e
MD5 b04e9b996c7e805075aecd76cd4c8a8f
SHA1 48ea74ef6b3acc883e7a27dd275b10aa21cdb22a
SHA512 52c19ed28376ce97c2a11d014396e8285c5c607843c74025b4f8ccc242302fa32775fdc6bbea8194977e448ed7187211f55ea415a7581299ce8bdb58c4c60852
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THP:TQvGAdlCEL8c/DRNw5Cz6YgAn
TLSH
T1D8267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 b53617cab1045501658a413a351b81c2ca279a4dc919ba1ca793daf286beea95
MD5 4c9cccb150d2877448fa7cebc91a37df
SHA1 fbd7c82b7dca88704bf0a0636f401880c00c762e
SHA512 a7e3e22c3e3f53e28cf32fd8b9ebd7571a12e516c8b47e02eccae18eec2f7055b7fa67d75a9a49a8889e34f0852899129da231c2ed5e8f27d6d9680e62510f36
SSDEEP 12288:uAwSfxL/2Dc3FDLLmt0LDQewsAjCRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKole:TwewsAjEzQPI9hAH8CzQgAqvuG
TLSH
T1D685E031FA74E436C77F0DB21B36CB16187DA9604B912AC3E3B84D9E49342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4c8bd8e6176818d88c37ece927734e5f3a114e978459596ab6599f18eecbce7b
MD5 eb6d9979346c53238581ff18b10455b9
SHA1 ea1789dffcc7bfdc18dec29fe22ca3c25189c169
SHA512 bb1b75f7de27663e32dcbee7342bae470f5dc1d2460be624a895a4b76e0083b0894c178cc2d13a9d474ba967459777f59295fb042e63ef38a5a073094f4dd772
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHbp:9UEtQevvqc2W1cpV2tI32bp
TLSH
T136474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d413d28b74cacc05227f096522b13839cf10671b71685549d50dfb5134dd45a5
MD5 c2e341334091935c263c4ab7709c96a9
SHA1 0a17e27b8781306cfce0e88fa53c47e1549a6da3
SHA512 0f3e697384d4e00950f5273edc5276fdb2dd2b439c4b0766b39f976cd2a95e75ae6389d7a7263f8344101f631ce62fac49b7a54b160b1e681ecf4e37f2f64c10
SSDEEP 49152:ICbRquA/m2yL5zTfFiV+XenmE3/zkzQPm6YgA0uG:hoquVjnmP6YgAn
TLSH
T179D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 da1eb7fd998d06cac6468c4e9091df75e97fa7cb0926975929640d5291358738
MD5 4bace084251d844f8db2dadeeee574ad
SHA1 2375275d53d56cbc7df987599758fe74440728c1
SHA512 903ab5b20c7c52bcb60324fe3125eb63e51063f81e1b5735bd3faeeebcc293703852ec6bc2517b02bd37c817d7913867a43a2794788b26d07333d14806c7ffa8
SSDEEP 24576:IAhGL3IFoiwtA5l7S53fzQPI9hAH8CzQgAqvuG:IAMUFoiq5vzQPm6YgA0uG
TLSH
T128359D81E7F945D4F5B3ABB899B68571EA76BCA55E30D20F2160D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 8cecb528922710006b4a582bc2fd31a6c082c0e68269a17b719552a13e878361
MD5 1e92025e87872bea01173dde151201dc
SHA1 27d50a6f45811790992d6d22f002ce231b1d5aea
SHA512 014d2cf22a7337a7626bc2c74ce89808c918d25a7706d33e957e3eeb5b22c25a27975f59d555fc2c4929a895f106828475b29e9edbb409ea6fdc105ec1054341
SSDEEP 12288:0mw5HEjsChN5BFgl0WDm+C9RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xwucOWAzQPI9hAH8CzQgAqvuG
TLSH
T14B75F14A76E80CF9EA6B46398557C632E7F2BC112B21D71F0360C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 259aac89d0511ed9d63513fe73935add8a303f20925a87481520f34fff909ffb
MD5 cc324cdd44809a4b08c40e6d21725a67
SHA1 44e73f8c7755c1e77696602477c40372f77c4dc6
SHA512 e4afad2af89369954287b1320eb4fea1f203f10b75cd60c381105621a1440327764be2b44176d71e978c5661c4bf549db978159d48006cd67892d7d5dddcfa25
SSDEEP 12288:q6Z1IySRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:rZuxzQPI9hAH8CzQgAqvuG
TLSH
T17465128A72E821F9D6AB4379CCF64F8187767861277193CF023106A65F37AC56D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 aaf23daa453052a0dcbaa6662edf46b22d454538187853ea08365bbe9692cd0c
MD5 7af93205af2fbcc7a3b21b308676279f
SHA1 9502f2f4a7ea97d97ad1bb53ebc10370d16f8389
SHA512 5629e84ddd57134168f2f1da4608dd1745afb54dc97b913131625f5fc3e8821d3c7548375629bf9fb0664130d75e975b1b8ac8151e37554fefa1ff5e6d062b5c
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uj:0QRQyi36YOcPbLvw2gAf+PN3o6YgAn
TLSH
T135666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9893a1d36353b268548847dcbea8ca877bac186702b8ea8b86e542b282f04c33
MD5 d0e7430da33cfd9b0c77511510f7c3fd
SHA1 a553e7d429d4305d357b69021a37cc28d6f3562f
SHA512 acb94792d11b5c71aee89b66e73a1c0abf0937c681380696bd049f277092cb3f646942461e788719710006303b6e3821befc08da928a7eb8c544f6bac4fdfea8
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uj:WQRQyi36YOcPbLvw2gAf+PN3o6YgAn
TLSH
T14E666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 03bb90e5573679b25f1661d613d523c4da71bbb1aac42bd0a97d52dd9008274f
MD5 19c36c465b4afbf21f77ce4aaf46db30
SHA1 e4043dd8d2557dc9ebc4e70b6134ed2cbaf93023
SHA512 513a5d04fadcacf04acadaa4081d74a6087bffd7bab33a45013d014fabd6b8b99c441a19ee9d5ab311c71c941577cbfe391284ff01610da33ecb8af9d848dc34
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0BzQPI9hAH8CzQgv:Y68Qg55nhceWu7PNU3/UzQPm6YgA0uG
TLSH
T1C1B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b6f728df93de41bb02a1a04f67ff96bcfb9e036e3666178b4c8b874f0831e475
MD5 24145bb28188b6f0f9def68ddb5d823e
SHA1 2162cacda0fc897311a428913f0b8828b3b7248c
SHA512 26880e7c0ad12c34cbc2bf67bc86f76abf54852918bca63fd91eb8878e6c7aeb1167a3792a6fb72009da3b61bdecbebaf5355ecc80408d5c53ae5c781bd9dd88
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99t:4y5112gYy5azzVvt69nLKnhZt6YgAn
TLSH
T129167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 272e429c4d8d4187bb6dc63d019585fee32ee9d699ec2085a6ee1b3a667061a2
MD5 8365b0717842940744973fe7a36e82de
SHA1 e4d571920c14cde48e31768e1548909100b4ca87
SHA512 0e0603580645a4ce493fbd0a7ce9b5fb40ec0ac449a53181a7f0d007c3290c3cad756e1f511c8b928107b178a553aa4762928759812e841fb3b4186f81ebe544
SSDEEP 49152:MB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glezQPm6YgA0uG:Gu6Jmdxd2dg6YgAn
TLSH
T116D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1054bfeb56abaededf7695ff4ec251c8d18c22fa52b87435cc695e56f2573ac0
MD5 05724bd9a5e73c3700ee6498552d520d
SHA1 1284b2e4a94da9369804cb34a88ab0d793dfe597
SHA512 2091e16d3bed2ec1847c6fdc18418ce0fcfaedff86e6acef0cd880018ac0a5526965fe25a51b841b752f949192e17b5d52be282ac7e7455c0ae6e3292661feaa
SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4xKzQPm6YgA0uG:PmifPWRP6YgAn
TLSH
T163B5BE13F2D801E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 938db886f8922ee2a1a1c12cde7a94c4c2b06e209ce0edef42e9c12f5a39a96a
MD5 170a8180ab5ef9cd7fa2101573565a4e
SHA1 c441091e29bcb31cfd9a2527f5b00c455508477c
SHA512 e47eddf38fb0ca902b907370c509b068ca1250e820e2b0efc54e1a21c4a66656976b3be4e0646b0d6743fbb6dd0670db66569896496e5d46d9e55c7a20df5a88
SSDEEP 49152:YSuZQIY0Be2KcRVtOnks6NMHqxzQPm6YgA0uG:C5dKii61x6YgAn
TLSH
T151C5BE03F2E901E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1c8892b9ec99626a6a4c4644e522ec2e91774482bce975441662a53d4793f3f0
MD5 50a6696d86b71c4fa1e6fecdcd7811fc
SHA1 fdcfc214c7c054bffa7457e055e06c066cd98c7e
SHA512 88572b2a2e6ba926d2dc18671827702169df145e8de9879600d1eb1506fedd750ea16eb7348b6c456ac78c854689f03dff39e6446c042a3ff18c23a445059036
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5wOzQPm6YgA0uG:PX2imph76YgAn
TLSH
T1E195BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 d91cf53dd6985099adfb2da43fc7ccd89d919463d46cba8cbf04feffc90d9ee7
MD5 aef49fdb4b70a0b76b20870348441a62
SHA1 6a15a108cbd4589128231663a441ff6d0e67a91e
SHA512 60ba788e67bf9add2e178c34b9c426d762a5e8d794215a34a8abc0d20284caeabe56a9d2861b879821fcfe10c7e03d0cb397a03d7cade597e97333c2f6fc2577
SSDEEP 12288:zLRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:zlzQPI9hAH8CzQgAqvuG
TLSH
T1B455234AF4A80AE5DF5F0BB248675FD1086D5DB47BC1A37B133218628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 64945332fdb91ff606440ec3841c9b2f42cc42417c4831dc639a8cf522ef5cf3
MD5 6feb6b18602b6c444c850f4ad5600e6e
SHA1 e0a624a39191f2acb669375050863c041d452d28
SHA512 c4bd03a7cb37e2ccd3f3b20ef87bd16fe05a9e501759e3e86d56a1b868c2b04ac34e603f6faf804fbe0597a691904b329f91dddbf6af25554760353af401af42
SSDEEP 12288:32RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:3IzQPI9hAH8CzQgAqvuG
TLSH
T14455234AF4A80AE5DF4F0BB248675FD1086D9DB47BC1A37B133258628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 1d51621c00727f43f7121549b8d552b0da6d9a77536456ca33849a2c606adc14
MD5 bac497f9e019410d9abc5e3369934bbf
SHA1 5788f51cca563dad6c60a6ca3af0bb5cd5b2f6ad
SHA512 e037348d37870c5cfd634fa37872bd8bf69a3fee398ea641903e4b5e29f0b00468765cded0e81da757f2a07cb29de81de424dbfc44ed010c0b823323efb3e98e
SSDEEP 12288:fsRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:fizQPI9hAH8CzQgAqvuG
TLSH
T1BE55234AF4A80AE5DF4F0BB648675FD1086D9DB47BC1A37B123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f1fcc8171a5ef967ba73bc03f3cb2b4b518c7f20b8209062b2e0e1071310d4d7
MD5 2b05287114c110cfa521839f1e23e505
SHA1 2e4dfc640d6afaed1e5acbf35ad7384252b30942
SHA512 9776d2f4258acb0011c0e6e66e5e03053ddd7aac31e86ffafa2b2e6e374b5e3594b3712d8a5e886c46bd505087fadf8abf7461615fd6c1ed1a1d8ff313dd71ac
SSDEEP 12288:ZVJRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:7zQPI9hAH8CzQgAqvuG
TLSH
T109652346B6A802E5DE5F87B688374FD144BDBCB07791A3AF032208A64F7B2C4BD15791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 0e67b512119d3027d5e2935b084192b8432f38fe21ca4eaa66911f09924c96b4
MD5 040e879e9c6eb574f3aff99c34ea54a2
SHA1 9b1cc95c75b59317ab30356b3293a13888018d09
SHA512 3f2ef7dd72004f6302d4165c95b448e304adabc5b33ea00e5d8373eded5f449e2356ce73cfa897ff15c3b6f8f88b22cb80fdf8f01379e0916aeea0091a21321c
SSDEEP 12288:QxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:QnzQPI9hAH8CzQgAqvuG
TLSH
T1AC55234AF4A80AE5DF4F0BB648675FE1086D5DB47BC1A3BB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 658189c0b16440e94d45930031de3208f9107cd8464a3a8fcae218a87bb23136
MD5 54c6f7417f2c42ddc82f1269e23707c4
SHA1 2c1c3f664c6f446e09dac95d5587ec3b46f9e622
SHA512 c91242f9f460959d870150f04c4a3642ee7ed143cd8f0cdf32d66a9ad8e2870fdca6441529c4580a6f1f1b98dd2dd9166b685753abcceda2bd96b123906dc9ce
SSDEEP 12288:haRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:hczQPI9hAH8CzQgAqvuG
TLSH
T19F55234AF4A80AE5DF1F0BB248675FD1086D9DB47BC1A37B133258628F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 06406171b696894c0c2dfa5a3d11a6ffe78c76d64c7ba90f15edec771909db75
MD5 23a07d24ecffb05792edd2544f1298f9
SHA1 9abb0f5cf5c9112f03892f367d63a3d2365674ea
SHA512 764bf43003474e659274691635b0e8ba5f75f805f0450d8459f062bea62262b35263d5a065dbaa411109342d7ca27ebda597ed2d9415f58d798978375dde3e3c
SSDEEP 12288:neRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:nQzQPI9hAH8CzQgAqvuG
TLSH
T16C55234AF4A80AE5DF1F07B248275FE1086D5DB47BC1A37B133258628F7F598790A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 89e9206625b0bf8bdc088825dc763918f41edf8613da2cf1bcf46fa50ee12a90
MD5 9433dfe19f2126d795ac6815903e4aee
SHA1 ed5a0849aa62b80bbdf22c960e26bfc92cc88044
SHA512 f911534176db4698ea49d03f91fe90bf2f3e0ac03c71160eed72797bd36c9bdfcecc1f13b9df1a84bf40edeb49cda0bb42c94a0f9948818e3b4be04eb456f278
SSDEEP 12288:0iZwbJzzFEoS2cPvyWRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:XZMNzFVSOozQPI9hAH8CzQgAqvuG
TLSH
T1AF750195B39008F8DD67823ECC268E52D5B27C691BA0C61F03B436675F373911D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 acf64bb56fd4a0cc17196d61e475cdd2704ee6d720621be87677157444451cc3
MD5 5ac362af3558842542e9ca18ca259a86
SHA1 02fbc0e1f4adf2ab9ab31fe3a1f9cdb204d1038d
SHA512 601c72284c5c4e777bce0ba7c1904026b8a670ee59b935db1b90ff014dcdfaeeea804d8bd1686498c9d9dacb0dd44f243d282ca992e74b5705b0de8cfd1eff2b
SSDEEP 12288:UXRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:UhzQPI9hAH8CzQgAqvuG
TLSH
T1BD55234BF4A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 0deceb027d73e7d03acdf9ca84811c99f8ebd50023f02890a90c047e8cf40c21
MD5 a81298e1fbf4b4100f9043bca5521ab2
SHA1 7ec2b787c572b621447239bb01f77b5ac87a93be
SHA512 238116ea2417a2733c78c250f2defc4218be92658c9c90f8948ed7337e45625cbe4e9c7f810a200da8e4fa06f9c055b9d4ba23bdfc8e020ab17300076d2bfd16
SSDEEP 12288:1jRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:19zQPI9hAH8CzQgAqvuG
TLSH
T18E55234BF4A80AE5DF0F0BB648675FD1086D9DB47BC1A36B123358628F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 49cc35f8b5db70c6b01387bcdfd949416729fe0cf519f1b7a5e3f99177fdba2d
MD5 589a3a29feeae6adb72a82f6d651f038
SHA1 6254473d2dfa4f4757c26290c35aa9ea8d694e33
SHA512 71d501918f9e087c16d9f106f0eadc53ec51b8bfb275c70b1216379e3672bbe90582d7378432fac3d4ffbf67ac400c6b0fea66cb57ad82a10afb3fd025fa06b3
SSDEEP 12288:LyPz5L8SRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:mzy0zQPI9hAH8CzQgAqvuG
TLSH
T186651247B2A421F9D52B4379C8631F82E776B87117609BAF136006761F372D0AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 6dc5509889f5d3902f08b2c522a7786732b9dae4fd253b2660b0aa5bd4eb6def
MD5 7588cb562884edcc9dd5c55357afb908
SHA1 2d3386ae8249264631cdec4aaf8b6ad8ba9f7f16
SHA512 ab67f6af5f3c55f3b046137c29c0aa978bd1714c1dd8fab57e0e8370f072d00349cf2850e2b5ab8dc8d5992c1e95241b561bc2e11336e677b59d4e7cc89e5e94
SSDEEP 12288:AXRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:AhzQPI9hAH8CzQgAqvuG
TLSH
T11B55234BF4A80AE5DF4F0BB648675FD1086D9DB47BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 d981dc75ac8f12632e61e6814a19374603397c6deb27bf1efe2c41c5ad461491
MD5 d7b6877fec77b1d3aafc6e6af31c8849
SHA1 479911b1bfc828c287ed9bab80e05c124098a134
SHA512 7eb040e1d92642f63a2f189dd23be1d40c59f7883ae888c9c616a55c7b8672756bc2c12504bd33638c0e9faea465e391efee51f4c83ceffba9526ab8a30ddc81
SSDEEP 12288:VXRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:VhzQPI9hAH8CzQgAqvuG
TLSH
T13555234BF4A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123318618F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 3f84f4ff23e5b4825db10eb04df5ad855e1bea29ddf31aa30327e2715b6a4e2b
MD5 ccf62c3f0940fcb623fcc733a0e11539
SHA1 79ad8b452e6b0c0907a0ea8f3cdb2843553b2435
SHA512 fa9ef9b2ca221de37fc9df2a01638ed681dc45735402d47ab95dcf7ba20b1b5c178669f16f741b5a881e448ce961ccc05febcc028683b74b5233427e4c4e01a1
SSDEEP 12288:zyPz5L8SRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:+zy0zQPI9hAH8CzQgAqvuG
TLSH
T141650247B2A421F9D56B4379C8631F82E776B87117609BAF136006761F372D0AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 5605b603a13e85bccd8d885f4043adb146743982ce29c8e1d206067a5dd28f71
MD5 acd17345f663bee4158f0c9a867f4466
SHA1 d90e727cf24abd00981ae1f6f5168757c852c737
SHA512 3543e1e0d0e14b7c13c404602fc03b59076e33098f8c8362d602ed2097878dec26b823e88b65b40da049eff662862e4af9f4e6ce44863b683d25de4f778ce2d8
SSDEEP 12288:1Cd9mWYoaLHF3z0z04PDvhcRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:QTvaLl3z0zDyzQPI9hAH8CzQgAqvuG
TLSH
T151750195B39018F8DD67823ECC268A52D5B27C691BA0C71F03B436675F373A01D2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 5417271f73323c2a2fc56a42695e93a49ca90322faad04a64edf5c45dc85c248
MD5 90c854ff141f28cdd0541a3a0eebfd53
SHA1 c3e65503c20ebd00b5de2d31275751a54752fd8f
SHA512 8d842900f548939b141d06497248cb010419a71241ddd1f28b8736b463570eb26fbc308de0318c6ad831a3df2b5a12901ea5cbb1cdd199b1018de9715ff378c7
SSDEEP 12288:Ti4e7mRdTfgwCHKy7GLbbdIvlRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:T3bd9CHKy7GZGzQPI9hAH8CzQgAqvuG
TLSH
T1D885CF90F3E414E8F1B78A358C764611DAB67CA91B71DE8F03A4255A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 3b0f024a6d6847b646ff7ffaec2b6f864f5f20c732c729698f39732f4020aec0
MD5 2b26535f1783ce1400cd4201dff6c372
SHA1 a1a6643adf33fddc20d30cdb73ab14c19c60437c
SHA512 6574e71c0d864456f7f137ae1f64c6aec553c6b971d2fe52574e2a39f7c1bef8ac2c5e2e774e601793eb7d61fbeede165e8315581138dbf4d7f41ef7c005022f
SSDEEP 12288:/MRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:/CzQPI9hAH8CzQgAqvuG
TLSH
T11C55234AF4A80AE5DF4F0BB6486B5FD1086D5DB47BC1A37B123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 5c55ee9dcb7c4b049df8a45e0f356893b94eff9f1f28d9677692ae5089caaee2
MD5 beeedfdb496a00af3c9fd51414d8b5c0
SHA1 14e1b981d31bd426ca7bfe380994c2f306faa0fd
SHA512 5443cf6e5f6ae525dfbcf69d3cfc29a4770ed825258ca23da119dc201b7af44c5407127815d15cd495ff08dbd63c5a3b42a289f3b9b7175288e2413746d60b15
SSDEEP 12288:NyRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:NUzQPI9hAH8CzQgAqvuG
TLSH
T10555234AF5A80AF5DF1F0BB6486B5FD1086D5DB47B81A37B133318628F7F48869061A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 b69b4bbd79f4973d0a78178209572d4e273853fc31a22d90dea11a79598d7e8f
MD5 d99ba3e02213bb32e0f8403fed2e8835
SHA1 79e010354487adc19b27ff0f3dfb330bd5ff2c87
SHA512 e842ee50819413c1cfa6da4825a9cdb0b01ebdaf930cd2add0933c111d25fffdc17d13955ca0dca05296568f4b5b1d806adf2c351263f480d9cd47d29857260e
SSDEEP 12288:SlRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:SbzQPI9hAH8CzQgAqvuG
TLSH
T12755234BF4A80AE5DF5F0BB648675FE1086D9DB47BC1A36B123318628F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 aec5793e2fdf541416b664eca171debb56c1c61da0296e64b6aa3d675b255ccb
MD5 2f6549f85e27d87763fca264e61143dd
SHA1 2f15c4d9b2ff1b95ae57bbcd315afa26755d5e36
SHA512 56fea2fd4348a6fb53ec48ede77c4d7fd6bc350a92b227567dfbcc390ca0f5feb99a11fd3028d99791b6dc277e80b98837617ef8ec9f5d8d9217330f7b8191b8
SSDEEP 12288:RXRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:RhzQPI9hAH8CzQgAqvuG
TLSH
T15B55234BF4A80AE5DF5F0BB648675FD1086D9DB47BC1A3AB123318628F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 a503eea4d342dc569251e6a1f2fbf8706b14841e142cb457064069931bb8a6c9
MD5 6794361d9f5dd8f85ef373cb99d80308
SHA1 f138e6e2aeba26d1102a2e0e1632180e6f9e35b8
SHA512 f2bb99506fa75683dc31aad66cab0b9332582a253714336869ec35508403bdd7ab93fe347dcf6aa3c5ca2f854939e689e70a4cfdee9522ea62e5d8c9fa7a3d33
SSDEEP 12288:GMRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:GCzQPI9hAH8CzQgAqvuG
TLSH
T1EC55234AF4A80AE5DF4F0BB648675FD1086D9DB47BC1A37B123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 ca1063ad47295c01cd4ed8b1e8593d45acef03cc430bd4a2adbc9e11ae801709
MD5 be6cb6b7843b43cba0319d7baa0d52a2
SHA1 0d9ba6b80f329edb1d9a4d07473c4f40a70e06bc
SHA512 89a7bf354f1a5d940d457a4914e439511d2b4a7c172557a9cf3c88b5982e33da4617b68510ba4acd75cd6e8c3f5292e03de357b12b7862e560fa135d51ba689a
SSDEEP 12288:1/RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:1JzQPI9hAH8CzQgAqvuG
TLSH
T1CE55234AF4A80AE5DF4F0BB648675FE1086D9DB47BC1A37B133318628F7F5C8690A191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 138efd4cf97cfc03c53d8d4939e1a356ea056737960b56429518f4eaaf517f8a
MD5 6809a28883bc1b2b219234e14592943f
SHA1 0f20a5e195d3da1d0d5ac13cfb0646e732278ed6
SHA512 a50b109b42d397ab755a9b613a942d2d3d7271fd6ac05bc670f07bbde78a78a6f01c643aee0fba21f29c359bafc66cccf24ab4072ae64dfc1ca20340c572fc5a
SSDEEP 12288:YxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:YnzQPI9hAH8CzQgAqvuG
TLSH
T1F255234AF4A80AE5DF4F0BB248675FE1086D5DB47BC1A37B123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 8fd878cabc6e56c916da5e841b30041a72cdc564b2a77104b2afd2697db586c6
MD5 ea384996d3cd15108aef03d65b43683b
SHA1 50c7d016d2ebfc8881f06ece52031cd021c8a612
SHA512 a095b61a75955e8b7a176549d7e04ed995ea73f21444e869408ff7256ae3002262b82de24417fb8ff8336e0d1749642e16d7b7bc6f2aaf55baa3c2ad2c8f9dbd
SSDEEP 24576:Xfwvhk9RX6wkyAItzQPI9hAH8CzQgAqvuG:wMnYItzQPm6YgA0uG
TLSH
T10185CF29EBDC04E5E177923C89B7464AF6B178691B31C2CF025A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 65682e1f800d77810e2d830874937b0b9356c4842bf1d8e4cdcb53e7c5e06f39
MD5 33d4d528f07740d291dc98ff17575663
SHA1 c4b2d10c133ba9c0d4f87447e50ec659ca06a9b6
SHA512 2cdf674784ec76b463e38c58488d8aa61782fa39366a966844495fe7f280ca7af5a61869dd20e68bcd97f988cd6d45ed902e7bd1463d7c6bd719ef456ea1f39d
SSDEEP 49152:tYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uzQPm6YgA0uG:gySzPI6YgAn
TLSH
T1CB066C56A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4f1e12c0da9c3e5711f25d09a322a14fec2eb4228fe05128a3a1aac6cb413b0a
MD5 f68521e89f1d3180ffeda0983c702fe9
SHA1 bb0def40c1f3b913ed91b2eafe29d1a3a0020cfd
SHA512 09e1b08b81542da87b1197344c518167047acccfe8d5064650151e03d3afc49e07635d78aec394d6a2583c8e1fd9ef269c8bbb1cd6d2e7799c76ea79cc63d83c
SSDEEP 24576:y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYYzQPI9hAH8CzQgAqvuG:y47JUQjTirIhCnDHUPfF/ezQPm6YgA0V
TLSH
T11765AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0528a46c1834724432bd76f9b19176ff5e3218d1ff1e3a655dcdf84f60684c0f
MD5 b3097aed9ab912547cfe12402f0a15f4
SHA1 645f9b3d39f76774d1c4183abac5829b3f3d1fc7
SHA512 511d6e5b7b48ac27cb0a09bf173af0b6717439bc98f4409830e0fc292b19926b90d654ffd1134ab626e0442f303529850204f474a94302ea922a96429fb98992
SSDEEP 12288:mPsfHRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:5xzQPI9hAH8CzQgAqvuG
TLSH
T14665F10AE29802E8C56E5276CB564A81B3377C6457E1E3CB13D0F47E0F7A590ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 77d31f1a3c12caaf4c95cfa003fbe158d44b7a18de739454111814f03165a3ca
MD5 5b3ca1ad74404b9914ba6303ff21971c
SHA1 a4964ebf684172fe9af4a52cc6be05ca6125587b
SHA512 5126722a338e4d9d65e1c74ecb7d29b9c19e51377af89bf6550d7c8937731b15061dc75a2d7fba9ba46358bb825a1fedb3e22139a277fbecc7e3965aa50a8b12
SSDEEP 24576:t55gw2Q971z6+XyjSAJ27PxZceTjRJfxQy:t56NQ9dRXyjSAJ27z7TjRJfx
TLSH
T1F0654A50766AC75FC6AD80365E32D1CCAB707D05EE046F0773C88B3F9576668BAA2381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 46586b0c3f240bfca7a1193a0498dda50ae0672698f448a70200d511c2020c54
MD5 e20ae684639771d2abff32a0c1e780c9
SHA1 7fadc335c65d353252cfc34a629ee2a345959d04
SHA512 5424add0df0f4b1e564a37ab138e7d4d5d04bc03abbdfc056dc9f0c06e5e451be0fd5001e979cfa5f7a7d521d9af6a9cc548ece64949b88dbed372b6e0bb4010
SSDEEP 6144:/a4DofX2VXyjSAJ24VE1uetjHw//NKDexHXTKEniHNKDexHW3olflx8D1L8GcW:IXoXyjSAJ2setjw/XkS3dxgy
TLSH
T17A65E7816137E39FD1F750320339AA8CA774EC06B7496F27B388453AD46A725B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 029afa28904b15b10945be48ae7b69a95a11cfb9647e5d6d177fd60a3ab7f95a
MD5 71ee43177f422a2d7619be9bdbfccad6
SHA1 2bcc58802b209678bb35b7922e82cb5131763431
SHA512 716216045a5e776c2664e3463055adf5f319cadcd31dd453ba1a21a5e7121926ba5b9e9caaa7fe0a67f1184480227f2e1e8f0338ffdd60baae8dfe7dbb63d078
SSDEEP 12288:2o7vRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:7ZzQPI9hAH8CzQgAqvuG
TLSH
T1EF552347F69C09E5DE6F07B1486B9FF1142DADB43F80E3E7222218A18E7F5C4AD25252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0a2e5a9175f0b96cd8725a5e72db5304b8c72799f43abd3bd33cfacce6fe18ba
MD5 262507d589b34a7e78c3d212d3d67b94
SHA1 35d4ae24b2433ef0e03ff2f3adef0f04202dd345
SHA512 0ffd25500190863fd5890e34e198da606c3eed9a86aca4dc0ed8f5fbde4c049f4b5ed85f1274dc285cad8e722869fe39b9cb479d19fdb1636c24c40333aa57f9
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYTzQPI9hAH8CzQgAqvuG:7gb4mBIBhGFYzQPm6YgA0uG
TLSH
T1C765AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 415775c0e875fb5d4dab30a175c082f86ac5f520dd03f039ce2dd17f75b2feac
MD5 e670cfc719bc59bebebb6514a5fc9289
SHA1 f3ec878f8dde51067164d5c2b77bf21f0464c31a
SHA512 6fae438d449714eb714cf97b18f9733919e774cce37869adace641e680c6bf6a7fc0a679d16b88188cce7d6a4ac7e0bac591c537d28bd55444011f5abe4af234
SSDEEP 24576:NG88u8FpJqH1Hzria7/mozQPI9hAH8CzQgAqvuG:A7ZFPqVaa7/7zQPm6YgA0uG
TLSH
T17295F165B6E001F0D47BD13889474BA3F6B2B8251364FBDF07A88A511F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 beba50d1eede87775cead2b947effdd2e5dda3106abcb7c111474c130e439a80
MD5 368cc5abbc001f84b32bb374654ed9d6
SHA1 3208a2039b5860dbc6c8cf227af2c51b7abe5db2
SHA512 45207624ab9c4da0f49460576e667aaaf473263b1a5785b204175b2d10b6e1d7eb4a397259382eb143c0d1341bbace02168ff44619ee4a6f824129d877f76ba9
SSDEEP 12288:6HvUrBFrEjwaQqRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:6PUr+NQMzQPI9hAH8CzQgAqvuG
TLSH
T1AF75F11F62EC18E5E67AA17D89828759E771B8611311E2CF02A1817E4F77ED8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3e095398231d532de1e53bb73d125993e181f05bf4484834a463b59d5a41be03
MD5 124b7e6c0c185612a9c343a06aa5802e
SHA1 71cf86eb95831f059f3417243878666aba9c6bfa
SHA512 6d877d2ae4a5942f41e45630760c5532a67486910fb1e84102fb5615ea044cfbd2cf26fe9e61189f1c4e6bb0c09d6d64337531850c424e3b06650e66eea016d3
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjczQPm6YgA0uG:lG05lO43b16YgAn
TLSH
T1EDD5CF6E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bfefb2bfe5fc288843d3424cde9ef348d229dadbd3a2424ca3f5365f39590221
MD5 bb2a77cf78cc93188239a6f1939b8d27
SHA1 60e39c214f4ccb19642d688f8680f14744854710
SHA512 6fc2cf513715d3b5d5b49dc004f329b11306ab1a9a9e8e7f3d1df00f73144954f79f9762e4ee7c474d4d9ac61b9446d2c1104c25e25e67e0b2397475cc74881a
SSDEEP 24576:tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnuzQPI9hAH8CzQgAqvuG:da5POZ3BJt2pasx2+mUzQPm6YgA0uG
TLSH
T11965BF5EA6FC01D5D5B9D17DC5838A1AE5B1342153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 37c8d5f7563f98c6fe4bbe7386d29b9b8e64b8b3d54caf940724a85570067653
MD5 d9a801da27db83555ae074d5dd89e7d9
SHA1 738938610a424566dc0070b1d9edae70f1c2388c
SHA512 7bf5d0971c4a032d7a290f136046eb8fe8e2a650c532e7d5f4d34a23ad36d1ecacfd647a70181a4b94f3d59e6d598f729f42eea15e31486792494628d6672b54
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkgzQPI9hAH8CzQgAqvuG:INc/zEOVHFbzQPm6YgA0uG
TLSH
T152858C1623E901E4F5BBE1BE89779A46FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 08092131b4344c842cfaa4f18e165747e0c6fdf4b82a5440028d49f9d41eecb6
MD5 a9fa3f7f6d5b93ba1b490c37cb510911
SHA1 7eb2da3b2060bd63ec2c0dde832699e4abb8d142
SHA512 535b176621969bfb2213139fa1697249b3940618fff8d3381273af32d331a55078e78909f06c0bea87118b2998556f73ddc533f1e885ec7389d8d46590c927a8
SSDEEP 24576:vTkNvNnaFeYhJNtmZBmazQPI9hAH8CzQgAqvuG:vTMwBtOmazQPm6YgA0uG
TLSH
T19955AF6EB6F806E4D1FEC6B58D238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 0e601d7f4ac3f4655f541d027cdec9863fa2e3d25e6fe299d01c3a486afa0db9
MD5 f8993528c3610f0f7ba37d48cb5d5442
SHA1 f3732cb4e089ba86e045b8ee3c92ea60f7301874
SHA512 7ab0819b9126919f3034470002e75cb51c36716558489d30e9bc6050381549ca95d9bdaf655e9fba5036be75fe701d5efb02e0c3dba8f784eeac2de2952f5585
SSDEEP 24576:fD3FHshBIYQgAFzQPI9hAH8CzQgAqvuG:fDVHeBIAAFzQPm6YgA0uG
TLSH
T12485E27EE69C04E4D57BC2BCC9638A06E67138B8032166DB029481B65F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-69-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/108-290-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/108-75-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/108-67-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/952-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/952-121-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/952-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/952-164-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/952-162-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1516-52-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1516-48-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1516-54-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1516-41-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1516-42-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1752-308-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1752-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-102-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1752-96-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1752-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3236-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3236-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3236-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3236-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4272-90-0x0000000140000000-0x0000000140D60000-memory.dmp

Download

memory/4272-2-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4272-9-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4272-0-0x0000000140000000-0x0000000140D60000-memory.dmp

Download

memory/4556-56-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/4556-273-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/4556-57-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4556-63-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4596-25-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4596-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4596-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4844-323-0x0000028C8DEA0000-0x0000028C8E06A000-memory.dmp

Download

memory/5476-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5476-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5476-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5476-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5476-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5720-108-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/5720-116-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5720-311-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/5924-305-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5924-79-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5976-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5976-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5976-82-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5976-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5976-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5976-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download