02225e265693ff0d95e75b5433ae8139ba0677b5731e302d417865cb3fad2289

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 13.3MB
Sample260810-3m18rabc35
SHA256 02225e265693ff0d95e75b5433ae8139ba0677b5731e302d417865cb3fad2289
MD5 a28c1e39ef47f57176dd61a02d078392
SHA1 751e114761d220dd6a35be9f925daebce58ebc37
SHA512 778300873579eb00a0f3b82d1fd53ce5abc1e35d55b82f777ec9146befd21b21843cbbcbab4211f93aa1cb5b7e94f28efc710d8598b783075bcead696f55824b
SSDEEP 196608:7Tun686Yu0ywoPnG0MFbGGLsXPV9WzZ4F9:7S6JYu0ywoPnFsGwsX7Y69
TLSH
T194E65B1A22A802D8E1B7D27CCA96DA07D6F27D154F21C7CF06A46B5A0F33AD44D7A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2524	elevation_service.exe
2952	elevation_service.exe
2992	maintenanceservice.exe
240	OSE.EXE
4820	PerceptionSimulationService.exe
5004	perfhost.exe
4124	ReFsDedupSvc.exe
1976	SensorDataService.exe
4764	ssh-agent.exe
3252	AgentService.exe
1648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b72277d2e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e30577b52129dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de0a00752129dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061541a752129dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000695648772129dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad5e30752129dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a93536752129dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe
2524	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	4124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4124	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3252	AgentService.exe
Token: 33	1648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeDebugPrivilege	4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4044	2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2524	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1128	1648	SearchIndexer.exe	101
PID 1648 wrote to memory of 3888	1648	SearchIndexer.exe	102
PID 1648 wrote to memory of 2836	1648	SearchIndexer.exe	103
PID 1648 wrote to memory of 4216	1648	SearchIndexer.exe	104
PID 1648 wrote to memory of 2208	1648	SearchIndexer.exe	106
PID 1648 wrote to memory of 5448	1648	SearchIndexer.exe	107
PID 1648 wrote to memory of 5904	1648	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2952

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5004

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1976

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2728 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2728 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8d3363d326b66cacf279dc9f945eda4c05e591768b24d3376c8b10bee2dfa72f
MD5 e586cc614ae055d26e758b3f3bbf33b8
SHA1 461ae1664115f850e7712146dd6b824471031046
SHA512 03641a8297e8f5c4046ac2cdddf1091ca2c3cc928b9386d018ad3d24c7cd0c4c1d1d3934e17a2919b7dee31c394d6ca4aaffcb2acce494e5d4cb0c3f495558da
SSDEEP 49152:pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnkLNiXicJFFRGNzj3:/3q6mjB77wRGpj3
TLSH
T197D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 31d6ace0d8f8f3e4dbc00a8a6c3e02de32feb0bcaf4ef027fb448e0be80e5a57
MD5 0be5053b7511464e65cf5e2778121fbb
SHA1 2669eb3928b5421fb6ed2c728d0d3403df8ace60
SHA512 30716e55009e26996ad90c0da9ba9adb6760fe4836e26abe6fdc1fc126a0ad2fa956cc18a8081c5d2fa027a16da2d4a9a8147daa9075426b9c75f1d86355e3b8
SSDEEP 24576:qXYfDtczAf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xtcKLNiXicJFFRGNzj3
TLSH
T14475012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 88a20cbfef181a9a3aa939c359d36ee61501ed4799aa507efabe5c476caf73fe
MD5 0628a86ca42c80d9e708768fc6c104a9
SHA1 0b2372ae91a3205793773dac8504e90b9d660743
SHA512 d4369378ef65050e3cf307e1a80753f34e0f60c9be1a687f78d62df539fddd59c77a9bbdd81a1512dd7e7adb101053ce5286f7ec635d5f9e35335267e55b857d
SSDEEP 24576:50Le5ji0hmxhrM8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5Pji0AzRLNiXicJFFRGNzj3
TLSH
T1EA859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8b1b38731028a7e9579c364111f03e5de7b04ff82ae1c1bdd8414bc1a0f23db2
MD5 529afbb81203a4f265312296c5abdc1c
SHA1 e7fa51542f88d4588ddae969b1917021919960e5
SHA512 ab8f854c36f29e0d27e52429b71e5fa975c5e3ffd7a4991feefa9feddab7514c8ee528f396c3ba559aa48b5070468fc702d0d0d2235ff137aab15ae049a862f6
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWj6q8wyua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h/ezSC6vUzPv+Hjy1LNiXicJFFRGNzj3
TLSH
T1C2756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 990c2d67079fe5d364c922b1627290f5b2c955e789d3cbd7d8fb92d1dbce5213
MD5 48dbdd5875902d3978b831347fc04689
SHA1 d307bdac264551b7fb67c4f41ece265d815cbb62
SHA512 ffe69a238b86ce82cf8c386b2fd2be092f2737cb71b6706b724dc01dbf1b71faebd00a6b6cad36b714722b3bf004b243919aaef20ffafe725acec7b6f590be17
SSDEEP 24576:ZVbqPb88hv/l+BL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZVO88hXl+xLNiXicJFFRGNzj3
TLSH
T19E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 057d3307f09723c1c793d414cd74d9733c3142ac58ea8bb978e8b8ecd1c00e68
MD5 79cc858782e3480419d28a88e02461b9
SHA1 ab783fd8a5a8fd9bddab820795b11384058e9545
SHA512 241552a707f1d920fd3689963e22bbe8882a89e618dab911fdec457cf7f98b43b3d84c4b894e4c2a93575a1475b85d9e3a05411a895764dc07c65f5836f096a0
SSDEEP 24576:zGY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dLNiXicJFFRGNzj3
TLSH
T1245523D3468854B1FBFD003A867A5828B5845E2C8A555DE3D2543E5EA23CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8decf664d217d99b15e17bef6a50afb31bd9f848bbc16790155b84e05b37bf06
MD5 998281e3259201f1878cf6653b9294b9
SHA1 29a450b0ba74c79836950baa35fa675f13be0222
SHA512 97aedeb64c4f9bb0544c2aa13fbd06d802a534879e770b1590ea041d3a7d57a5bef39ea99335b46206f900323c1eb815655f41fb1d6c0ce163c31933fb952be5
SSDEEP 24576:TJIUj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TJIUjLNiXicJFFRGNzj3
TLSH
T1D075CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 442a0ac1bb6cbbd61ec37e2be5735c5684319236357280bc206524254abb663b
MD5 1b6cf3c1fdf87f825d0c14769ed1a517
SHA1 888634a76e12eff3ec12614afc0fbc41e3999ecb
SHA512 779bc35014086f0577ed9cb77bd4b57c5594f39065554dec600353e280af45df449d577458bcdf747805dde856c9869edbfb16cb3f0278ef4c067c2272f11fd0
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH3:CQvGAdlCEL8c/WRNw5Cq7wRGpj3
TLSH
T13B266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 344d377bfd631a87237141dd477c6a28f72eaf715226d42b5be4aadb27f4e0a6
MD5 009bdcb760be890bff56dc88edfa1df1
SHA1 85b335e16826452e39e771d037c236550cef036e
SHA512 1bdfdf2135fc5dbb1ac839c9ce299917d2ba46977ad7b6607dd51c0cd0e4df0e19ecda5021c07f5e1c38e406f8905774e4b00b30706efcc1a5d8cd72e4f136c7
SSDEEP 24576:SfewsAjh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IljhLNiXicJFFRGNzj3
TLSH
T1D275E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6e95fffa5c5bc30c5462bd589d84bbe332081609a62527038347f936626d8683
MD5 8ff7898940350947ea53a6bf8c3cb452
SHA1 e863017c44deeae75a9d7421cfc94d0d13c9eb2f
SHA512 a2f9a4050cf1bbd10421a612180e8e89a3b20608edb640f12752f1160a9c42befdb404ef6c72c34a1f7016e1f68ca5cc66d6379ce3996819dcf489e732523640
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH9F9:EUEtQevvqc2W1cpV20I32D9
TLSH
T178474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 eac9a1c3649ebd57c319b70a8f20c1bf40136ea81ffaa5167ec5f2991582ff94
MD5 8b74e40aa3cef6bc809e4568c620d1e7
SHA1 0a715340a03cfdb22c13d47621ac0ed267fe82da
SHA512 090572c1903a682b793989acd3e00780ad4a869ab6dbc9dfa37d1d1fdcfa52b7c1cf83a3b372bb1e2b00ca7a278d0630114847844da7b51b37cf48e1fde72005
SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zBLNiXicJFFRGNzj3:zoq2Vjnm+7wRGpj3
TLSH
T1AFD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 088d9eefd353acbf9e223bad348148be8a90762bfbd3f8973c8d4b2d887b5916
MD5 55170f94257ee8a301ff8c95ca4ef6b5
SHA1 2589fe46ec2c0ec98317575083750a3aa5eb29ec
SHA512 69051af62071d102872eebedde5c61b0e8f5088393967f2b44da79ce7f5d7f3dd70de538da4c9d120e080e2d063fbaaea00370aa73e94b89c2e9c7c98144b4ed
SSDEEP 24576:AAhGL6IFoiwtA5l7S53e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AAM5Foiq5OLNiXicJFFRGNzj3
TLSH
T124359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 8fca23f9cdeecb938cc2183be59931c31c18ddab797a529bdce33aad4df8f335
MD5 cf21602c8dfd2d05ea94ffb9b8fd997e
SHA1 bf6072ad22370a6e9d7c264620c04d1be8218211
SHA512 c989244761e7e6b0c7a13926f0fe7c38684166d183bc664daed4633f8ada3bac74425b7d8a3ab65b1701bc9c24d24f4316770ab55139722203bebafe220e46c0
SSDEEP 24576:AwuROWV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AwSOSLNiXicJFFRGNzj3
TLSH
T15265F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4769395075adc8961dbac76346cb1bb33f84a69a073f07d605db4dd1a2c225e3
MD5 4d94e3c0b322283eba60a92b78115538
SHA1 588322ca3b1df4c19d225e11b48597e410015c34
SHA512 757537200c0512ce10a9a9ae2420530d68cec124a5280c88d870ce506de536197d9aca0417b374951236c4e183d09ee89ae03aeefc02491a3616df58e7123042
SSDEEP 24576:UZu0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eLNiXicJFFRGNzj3
TLSH
T13255129622C820F5E6BB403DC9B54504E7A17C2A573643CF52242A6E6F36FD69F39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a94e6e66a69e2b2eb3920f220d6430c68e60b9bc7becd94b19532fe2f2263d96
MD5 0444664515c79d4d3747de6116e4c29e
SHA1 1dbbd778081bd5ed10ddf561e95945d7a02967ce
SHA512 022bb8071606d8094748b5e17e967a56186beea15a0c04ec40ba6b608fd31f2e3b77e7746f86afa8db2eb83916682f5ff8e932b14a1e14981afd1e2551312fd3
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN337wRGpj3:qQyiKanX+PN7F9
TLSH
T169667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d01f03f46f2bc0132f13a67e71a3c52a688d558cf37c8bbea644f5f72b9a93e9
MD5 683b1b4f5d7d5463cfade3e910c9e60b
SHA1 ebb81139c5f9812f2cf28aa4d3136461b379bc0a
SHA512 c41e287580a204617d44ec6a5bdc62eba3d2b27a5ddabf3fc39e2524724ee9ecd4ee08be20bcedebe18676d36516d8e2a5cd164440a8eaa7e8dfc6f2b3338955
SSDEEP 98304:7QRQyi36YOcPDLvw2gAf+PN337wRGpj3:KQyiKanX+PN7F9
TLSH
T17A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 33f9f592595a3e4e7268c2eb8a1e7b2e17283793f45a71f034deb4c6eda3f8ff
MD5 2a93f063f8f607d58bcd9ec46c2802d6
SHA1 e43635424d59f28d607d19b86b5de65c8432b11e
SHA512 0f2d2204f2e9267f88249b7ea147d2605ee3652a85af6a5688bc9ae683ae16fd6b8e4df97b1ec01c6d31e1a14134a310218621b17404bce423e6f193aa4fcc10
SSDEEP 49152:q68Qg55nhkeWu7PNU3/RLNiXicJFFRGNzj3:YthTRc/R7wRGpj3
TLSH
T1DCB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 33ca62c3f46f2f77b6a86ef9c9c3006673b3e83ac3db4abfa83c44fc9e731c75
MD5 36a1b377dc2da251ed9b74b7434a95f5
SHA1 8ea755f75b7b1299679c5b120bbe9ba228e95065
SHA512 5c2b8dcf98d4e9b6a4a200b10d9bfdbe5f0b7564043302455482b01bcc9c7bb4d5a45299decc10562bac346897ae8f7bd37fc4813d2fc9ae35c41d428cdb6f74
SSDEEP 98304:7y5112gYy5azzVvU69nLKnhZY7wRGpj3:WLIHRWhqF9
TLSH
T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d8d6430aafe9e602b22498fb2eaeba8bfec21d09a9a9c453b704677c087cf83e
MD5 d50ee4f6d712fa451dcb94cb1a8a6607
SHA1 10f19a4b3e700ae7e006c0fe30b8abd802f61c0b
SHA512 2182fdc4a6a12922902c23fb3c88a541a2c72a43b9bde8343c3f340c10230f5e95bc6edb3221e08d7ac873225d5aacab8fe3bd67119feaba0449bb3d93cac43b
SSDEEP 49152:0B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPLNiXicJFFRGNzj3:uu6JmIxd2dP7wRGpj3
TLSH
T13AD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 39b1f8bf92c8e1fecc760bfb595187ba7c4350614408bbf5e7bed0487ba1f04e
MD5 e3815ee61c453abf93745194068c1000
SHA1 792bcf121211acc8dc89ae73816e862e7e67cd66
SHA512 073f4e07a42a35bf71d4211dccb44f7fc4c265ddd6571b922befda9d60919f2cec1e5ffa6ec73554ec96482eb992d30466389e9dbc0dc189cec26ef966f93196
SSDEEP 49152:c1hpsNoJpF1A67U44CwH7R4xDLNiXicJFFRGNzj3:cmifPqR+7wRGpj3
TLSH
T19BB5AD13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40c9f7800ef8d49ef5204e74378f628a74e9ae24a9f374ad1825099ab7e7ffb7
MD5 889a8f7a3b713d8a2d8683d245b2df65
SHA1 b17f17d23028eff10908e1ff201d7ce8133c4f36
SHA512 2b52ac1dbc203d62c6800a745b425e2d1a90c32b2b2d4e205c53690d294872dc33d069f3564882b2c62671c6c0b1ce908cdb6dff3a96e95dddb55e287f6800ef
SSDEEP 49152:tSuZQIY0Be2KkRVtOnks6NMHq0LNiXicJFFRGNzj3:j5dKqi6107wRGpj3
TLSH
T145C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 81bb2b7e946271d2cb3ad693da1f1b8be289338cb9ee4fed6b2668fe1c36e370
MD5 07959b84ef92fed1ce11accb74f6631a
SHA1 4f60a039f5d33dd40097d3b0dff8f73608f2e468
SHA512 3ea0bc5ac881cd3ebf77c465018714b58d531859f56bd384bace6fd5ddf15929d10cb3fd6f7c9c89827d9538e26ea717b9a1544149addfe1cb50d498c0ffce45
SSDEEP 49152:DhtSn8EApI0figjgiDn0AP5wfLNiXicJFFRGNzj3:iX2iWphy7wRGpj3
TLSH
T16295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5b1f05418166559020ca9f8091308ee7a4ce3e83dd9b731b7a1e441df2b4e277
MD5 4916e5ebbba9abe26cc24f43b834a45b
SHA1 e8f9b37e8ccecfdaa2d30f1c4e8198de315123eb
SHA512 bdf0c5e6d370eae81a6319b09e24ae5dcc8818807a1692486990ccd8a45c9c15f5a2d5d9670c8cb437c082a2c42b440ca33e0e2274c5a83a4787bb60681446e9
SSDEEP 12288:nmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1305523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 829b3af882293047c9383eee66419107d5f42f8a43d4511e7ae6b2dfe91e1b74
MD5 6b27498cb317565171dc746a80969557
SHA1 be94bd61ee3d0dfad2ab46beeca5eb02ad3c43b1
SHA512 3616d2d94a6da22ae6ef1b2ab3971a61726f53723f03f152f5848b393da321daeda45cfe888334f030bb866b39d6b7639ee038d020b717a28a54833604ee61a5
SSDEEP 12288:9RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14F5523D3548955B1F6BC0039C6764428F5882E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d4d23797b8f6ec4bf6d127939f53c725ddda4260eaf27cb27bb0db9b94d9d37d
MD5 2f47924c9764bae5859003ef81d305f1
SHA1 9a9f4eed38a11044975b2080bc0b5590b6a64f8b
SHA512 996504f470a4fea170f2dd1b19cfb04232fc81048c80ba868fca5882b838d05b0675e0eb3cc95a46740391553516cbcae9d0f322e919be080496d3721f57f0ae
SSDEEP 12288:APiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1345523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a7b80b9fd0853e646de6ef9da46fbfa83c38e31d282f7b8e0664995b1c9032a4
MD5 1720985934abda8b3a4c129e4ff89c3e
SHA1 18ad8f9a68935eca88ddfc51b88014e3a6c69d01
SHA512 ee8bc004ba424e52940ad0ed4e1a717c90a84fe0a261d91c6dff170862718beeea2500a28235d732590b8fc31be2a0f81f0a1473b3e82abbc118e044def0630d
SSDEEP 12288:+VUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T133552393168900E1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8438e93296bd6a17cc18791c6dc5cad3d3698312b1469bb42afab92fd868c701
MD5 ca3b8172700c3d4db8b8cc17f60c816e
SHA1 758907e9fd1d6462c4d3dbc154885e9d89273f75
SHA512 05c3fe9cd4782e8a76df089589d20838d82c7bc067e098456594dcc0075b5c829eb2650f5ff6145907358e6db02bb6aa28fb7e355cdefb1cf9d3ebbc1b62deb6
SSDEEP 12288:yciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ym/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 efb24eb88e3c37e9e15b690080fcbf2b11499ef6c44513983fe6e98ab580dc64
MD5 bbe9a8227baea3e9e2936d01caaed8dc
SHA1 ab3a6179881f227bf257675da742ad53674303f5
SHA512 f6e3d165201a4ceb0c7bcb1b0bd655bad102c904dee2b8fe755701777be9744925eec016d24299f11ef75ea8eb6e23a80938fc54277935ba8cad9d9b4795199a
SSDEEP 12288:61iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D3558945B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ca74ffe59b34d2379f8a5d90ad37084bc438607852c01c3201b5b8c00610ef04
MD5 86891711bdc0252f775f5657f415ad74
SHA1 efa57641530cf0e46d0f257b69347342089208f9
SHA512 7acffd1a6afe9fee564a862fdcafee97226fdbc495701ee12825e6cf4862798034d964c1a41b925cf839d9bfa016f4a0cd0233db0860f64fc7a15665c62ba05d
SSDEEP 12288:vZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D3558945B1FABC0039C6354428F5882E2DDB6659E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 10ea86e0a186968c795f71203825c2c3b3d2b45ca5a4b95b9e4a8db2cbefb588
MD5 71b405c87baffee918742d2cb99a05fd
SHA1 c22d67012ee47c1928c0cc627085598a2ab3fe38
SHA512 a43d75c6f16ffa3ca0dfc4ee90eef75cda54a83554f4ff611ca01d22efe5f962ab3122b8122b2ce323bee30706d75c40fce1e23aa8d310de1044aeaa04126a1b
SSDEEP 24576:EZM3zFVSO9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EZM3zfpLNiXicJFFRGNzj3
TLSH
T1CF750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 05d3ac301af89f7c9ff3e852cc3d7e140b05f57add1ec131b37e769fcc0a5534
MD5 1c819f4975e6382327354f64ba1b1b34
SHA1 6274c9f21d526a6bce7c51824743813facb1443a
SHA512 8ce5d5884aa678376c1a4d2e334044c38807826801c82c6d3b7dc496d47f0ee14e8be4a1c87b2ecccdecd432f2ff608efe9f8a31c9026e542c9a788d186615d9
SSDEEP 12288:9CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3548955B1F6FC003DC6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0bb54e72fd26663632b8e43d6309fbeaba6c9da2a49310d73c866a6a6b3f71fc
MD5 01fc5d843fade2581f151fe4493a21f3
SHA1 ee79bdd0e6bcab7cc715c60d8699c25e5b47d478
SHA512 8f9d0cca3121b5d323d9ef9471230decb4c73dc2c179caf129b425469d9687634adfb80d799d681336648cc9e3219c58c908c246e50fe3ed5571aa6e676483bb
SSDEEP 12288:8eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F5523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c37e82332de01179a752e9141feba73434e4719d6d428a587b264eed98d33729
MD5 72f9788ed76be3b1513071030a870f4b
SHA1 a5c1f4c807f240a38d4a0f9b7daedc3583b2b7c9
SHA512 c9c7dea10a844edc0f01a5c664941d9d0e30c20ef22a49241d115298957ac3d9f4a647dd2c261fcec9e0d93c1a3cf699b980208c60f440a7572a8af094646789
SSDEEP 24576:Zzyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZyLNiXicJFFRGNzj3
TLSH
T1BB650147729530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5603a90ecd1538b2b65696dfe6eb27f5149dcddd8158eea29da0624173051363
MD5 1d02796e7f80d0cdea811eb595077db3
SHA1 fc7630e72cf54554fbc29bf9b8bbf3a016908183
SHA512 6cd16c6d8de68f61b54fb9cd017a70a212114611437615cc39a98ccf6416dbd0fdc1adf704e7b3a4a7b7e4a31ff92534a5754b3d35d7fb9a6eab1f3c0f5863e8
SSDEEP 12288:dCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10D5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a332f16765fcb8bb5ebc9142f872a7eb1e2f1f8009f05dfcdf5c7a11fa2a10fc
MD5 c0ba4e3f3feeb2fb830c1999d5b31509
SHA1 622fe6ebbef76658ac846510048bcf82ecf6a64d
SHA512 915ebca8683025ad17031e96a3ee385bf8d033e4fa6e3de8691108b51a57fbd1f920f6f638a460eb3a3b6e131b2ead112c74a9aab6faee12b29318f721c1607b
SSDEEP 12288:MCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ME/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1975523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 74ded70f40fb03b58a785737c07924353143cfee387f9b15682914f87f65f3e8
MD5 b4994aef8ebe5d29613b88fc57eba4bc
SHA1 bc3efb74546d92cdba822ca663dfb0d1f7bf518e
SHA512 8f44cd60b57592e94422779c0c5a823bbdb2ea3c57132686d7ed4ed00612b98c956d9fb0100b5fddccd6fc0a98bad7a0c938fa268b654252e6b6ea7fb0d6eafb
SSDEEP 24576:xzyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xyLNiXicJFFRGNzj3
TLSH
T1CA650247729530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 262c37b51720aa49f8bc22315b1f0cbf2677beaab4316e333ccac54b29de6fa0
MD5 8cdefd78e04aac32d99c6a7496064067
SHA1 9f04b9ad284dee1de51c629e14e4635efa09cf7b
SHA512 523540e2e96ba4e804ac743b5d733ba2b6b9e7285877d7a55c7b2c7efa53765789fc9fa77394458ec7835499a8467eae8a8de5d310032bb0b25a27370ef92c92
SSDEEP 24576:3T8aLl3z0zDr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3T7LljaLNiXicJFFRGNzj3
TLSH
T18A7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 442c392df6d0ab6c0521cffa8fcac9d399a1b4d2f7b7edd4164bd01d305ff3c6
MD5 7b6686bc93460f6aad77624b25ee4774
SHA1 76ca52a3c82790c6246323fb4d0e62a6b18825ce
SHA512 a8fe7685089a2301e0021e71f55bdcc4e1fed10ff23758b1db88270f6ea501723f511cc44f7ca457957cc6187ea61d10bd629c47b6e317dec73d60821410028b
SSDEEP 24576:13rd9CHKy7GZX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Vrd9CHKyapLNiXicJFFRGNzj3
TLSH
T16F85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3d1e080b1273cda5455d501d1b0c87e858154c895f763ca7b493e65ec61f8b75
MD5 5563a8a9ffb5c3188f9cd047f1b63f79
SHA1 d39c4ca1c5cf1c88d61c13698a7981e61150fa14
SHA512 793e823ec1f0f352ecc93a0ac0c3a07399a23b36329fe73ad2d8b35515404452a5cb98560afe443d18b03763f358d2ea619a704d59c5483d786dce627144d2bf
SSDEEP 12288:CviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4da2a8457719caa55b1aca8fe3c171a6674c7ba981d27840e0069f88ccce774c
MD5 f827d84a2baec7eddb7e83030171479f
SHA1 fa0dcf06893608db4627a164a86186a54f6b8e94
SHA512 e7bd295f2d98610300f94a6ec3d490d722393d4ec5df7170c6d3f65635a930d8aeb26e3afddf6ebc3574fc69029f80f6f5b99d87adaaa22fcb2e8261d12412ef
SSDEEP 12288:4NiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10D5523D3558955B1F6BC003986764428F5882E2DDB6619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 da1188b2b406b779e1af78336a8e6d003c54b746fe98a21e4cbeb3de36a74af7
MD5 c13c15a4c7b4661cf69380ca76998940
SHA1 6ccc4eadc298ab3ba909e84996b53ef97ea9d068
SHA512 4f09e3b9594ca1f4e0bf9f4204b27286f4ad5834e36234a67fc111c6321c16a0f281418309e9b6f3179ae0a172871f63c89534ba8fabadcfbca2cadd6d38e5c9
SSDEEP 12288:KQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1465523D3548955B1FAFC0039C6764428F5882E1DEB5619E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5237257bd6164cbea02939f5a25e186edf76a1bbd88890ecdc8b8e9878a06474
MD5 936b83ca64003c6a0bc94779dc42a1cf
SHA1 4824ad13887f92e7c5a2d5a272f8eda40e622322
SHA512 968e2607fde25d6d53ac0b63aa3deaa5d771c27f53276cb79ea22da5e93988addbe721a5a0793c933c1b056bda0cbc8e64fe28d57673959bec65557266d1e318
SSDEEP 12288:1CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3548955B1FBFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 664a7c4d87ead09466be3f2c8fe518c198631c07af731dafcc8c00ccf0403f30
MD5 b14279ef24dcadc4c732ee47d07b4c0c
SHA1 7156e01effdda013f2a2f30b7cde9a1bcf211e65
SHA512 a30b64ca95a7986e3e16b190c27322b8af5f2fce98ddabeea838ab823628ae771b436e12149f460add92461cb6de6b82dcdbc0df6fd58210a798ae91093e47d3
SSDEEP 12288:UviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ub/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3548955B1F6FC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5b66b7f362076c9860e5860d1c313a39e41ac6253bb665c3e2414740634f9c02
MD5 1c5844134b590e67a0584d527f8de327
SHA1 25040015ead1ea042fc6a1cc126e205a6dbc7ae2
SHA512 1838b7cdf11faef49a36c21bbd959a1cb1a8b4ab2198f62800f344344ffe6cd481b222784cefe6662e563fb855c0377a8bee29ecf82242924c97d33d078779e6
SSDEEP 12288:3qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3548945B1F6BC0039C6754428F5882E2DEB5659E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 97aaaf6d5fb0b93b9aa76d1b8538c082faf802ac555a9a42cbfaf91e9765e2d9
MD5 df94f9ae61c2111b6b33d371a1719ef5
SHA1 99c7cf507c40ad4de4a1537b3bf9e3d48039b1ed
SHA512 9ae2ab6ba78f930636b56ddf2b58497ac8141787091320d7f82a25879911951d9399cb2be66d8549bc85b7db8aa2b1a6e3d3bad2857e3dc0f23f906dd18f7d8e
SSDEEP 12288:WciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1be0a7f10b3e1fe7d1e8782485facfc1ef481d16dd679f6bb960f681cefa8556
MD5 bea27499c0143d364aa9ccb352630d10
SHA1 63295c76fd693a6b712e95d2bf566376c02bb7a1
SHA512 aaabd311398e76f4f312ddbcc153741a94870338d3eed45e4b6f2b59d0edf54964841cdd47fc7faed24accbd3ea6c375773c0467044a7db4c70f2daa4ed14305
SSDEEP 24576:rfwvzk9RX6wkyAI4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+MnYI4LNiXicJFFRGNzj3
TLSH
T1E285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3a0146978905f474c5bab81eadd9f66fd9e4b52502e1977836dd1428ab614271
MD5 e5b47ce888913bd8cded0e1b0aaeed9b
SHA1 933586116d74c5873e3d0d577cfe1e3ca7b672cb
SHA512 e9760eeba54009d155ab8eae0268e2db51cb641495f050127b9e758af1a71359065c5e43ea40499ccdd916b2966814ccb5868196427359faa205f1ba1c20dcc9
SSDEEP 49152:rYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/LNiXicJFFRGN:2ySzPX7wRGpj3
TLSH
T1BC066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a17d4a39502e992e74110436c7aa0a8926a9d471c96eb3a66666876dec33ea73
MD5 a7d3bbdd236e5a508314623fe9dfc78f
SHA1 10c3e283b18323850c7e111bfb556786f956289e
SHA512 ef8bb9d3b86dac96c488f2e05bfabbba9b52b51409f4c7ac37b94f148f5f90988b60fb70bfb026290f0c6e342517cb4afcb104d6da7fb7fdc7452c5fe0c49fd1
SSDEEP 24576:k47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k47JUQjqirIhCnDHUPfF/PLNiXicJFFS
TLSH
T1E565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 810aca837cba5c59196cb5e8cc77dea79bca7381091be35bc30a5d0ed3b009c1
MD5 c9a606fe02c67e2c0090204a8b3eaf17
SHA1 675f58e7c5bd694daf7b15ab1075873307911156
SHA512 878fb8ff9c1c2bf01c2e6c8111015d6f3ef8006e885ce5022c3a66d6dfc5d5f9550deed2481be7195af94c6fdaf90091bc3d2befba94945327f3e9ca6839a79b
SSDEEP 12288:DpsfSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:k0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17665F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 17e311376ae3a096cfbf6f54f6a36d0f3a8433841525f42b9b67429a5607dcd5
MD5 66ea4cc32e3192aa916f867af4712aa3
SHA1 deb376ec59d718f2d4a8ee8b18e1de79ded4a648
SHA512 3df65cc40401350d6d3a764e014f1e5ed4e51e4983beae33148937b398f2f0af2c2f850616934f21c29c6b3077a3ff3d4cc96a560c7f8cf0e497eca27485b6db
SSDEEP 12288:mEdu+mU3fFzdoo8pi2ysF0Z+7pYE5J0yBFAuOZ25e:mEUlUPBF60ZOY8JZBFAuc2I
TLSH
T1B5252850766AD75FC5AD40321E33C2CCAB707D01EE05AB0372C8972FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 077d824c77e7f89528a686ec854bdba5aecd8e022d644b2d941e103f76ae4b41
MD5 1ed23f2fdd2694be8e8a3d984d9cd87f
SHA1 a6d6862053f0893ee7044ecb6360e6c01b0665c5
SHA512 8def91d3ec82c95db8a6730365fe4ca224f835da4f984f0053b8e39afaf5fd3f54a17bd40932248bc48b6e550f3842828ad80c70bd9e346e88262c006657bb0c
SSDEEP 24576:2y6WvsFwYgy0gUDg+ieklGQydFCBoMKi7gzjZtr8168:2y6WvsFwYgyRUDg+ieklGQydFCBoMKit
TLSH
T16455C6816437A38FD1F76032076A5B4CA764EC0773096F266388553EDC2AB66A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 012386b2a197430b7d264677f54208607a38ffe5206a35cb44491a04a514de33
MD5 a6015c7f65ceb7035269f725cda1f94f
SHA1 cf86ef4635c9558cd2a52a893d89bc3d7a8393ce
SHA512 b6b59eb27b2b930b8ebbddd7c415e03d96ec737eb04e134568e748a7cb89b733235ec93b82ed47ef2783cacea6ad7576825f944a27cd5096e9312d5a0d3d85b8
SSDEEP 12288:kF76iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10A552393468D59B1FAFD0039857A8434B54D7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f53458f4855fe913daa46fcb7628e7274e6b9e60266dae16be9a275de7d6241b
MD5 60e992026295e7712039b23092818f81
SHA1 e6ece78e5ec37e2ed7e345ad73f7d31c8cc3b6ed
SHA512 d289a0a1c2651ba3932ae67b94e1f9fd019fbd13bb2081ed0ddc65f535c03e705a5b5143a22a9e0004980b4819dfae32ef0ef795acfe90ec125e9c713d090cf0
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Igb4mBIBhGFNLNiXicJFFRGNzj3
TLSH
T1A365AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c2eb5958009704c83f8cb3c5b61ac62e8cc3c26c06ff0348cc4b9cf10ef726f7
MD5 ca517d6649dc36423377a7a930f5b7b9
SHA1 a48012cbdb8ba5b4f8c071f1eae17ec94001da30
SHA512 7017985767b1a80547db2b688e6aff09ed3de6113e28811c1afb9373b282d556f5ef7050edf36ab608adf2e27d9bc000bc8dbb0b15a1c363333ceabbe2afcd0f
SSDEEP 24576:SG88u8FpJqH1vzria7/m9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J7ZFPqVya7/iLNiXicJFFRGNzj3
TLSH
T1CF85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 82d3345009567ea735c3d007bb1c887191a1e3d9e15a60c9e7f52b4b4c999400
MD5 f001d88bee5b9aac3c12a3b8ff7e073b
SHA1 bd181a84aa6e5ef9967a911c09196e18fed857f8
SHA512 09a66a1c59dedd93a94ee3aad8f58227a69a59c03f1364799a062f4eb40d2eb51ba6dd53ea94306ee1b6ef62a367d131b3be468d050a677ee5fba85638d51a50
SSDEEP 24576:0PUr+NQp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0JQpLNiXicJFFRGNzj3
TLSH
T17D65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6cf7c3ee7679edd211fdba2d96ecff150575ae44bd7335705325d38ea8e7195c
MD5 fa082dd230f55e9bd0cb98cc40ed9ccf
SHA1 6e621e8517bc503e6ede48a9be62aa9bb1a41f98
SHA512 f2088d944bdfdf454b44ad0183fadba91a5c872a73cc09d9a72d9ea51c990510a50888bee33503238f326cfebb80eca0c502220e6486b02849df621e3c1da88e
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZLNiXicJFFRGNzj3:cG05lO43bg7wRGpj3
TLSH
T1C8D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d6eef9280ff16677dc1b77d5c23b9c5f6f302bfb5293ab2b565ba636fe9f88d3
MD5 79008007ebe2f36109d737e96d396a8b
SHA1 3af028419bc56557e999ca3385f2844935f0c9f6
SHA512 50e3249dbe0d6aecb1310db20ebd799c5939cfc8d8b64df4447180e15b3098229732c19549923aee8ea9cda9f1f071e0acc16ddf33ace1d6d61a60d900ddc8db
SSDEEP 24576:Tfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn//TwSfVcYG3K/cJHlnFR+IGNe8jg:ra5POZ3lJt2pasx2+mRLNiXicJFFRGNf
TLSH
T18C65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8865c9acf8b150412dffdc47e356db91db688a243ccc70f6a4ffe59acef32dfa
MD5 3832b5bb15f0929447ac1ef166170452
SHA1 8e7ffd57d8b3361de0344bd1bb6e5d62a0938739
SHA512 5c1f384885dcacaefe31aa7374a7289e7af2f5f7075829439a1162fbe39add7a003c3be256f3dda0923b9b1e9751d81ee0fec1065c112dbc76e3381807ad57b6
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fk1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iNc/zEOVHFCLNiXicJFFRGNzj3
TLSH
T137858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a6e5ff7821461781204156f63ea0c69bf486a142f795423994edb48f9d5eb8ef
MD5 3688c73dc7b8548ce0edf7ae86e79f3d
SHA1 372930afd88db3b24465933fde16a488a38cd2f4
SHA512 c0081a5c6ceb09ddae21933f35b47d1fd4ac593b6cfa0d49f6dd9076926e64395641240a99aacab21708e21095004f4a8469ae642e06fa0cdafacb7f6ca08ee2
SSDEEP 24576:LzkNvNnaFeYhJNtmZBmz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LzMwBtOmzLNiXicJFFRGNzj3
TLSH
T13F55AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 65668ef1564bae66f5156fcc27480cadaec5a309da1b7fdb057a358ec5d498db
MD5 038c6557c27b9407ca6b97f7ad40485c
SHA1 b19ab1b530afd40ebd55ab8e91e32605ae4c696a
SHA512 145daa629c9ffb2aa0c64ce78749abb21c5f52e0d20d356874a0eb25d7fe8fc33406ae592e21f1937c7c91ed5b1b6a829c97c0aeb42d0147251a16c9c9fd212c
SSDEEP 24576:SD3FHshBIYQgAw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SDVHeBIAAwLNiXicJFFRGNzj3
TLSH
T15775E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-263-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/240-63-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/240-56-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1648-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1648-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1648-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1648-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1976-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1976-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1976-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1976-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1976-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1976-315-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2524-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2524-25-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2524-17-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2524-23-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2524-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2952-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2952-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2952-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2952-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2952-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2992-41-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2992-54-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2992-48-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/2992-43-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/2992-52-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/3252-134-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3252-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3252-128-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3252-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3252-138-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4044-97-0x0000000140000000-0x0000000140D60000-memory.dmp

Download

memory/4044-9-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4044-0-0x0000000140000000-0x0000000140D60000-memory.dmp

Download

memory/4044-1-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4124-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4124-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4124-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4124-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4124-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4124-329-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4764-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4764-123-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4764-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4764-314-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4820-290-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4820-69-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4820-75-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4820-67-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5004-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5004-85-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/5004-81-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/5004-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download