stealc | b1c4968adf6c649dc01f45860e30a08fd2dc983ee1553b065760ac8c0d6a7892

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260930-2wfgzazz2m
SHA256 b1c4968adf6c649dc01f45860e30a08fd2dc983ee1553b065760ac8c0d6a7892
MD5 2796e87e52b99df4debdebb010da2b38
SHA1 5c224766f38d81a660900f54241e148f0c8b8e54
SHA512 efe0ddfd43fcd07ae9dff2d93e612fe151d18b25a41a96d2de20a0769159356a7f3ca708e1ae0d322cb4ea5bed8617d6dadc6cb33c4aaa3675236b3dd93588ee
SSDEEP 24576:E1rZCoV+Mi2iBgFJO6/nw68pJpu1bAUwFrlR4lDnQ/tbw/2Mkjy6Fr7g0oT:E1rZgMiCMgnw6UJsFIFEFQ/lFTjN4
TLSH
T13885BF1B626901FCD0ABE17899574A06E775744A03709ACF07E056A72FB7BF16EBE300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 3 IoCs

resource	yara_rule
behavioral2/memory/4560-39-0x0000000140000000-0x00000001401B8000-memory.dmp	family_stealc_v3
behavioral2/memory/1192-89-0x0000000140000000-0x00000001401B8000-memory.dmp	family_stealc_v3
behavioral2/memory/1192-329-0x0000000140000000-0x00000001401B8000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
4204	elevation_service.exe
4180	elevation_service.exe
3456	maintenanceservice.exe
4152	OSE.EXE
704	PerceptionSimulationService.exe
4988	perfhost.exe
1376	ReFsDedupSvc.exe
3108	SensorDataService.exe
1924	ssh-agent.exe
4820	AgentService.exe
4880	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
	\??\F:\	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aa9ffcdc3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e331251f2f51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047e216da2e51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f66b91e2f51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009da307dc2e51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab0137da2e51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2d1e0dc2e51dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a51280d92e51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023f77fdb2e51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdec4bdb2e51dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e67b55db2e51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1192	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	1376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1376	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4820	AgentService.exe
Token: 33	4880	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4880	SearchIndexer.exe
Token: SeDebugPrivilege	4204	elevation_service.exe
Token: SeDebugPrivilege	4180	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4560	1192	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	89
PID 4880 wrote to memory of 4112	4880	SearchIndexer.exe	102
PID 4880 wrote to memory of 1068	4880	SearchIndexer.exe	103
PID 4880 wrote to memory of 1536	4880	SearchIndexer.exe	104
PID 4880 wrote to memory of 940	4880	SearchIndexer.exe	105
PID 4880 wrote to memory of 4284	4880	SearchIndexer.exe	107
PID 4880 wrote to memory of 5688	4880	SearchIndexer.exe	108
PID 4880 wrote to memory of 5404	4880	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe" install
  2⤵
  PID:4560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3456

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3108

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9e6a61e1eb44e1feabd80e1ac58f26ae2024aa590064b85e95a2ffa318695260
MD5 f33fbaf836765973db4fff6fd8cd086c
SHA1 daf879a9231080b75b785e5af8c4946fef94ba3d
SHA512 e4c1b8707b508fb51d98aa4f63bba789d15e7e5c01f661ffc23ed82878de9e4207a1f6704bb58fdd087bd1f9350b06abcf966d32d2564eb1ef9a820b63c589bb
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnsQ/lFTjN4:Q3q6HjBELm
TLSH
T165D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a88c4f2e9d4a313cab2c715e01e07382fbb3bce42eeade7a567c76e2521fdc1f
MD5 0695a03779c88e9edc7dfd31d0ca2c59
SHA1 802f448de98c80bddce9e967100fc986303b0920
SHA512 857505e533ed95b39cc7fafdd1418fde41a17470ec2d228c5409c9f3337ea5431f4c209fb8f46978419df98c4ea2dc0cfc5b1b23b1e14cab45030d786f509ede
SSDEEP 12288:L1XLsswWkxy2lRq2czA7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:xXYfDtczArnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T16965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8da6d4cfd0204afb250b06451d343233d55b4ef44fbb330797c56631742bc6d5
MD5 23f08a7f249e6d454a6bb4b96dae5a56
SHA1 4e6c78e239e96943115079289d0aa64fcde5484f
SHA512 9403e67e1e236088972c4786e279d2bc47a138c09e0afce5b2febad2d933a1cf8414705144d4cfa35a0e83dd2615e67eeba395f6701a264ee8554272317e1f1c
SSDEEP 24576:40Le5ji0hmxLrMEnQ/tbw/2Mkjy6Fr7g0oq:4Pji0AlZQ/lFTjN4
TLSH
T179859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2daade090e6f54d3a73b0bdf8278a99142a8fed6cfcaa72405659cf80eb6f033
MD5 88a8d8edb2f3acbc1924f3a55f92a1f3
SHA1 a6afa3e491fd215b9a60ae8900e89ba8d7c0252c
SHA512 de39f22597744355018d50e7dc8a2f13e362557c9499bb57d01101ea178afe23875604f03bab1a6ec78759a6afa578ee24d8e061e996cbac42390bbfc25fde38
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyuOnQ/tbw/2Mkjy6Fr7g0oV:B/ezSC6vUzPvxHjyVQ/lFTjN4
TLSH
T115755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 df2509fd78709fb95798cba2c870f61aeb32c68d5a586ae398aa55ef2abf4bc6
MD5 6115c927fc834b2b0a314f7808598302
SHA1 554e8817360e01be8ba2f6beb9818c67663d3268
SHA512 29132d5736e2e06b884ffa22ef77f90eb1367c19cbdfc8b45787adbe004419b5c5eca77647dda264ac16d7d27dde301fd23f0c7ba224b6a2355fe88c7f8157fc
SSDEEP 24576:pVbqPb88hv/l+6/nQ/tbw/2Mkjy6Fr7g0o6:pVO88hXl+gQ/lFTjN4
TLSH
T16D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 17f0e3e384ffee9f04bf5a18030b6ed495a39ea0478812e1ac040cd1c3366d2b
MD5 6063e5e6c2f20c34d7e9a0955b2a52aa
SHA1 398bc69619fedfd5e23dee42f28de6ad0e907d9f
SHA512 e8ea4ccfc00e741b398037537a0f878677d3b1cbe5c4d516a941c48df5dfe11c955e3ee2fb937d5b086f17b78b2951b7f3b2517a427c3fa904287a3021f1b547
SSDEEP 12288:TzIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:TzInQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1895523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 09850d44fe3f30b0d5d7a0452b26a05f2f059eeaab3d7cc61afade8fb94c5880
MD5 787fed965a54900bfa207d51a7db8b19
SHA1 ffb68cfb0e9be1e8dc72fe16919d21f3fca96204
SHA512 edcba80ef4a34142c2a9931d1bdc9bfb68c4e738682b816359a5c93b423eec735689022006fe18995f18e177c5a2a8d4eb79d037754f8f086cda7670a10cd573
SSDEEP 12288:geBNUbTVO86UXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:gJIU3nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1A075CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8190c1be769204714613fcb2e45d3eff44f312ff79289f008e7e545d52ddaf2c
MD5 45376a67b0fc38d2e3e52493ded0b50b
SHA1 20c2fd38822bfe6248d2992a8d1b3f8397fccaa9
SHA512 a2a3794f887731f4a262c220838da58d6dbee147c4208430e92841eac547979f0b72bd8c3707a66110992495ecfffe493fb054d73dd96e919630100583c88f86
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:lQvGAdlCEL8c/yRNw5CZLm
TLSH
T13C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5e2a5b1d9251e4b44d8a9b97af162e74bc0a9a7358de7ac7bd1ac0d297464bb9
MD5 f783ae1909820f140bf22cdab71fee2b
SHA1 b8d6fb73390c877110ed34dc884de6ce2312dc8a
SHA512 1ce20b0ee81d3443fbb2de8ee70dfc69d8ecb71ed39a257bfaffe97bfceaab2829d72bd44ac56892c51cd0d8b2ae0c2815e5caf6cbd74ce2f09a19c1b4b6e2cb
SSDEEP 12288:lAwSfxL/2Dc39DLLmt0LDQewsAj5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgm:GQewsAjJnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T16175E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d3346cd1427f82601e67f59abbf260cc100026198f7d6ecac904204a876fc095
MD5 2a401c4d568ebbe49d793a10959eaa8e
SHA1 08ec767a60f2810be6d3a04156a570cf68c877c6
SHA512 6fcc6c44508488b3410ae6b8052f8b0c6ee01c4328545f7cf4f313950de7eaa3e8575a8c3110a826306d6266fda5fbf9263f7bd54838424634898f84e447c7a2
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2L:sUEtQevvqc2W1cpV2EI32
TLSH
T1AE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f5898db3bde444db3c9ca701394b0130272b6fe92cf5b57da9d9f1fdee2a1feb
MD5 f74992b68e1b279b3b5ec8cc2c6b8251
SHA1 0929ee466cbc6f8eeeaa3e4b077bda4666c8fa27
SHA512 40fac2479c58d61aabec49b3e5dcf025deda7f0c185f9a9551b256a5deb174b94cb5ad512d08c1493c986b29f87e51bbadceb493c70501f574cee5a4b22495de
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zpQ/lFTjN4:MoqtVjnmlLm
TLSH
T1AAD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2aa0a3c71bda109d1222d33b2259047730bf8ed20d6fa38a51b91a1070d4d47b
MD5 2f1b179bf45804b27fa626211c823b96
SHA1 8fb4e93a642332fda4a2c493d996858fc88fc116
SHA512 745f0ff33fcb077862ec45c0ced8b5000ca14455e92748aa0f41834b3f501aa7c789e7fafcd758b59152a61115defed3ff4a841ee7b42c5a9fc005b0d97cf06c
SSDEEP 24576:yAhGLJIFoiwtA5l7S53KnQ/tbw/2Mkjy6Fr7g0ot:yAMyFoiq5aQ/lFTjN4
TLSH
T1CF35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5d8335c93e23b1d71bf066906ce7fd1b36039fe63370212ded93587c6551ea28
MD5 6678510d9598ff54e51355fc9fab233f
SHA1 fad55ab7efdc7df5d9840296ec1566df9cc4b815
SHA512 58158e004f9f2e339b3af9d97a1db8db39a6cf817eafa68b2863790d736e79163d57d3340fd98a26eafc3b51ebd2f51af9ff66934e2aea9136d766d89c057c1a
SSDEEP 12288:Imw5HEjsChN2BFgl0WDm+CuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMa:lwuHOW1nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1B265F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cd822144795d767917a9361b8aeccf830dcc0621e7baa5dbac32716cc61d98e5
MD5 c36fb7c8cd284d5d5087611d65323e8f
SHA1 8e3c5f755e5610776ed4f41fad4ee62dfce0bbce
SHA512 056d18c7e50829dc6487aee5779a4c18446314afdffa5b388300fcfeb1a1f54fbce12756a8b45a5c52d5f7ed1c5912a9497bcbd88c330c7854ace5064983556e
SSDEEP 12288:rXZ1IypGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:jZucnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T14B55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b4f77f56344a35fa052177139b99e24b81461f77418dd3c835c6b5885dcb22d3
MD5 7f18c70d4aff13f059af6f0297d442de
SHA1 0fbaa8d74f66967b122faaf62d5aa70c6f944fcf
SHA512 60fbc75a7f300e3b9b848eb407c68c8bc7ad3c451ef9ab8802e204a10d009de7a86509b5b9dfad31186afd36cc4defd0db8dd2238bb04f94b87d7745154c2a79
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:2QRQyi36YOcPQLvw2gAf+PN3oLm
TLSH
T166667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5d30b53fd99b74db5e5d9247c245c24efb5ed0ba03817eff064ea0fbf677b3c3
MD5 8963dc8bbe35436246749636eb802e08
SHA1 72e2f0a4ed457fc47c8d68073b2d03b96bd64756
SHA512 f74241e9330a54f067ce1d3246f9bed6b08f606830f83f4f30e3998491a3e413280ea76a6700976d8d3a1829a9670a0ae8453a36aecad96f9e44b862a41025a6
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:NQRQyi36YOcPQLvw2gAf+PN3oLm
TLSH
T15F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 17a70178a3046020403738777685affeb6f42ea2a2f05254c5259c04451a07d3
MD5 83b073ab646cffdd93ca45542ef4732b
SHA1 34d9aa0e403ef768885fcee04b6984b73dce8480
SHA512 248e57db245a9e4a22b6f82f78a3f63a0ec82e42837d183ce0d16fea981f1409d1adc3eb7ac5d971644908e1d0be6451fa3dfb9a2b7a6193ea927afcb7020745
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0snQ/tbw/2Mkjy63:F68Qg55nhheWu7PNU3/ZQ/lFTjN4
TLSH
T138B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 145431f0a3c937a83c7012e27a6fec8e2f11d72e01788241ddc907371e32eff9
MD5 9d660526a414cb5d0df896c280fc9d0e
SHA1 509cb252cb178eb4e25f739229f9d10622c5093f
SHA512 7a7cf4a09d4f97bc382cf66365af535795a76053dc649175d9f3135f542db92a93428f8b954a2b20c61e3a4e14951963de0c052f30b576c4b98da2eff9d210e0
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:yy5112gYy5azzVvL69nLKnhZrLm
TLSH
T174167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 89e7a69387ab615296e5e5053ee6f712f2fdfe231d4de3a0bb47546ebf0bf051
MD5 e5181e68806018c159415ea1eafa0cbd
SHA1 ccf3f2cdb8c6dbc3d0e98af88ccaaf106f82676b
SHA512 3e958a847933a7b34041ce78cf13d3739f30c050eb908a01206c93503c49b2b5cb96313b4dfb1a44eebf17fbb87a35e15f7f9817be6d81456f97c671c6b5fd34
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl7Q/lFTjN4:vu6JmVxd2dwLm
TLSH
T112D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 233319168f6622e60c5bdede70bf53c7387e2829c10dd8e8931336d0b2bfaf2b
MD5 8768c635f4602052c4bf0b92c39a0afd
SHA1 3459e8e02b7a1c9495714d2c3f0e26a473cb3083
SHA512 9defd3f03a05c69e00af01e2322c4e76f0423fbd4bf4af54325c672aea159cfbff09de25092c2b082d55ea9ba73708d28efdb13ec1389c9ffb625f0075dfa4a1
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4xXQ/lFTjN4:YmifPbRlLm
TLSH
T1ECB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 64530c2a35d42e17413066ad86be8e09a744be51cf11ce3db1baad31d06b6091
MD5 4c46efb0d0a90feb5b91d1d316671cf8
SHA1 296f039b49864a2a4aa1fb1608fe100c84ce114d
SHA512 0b921491782d5284d556fd4859f6916f8400fee95a1fcd250bec60becff18616ac4a56750432eb85965535cce569e3a6bea5fd94e1a122e74dfdc7225ea662d9
SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHqcQ/lFTjN4:l5dKTi61/Lm
TLSH
T186C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 42d2f0f468b3e2643616b0b14fb3558a5b89a9dbf6409c2510b8a103d4d722ab
MD5 e47bc9e799466bec1b4d34dfc1bbbe30
SHA1 8bc58bd8eb6f572f45bc426b43c5504f6ac64cbf
SHA512 7a96e79b6102213f9f22029e57a1aba79847aa29202ab3d847fcaf8c9b689614091b5ccc317f74e8cadddf519f1b9becaa04d70516d876b491cad36c304abb6c
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wrQ/lFTjN4:zX2iyphRLm
TLSH
T15B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b5530165ed1117cba0e42eeea8a925336f95980224aa914f23ae82232499f19c
MD5 80f9c9c34b0d06127e91f7db332a20bd
SHA1 e228d23dcea737573b70780e67e2db7e4ba7d2e7
SHA512 f449c737ff5f460c7776abbd8232c1bd14025c576846c8b049f1ca02b9d209a987482272ee2558793f633229102036ee84e515a010b17d91ba27e311e0141cf1
SSDEEP 12288:SAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:SgnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1A55523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dc800b83378788bf9dba6fab78e3ad719e9fb837b1110fb61da37f9d6faa590f
MD5 f3e1dc6a361e2f62de90ea3aedb0382e
SHA1 f1c39e990e2529e95f0e590497f64691511289c6
SHA512 c41f4e0433e09b9b23a0dceb2d1586289a15b12120366dd7e005f1aa5459d062b4131235c8af3dd80964a7320e567ba80b387458b05ee65450d255770fbf0e94
SSDEEP 12288:29GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:2dnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T10D5523697965F98BFB1706F14C828182973F0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9eee96a507851e1181ae74315badd8cccdb53d26e600109b5c70db2d6b44412f
MD5 9528eba320ecfa2a976009b25afaa36f
SHA1 aa2cf91626fb1f0fc1fc8b5396e15bafdd9a5f88
SHA512 15bf3e945418219966584be2013c64002a24f6dde86e5991eb407954d15a847113b1a7146a950b689343e4259ebd64aed5913fc047a8b3ab0c4a9ec584145ea3
SSDEEP 12288:avGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:aPnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1305523697965F98BFA1706F14C838182977F0EC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 42cdc4549a4095528682c378dfd1fa15205728dabe711f6cd0f627a48803a727
MD5 0f09f6f312bbac424712c9450b0aa54e
SHA1 b6f0ce663bd90ed675ea82021a74112d2923ba95
SHA512 d6cbace8f12a9156b8884e2531bd97bf47b04636afb5ccb2a7b476e3c27ee067067f1bf1f141ebc1cf67d160071f4b87b92a3835c1c5bb2ba5e2360920c66027
SSDEEP 12288:rVqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:MnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T15A5523693A69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d6cf3452989df78b633e16b9a02bd042dd06448aa8b285d6ff526e1d2159b5ff
MD5 3108d3a25313ea63f0c2305f8f2b6540
SHA1 fe778d6d5f97aa2392922556345ad5c8252930ed
SHA512 42d139fe5a835530146586192590bb41337bfacb5715277db736694950a00412b39c999f88e50857215e615914c48e8a96d2404dc7494e1c807a83c8cff937f6
SSDEEP 12288:+yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:+ynQ/tbw/2Mkjy6Fr7g0oB
TLSH
T19D5523697964F98BFA1706F14C838182977F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 953100f42db11330098e8961ec62007e19e41f4b09ff4c5dfd362eb309888a15
MD5 20b3d6d7e0c8a9174ed0fc1f8f727c2e
SHA1 e245296d50086e67b67ef0cdd7f89a6e92b29907
SHA512 5c20658f703f4f968dfdcd4f301c1e5f609368bdfa1fcff429296c8414ff6af454ddffb4ff9d662ac620614cb66b2cb5346f683cd2945d89369bd105dd9e05d8
SSDEEP 12288:axGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:aBnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1AB5523697964F98BFB2706F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 880ff62394dfa0241438a5706e915facb54813ed92402653e55e05f3ea766277
MD5 f72e21a5455e29e73855f69d12dc6dd3
SHA1 10c7cc6c6d0c63d2ea9a6799d5382680f7c9fd0d
SHA512 a024f6456f99bae994d75bf3a811ea3ae520bdb9c00873b8d60a5219bb4888419ee70294ac9b5e2a49261f7a369f1f783a360fa224460221a10b3ce672195199
SSDEEP 12288:2lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:2FnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1CF5523797964F98BFB2706F14C828182973B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 aa6210a5e05525f143c78e67a7ade754ec74b089e6efb4d251f1296773d7134a
MD5 1dc51e7a7c3d23596210656963530a18
SHA1 87156b568d41d490b2c30e1e113f909364298a98
SHA512 82a645be6f7824c4d5203592dc4f084999dd3d90cebd1c4b872a9c7f36b7090804b9a24ca0bc457b1efdb811dfa78c2dcc7557ce788df53a699b10e1530fbde4
SSDEEP 12288:IiZwbDzzFEoS2cPvydGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:LZM3zFVSO9nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1E37501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 751c6a610bd889b4fec8e3c6c8a867279877857901545b5354b7af991116bbe1
MD5 bb483eae4b127423e2a490de38313418
SHA1 a76569a106b464223fa25e04f18758eb1b4f06ea
SHA512 0892b4b0fead581579e74382bcc05f050f2abcecd44592c4a734bdd4d4867141c405736fadbb8ba32a0340b55c2ba49331945f124edd23749753847ed37ed701
SSDEEP 12288:VMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:VMnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1165523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 de3513c58c26d20c40dfdb2e511f7aef961a8e27fb5ce6d23cfeb2a00a8af8d5
MD5 97f367dcf4ee58bd2a2e9fc9b379a733
SHA1 9361e6cd854a0a991fc1765bbdf8c15e74a9c3ff
SHA512 7458a8c0d7584f5f14346f94cd74f705d91889cd1f5f71c82b00fc649ad12f51b93b0d81766f73c43d46eb819dbf6d45b27409595035cce3d34c415189b738a7
SSDEEP 12288:F4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:F4nQ/tbw/2Mkjy6Fr7g0os
TLSH
T1D55523697964F98BFB2706F54C828182973F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a33257585357a0e6f96bd8f05145abeb0161f89628adff4290635c3bd7f48c77
MD5 d9483fd8cc8717fd975300f11d123b63
SHA1 1ed8e3791a292b3f31e17b01a022dd19a0857aa7
SHA512 e288a8ba87fd0e8036789e4897631a8ef9a899429cfdb08d9a09dd1f116ec7be7037525059e2f9aa4fd3f90d0d02f9d20426a274f23d02b28a16eb1ab7167e7c
SSDEEP 12288:8yPz5L8pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:lzy5nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1CC65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 676a28a3aff7efafa9e6247602df07945b35b82d6c7813c5af9c529e47cc28d3
MD5 7abeb2a792e489ffbcddacb3c0021a06
SHA1 e3258389852b0825c77dc91ed6b11b54a9bbb9ba
SHA512 8dde81348a3640432c20d92a058c0b8eeca8825a10f7bc10c4181bb9ea58bcc0ddc13123163dc0d1d9f8f4a5b5e325cfb33d32be8ad50eea38f3bc21f2154599
SSDEEP 12288:KMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:KMnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T16F5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d14eb30315d86e4ca6e41496e227cf459a52684d08ab7571b815502361848e48
MD5 4c556c1b442cbfd9f56771cf56039511
SHA1 0c20aad61f2990639040f5b1cd1351910bfe3e64
SHA512 cd08edce8e25af3ea8a4e6cbd13a8586f530842a9a281ffa3e98e2a3e8c5ef28cd33bb0e33cdaae9512cb91bcdc3278470c33a441970f68e10897df815b63671
SSDEEP 12288:yMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:yMnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T18A5523697964F98BFB1706F54C828182973F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 af5ba58a02a7986db709b81893174d99a307f9b3ca97789555350297a3fe4fdb
MD5 46f6d727f7c6ed0b56a3329a8bc38d62
SHA1 5c3ea011d7afd16c1aa553eb6ca61f5be3c7ae0d
SHA512 3736e30583a40e5af7f59de7fa4521587235f09711114479c189694021b5312842b9ee72df0f3361cb2ef9a22b87b26f5565f5d5d55e6102629012065265a5d8
SSDEEP 12288:EyPz5L8pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:dzy5nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T14065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3799f436ba0dbbbc8497706c31c896328ba9d523221fe8462014b0336f52ebda
MD5 fa0b84340ece5515657f27073deb4929
SHA1 cfc0323d9adbd3e0c07871a50adbfd9ec21ab73b
SHA512 988f97ca9e88298d7b32dc5408f88d2b132315dbe194250156245ab827a9a1b1e9c1c68f00671a15fae814e28341550e507c4c1155fb0107c145ae0e1fa1629b
SSDEEP 24576:mT0aLl3z0zDfnQ/tbw/2Mkjy6Fr7g0oJ:mTDLljOQ/lFTjN4
TLSH
T17B7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 919ca1fed9610fd7b6dd18b76efb8a5597a0a706d746a4e0b2dd0d84abb1174b
MD5 c76cbee6202d3b6c5ad7ed817b74da77
SHA1 7f7a8a8e529c6b1efffcab0feed02409df328913
SHA512 c02187952347b5cd86ac1c74bc4c10ffcfe21f9c2748529db592e853045dfb02acd255f5ef88411499bc7567e9b4ac75ed88671a43d455dba32534c49325622c
SSDEEP 24576:G31d9CHKy7GZjnQ/tbw/2Mkjy6Fr7g0oK:o1d9CHKyaxQ/lFTjN4
TLSH
T16985CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8f0f590562251764419974d2ebeaae863002f14ee7d8c13c8a3136812edd8e1a
MD5 312f9fc9b9cd32439df47c39e4c79b48
SHA1 7a8c08e986ef46df127249f92b82361a2a7a5ea4
SHA512 95af1e8d2c1657e0a34b94b7fb4594c8e130be74c32663774e26456dd58dc7321fb0aedf71459ea707637d1a8e7a932340175da61f7422e55621e591cdd81bbd
SSDEEP 12288:/PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:/vnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1165523697965F98BFB1706F14C838182973B0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 090dc27fd0c139412e8059071ec9b949e3c64663a88bbbf53b6419327be013ec
MD5 18c020ae3810db95ab09184745725658
SHA1 98c4f2587e4a97df04a316ff09006ac5c9f30156
SHA512 f6439f4635b47c6725243264e0a5deeff651c8fc8e57ee654cbeca2c35f2d7dbdc875ec15c28bc42d392554ba2c42f1b1a559030b04a43fbbd9005866bb1ba07
SSDEEP 12288:+JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:+ZnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1585523797964F99BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d25d0caf16968007352645d53818206d78974b9fc2bc0905b0a15a1379ba3ca8
MD5 a52e95e786cdb1f7767e243281b2962d
SHA1 fcf472bab550ba4e06ccf3ddbee6b4e7c7a21538
SHA512 853c74fb483cf4633ffc1270be8c71b63a3084d50f180212f084af774da678adcd2a1e5eeca988b8fe2e8df27cad1037fb5dcc5c01c2b9c2cfda4b6485b0abe9
SSDEEP 12288:YWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:Y2nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1055523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f618f1f677ba28fc60711b983f5a2bc0baab42f7b73cabd29dfdc9cd0b43f9ef
MD5 efb1008b7293d40e6af886e8461ce6cc
SHA1 fa14176e7772136cd2777866c9ad1826e421453a
SHA512 080953182031cf8bd1788db76ddba94e2c9f2bb9ebb57da241393677f022cfc7b32d6d1cb319eb0173053677571f2fadafe58fc5cd494df293802d2d2aff10ed
SSDEEP 12288:7MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:7MnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1A55523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f533c850b235e549323a08e32d9707eafaf37831ac2fe6d2784f2d8f16c61bfa
MD5 47151c6a6367fa2f0126f4dcba8a18a1
SHA1 274f58f0c2cf27088a755fd8981863d9c1c47bf2
SHA512 8d179f9c701564dce7c48c35c9afa88884d5eb047b97a7c652f39136a01cbe19db44a9661c030ef85ebb9a830f90f0d4c69e9c155fe6128a2aad5fb21f0222c3
SSDEEP 12288:0PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:0vnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1705523697924F98BFB1706F14C828182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e2f8f6d76999837d453a9effea4521bf17694bf35e8e542aa7a58c2a614cdae3
MD5 a3913da290a54f980530e76e072cf74c
SHA1 92d996a8463f45ded4a9c8a729391091b1c218e8
SHA512 4b5fa9ec1b8ab0b31afb1e7b1ce9bce56dd96c8c0c18570007fb53107d57cb86476881ca28c103dba0479cf9214fc7a6ec2554c4e24e141a77b147165630b7ef
SSDEEP 12288:X0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:XUnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1525523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 47e3a3a0c5b334f51b302fcdbd067dcc398f7f35f974303487451323f9c36e62
MD5 627b422c19c3881ae24e3f2b41de77aa
SHA1 75fa97959ef694987821d7011dd05332c4b0b2ae
SHA512 32284409a2d7e05a946ea7538d0f3bf44772ef9a6c78638a47bee0632f4910f027c0ab398b0f7df6e9ac907b9b0dbcae5008c6e8d247d52d09afceeffab86405
SSDEEP 12288:5yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:5ynQ/tbw/2Mkjy6Fr7g0ok
TLSH
T11C5523697964F98BFA1706F14C8381829B7F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 9bb80ff6bd85ae41c0ccb9d240bd35d17409b7a94141677fd3d35639e46b3cf8
MD5 daa6f8874cd0d763151a3c4f7070347c
SHA1 35bb04aea39384e8aea80968f207c8afca39bbdf
SHA512 82ee2ec0277a3550ffc685887eb18d4501973b17e372695b5bca34e7d85f406c75b7d3c96cb82402cb1857db529df640fe8480a70539570b0d6dc01fc0f5ccb4
SSDEEP 12288:DHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:DnnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1345523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 15398799b71653a4b57fd3e78693c059402a00e7f1b492b6573f56aa96da8aae
MD5 dad1693afa90a77ca012b31d1b5b7414
SHA1 c7b9ba8822feae0b5dc90f7f76d2382c9702e19d
SHA512 39b2206020160b45aa93551d625905f18dbbc8ac8affa75479b96071cc81b6e5001aa2891dc75a8fd0e986a24abbdd624a6e2f71aea96f3e6027981133764e6d
SSDEEP 12288:iyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:iynQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1545523697964F98BFA1706F14C838182977F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 b72d34fd2cb6d27c63abe52f1aafc71c39c5d77746b2414496796dab7154083d
MD5 e768291d52a68d4280b60e232bd46bae
SHA1 372f4a3357449aa54810bd620c32978ac0b899a8
SHA512 71b9a98b976185b90cb8ab7e77e6dea71fa87327254b285998170bae5c04504ed590210383b9b51b90c9f5d0f577934a1b18d007e16afeb21851c3705262ad99
SSDEEP 24576:1fwv/k9RX6wkyAIonQ/tbw/2Mkjy6Fr7g0ox:kMnYIoQ/lFTjN4
TLSH
T13D85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8e05aeddadb5731e268295908b89560cd0325b347fa61b782284823bda12a6e7
MD5 a514755b323b205084484ac406130010
SHA1 d3b0c595a511500469d0abcd21f35be0eee966d5
SHA512 c5404fdd123bdc6d99bbb331629ff1fa7b99dfd31fdd066e213a3e1b6577b32855aae7c0ba3658072313070ce452590fa6cce5c278e73232626f8ee876237822
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LQ/lFTjN4:YySzPILm
TLSH
T1F3066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5f3e4fa67f8da3b60e05a8acf44a0480b8ac709b24ebff7bd9f062eab83c21e0
MD5 389d239e35fd2b010cc000ded2d3b173
SHA1 4db64475371d839591dbc22d4b68848af08a627d
SHA512 5d24921340e672999f81dd178891a8de9ad8344355b33dcf864ffbdc52265ad87d14387f30dff9f25cf291de3131386859e9aa9c5825608053402e3aff717cd4
SSDEEP 24576:f47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtnQ/tbw/2Mkjy6Fr7g0oU:f47JUQj1irIhCnDHUPfF/7Q/lFTjN4
TLSH
T16F65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3e50e3a75ce012dbffdc1312cb53651c8eadee3479a4ae335ff8d4d78c5fb68f
MD5 99bfa8c918038caab5a3c34b3baf64ee
SHA1 f319200a75856c08dce3ac39208e0589e9037ab1
SHA512 8cebab781ccffad3cade19b46b9d761d9fb2439eed24f0a056cc82a87ac68bb556e08587c3cc668946ac8284193752e9b9e21f55dce6d6f3791cd0f82588fc7d
SSDEEP 12288:NssfcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:dcnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T11765F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 ec9232e4b84e4007fb847971849f12c42d268af0befd5ecf0794a6d659596769
MD5 f9c1d7fc7d5d80f241299a9797f873c9
SHA1 a56fce5817a0b62fda0ab199fe8b7e10e17fafa6
SHA512 9edf954f4149e762b4525cb73f7b559d66f8f8344cf319ffee252f221e571004e76cd5bbe5c9106872dfd5f2e8642c4ec0b27570c1d181589a0378060dd26ddd
SSDEEP 12288:QucF2LBq4lGkUJsQwsgVtkhcCYQhC8ECQyPRM5pWI6LavxnHyA:ZfL/lqs1tZDIRPRM5YI6La5yA
TLSH
T1E65528107626DB5FC66980325E33D2CCAB707D01FE056F0773C98B3F9576A59BAA2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 e62fa283877870ac11c2b2d766943208028a359c8e73905ce8c8234ae0116bc7
MD5 725280593394089a677a4ae5aca78733
SHA1 4105a5e0c4dc735355825d63e775d697d0de0d5b
SHA512 888036d8ecfe76aa407b48b44e32028537205fb9a8051f46d1c34e271faa94c7a66e132b8652cefd3259447e2ee83c67edb77988f21e4a67933bfd83f3bd0227
SSDEEP 6144:hWdVE6taMq10u1AxIU7BMiKDeoHCnSbilf/8iKDeoHhmKvCqc8GbhjauABxixX:oEp8TeU7BMynSbilsxmiGFjauZX
TLSH
T139751A41A136A78FC5BA503203365B8DAB74EC06B7056F27B3C9453ADC6AB45B4F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d0c11a3a6d976c1f4a2f1819dc101ad8b899db16ea0e7f896bb00ae6626563c2
MD5 992f7d2f23d8f6d0174a654d65ea4edf
SHA1 9b88822939ff4e0aba4ec70f1366dc6c205ce58f
SHA512 dcdf2d7b73071e95a9843d0539cc99f1df9a8a481f06a4e2f25849ea9a36d61656cd3289af781f2d87e9be4b980bbc0f258ad0d81581f95ec06689fdbdd65774
SSDEEP 12288:t67EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:kknQ/tbw/2Mkjy6Fr7g0of
TLSH
T1455523656668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 bb1184df2aadcd81486dffc748c68bb8518cf91324412c7c29addf2e62bbca82
MD5 2ea9f71edeb84996abfe0737171aa56f
SHA1 f09fbb66349d5290c0991beab67c1f383c44521e
SHA512 e497adc3978034aeab081ac31615f1ea25ab56b6b5468b7a3fee579a108e3f3ede4c21f2575e3648a28ea16b047cae24441e85ee3ac0902aea49e9b2c409eb29
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYOnQ/tbw/2Mkjy6Fr7g0ot:Egb4mBIBhGFtQ/lFTjN4
TLSH
T1FE65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 63d7f3a0ef261f84931984797b006aea2ea22cf346d19c09793b2684f9430536
MD5 0f5e9b34c572984c844f4f57a1958e7a
SHA1 7e4faa2e1ae3f8a8d9ca4f4247cb1c2213bdc5a9
SHA512 8faccf53bf82b837d9d0e5b207e42aee942a27897ad02e34f682cc907524db05076204436eaf163468be130afa40aa6ff2320f83acfe191eecead7923595d5b3
SSDEEP 24576:EG88u8FpJqH1Qzria7/m9nQ/tbw/2Mkjy6Fr7g0o5:37ZFPqVva7/WQ/lFTjN4
TLSH
T11A85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9395eaad9d9fe5e3834baf076e8b9f7e36fb8ba7ca90c9bc713dd18cae59dac9
MD5 fa1f9aed8ad213dcfcf3106aef1c374e
SHA1 4c45968a802f61d78117b78e37aa1901a59a0f65
SHA512 af542facecdb37c3af20aa9f6a0479080e89e57bd4f5c6012d7b20807af987f6c4a0703ae0d58e89047a02824c8505d5b9f1b2c742c45785ae0e25d25f6f4af2
SSDEEP 12288:9HvUrBFrEjwaQhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:9PUr+NQxnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T15665E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e5b35915bf2b87c2b86bb239506c0d064c57941836a7a4d9f34185a860a71140
MD5 d61061d80765465423593c03a3211145
SHA1 a220396b08fa40698cc39dfba6377a4751171b2c
SHA512 16178685336ec2944d11d31e1f2a92ecb0635cfa4369b48dd914c7abe856c8195a8a3de8d01f141abdcbea39a3d7fb15396070ab3d5cee965f2382fc1276c9d0
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBQ/lFTjN4:kG05lO43bjLm
TLSH
T14BD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e6d14dafa2383718d58cea99d99aa34b79edad409bdf932f80813f96ad7ff357
MD5 2dee09a00be4488f71604eb1223ac027
SHA1 3bbe956261255608e39013e8520b50dea65438fa
SHA512 efc3173dd8bd65f9e5dbdd3f80cde5c4c8c64994186186dc30dfae3204426ef7e2e72861bee40e99a5a6d3ad6c2908a319b31bb164475330ee6f592d4616352f
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnLnQ/tbw/2Mkjy6Fr7g0oD:ha5POZ3+Jt2pasx2+mZQ/lFTjN4
TLSH
T16F65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b31a056162ae033ecd791bb4efb5cf3e2726996bc1ad21f5f5c693da6920b12a
MD5 ca15cef5834dec153ca35d34df31e32a
SHA1 9f4c30f54ad7c6bdde79dd51ff0234ae2ad22715
SHA512 14d04876f9c49a4fb1b6a0ee57dc42bdc2813b64c8ba7b29c43bff47d26721b663a679aa8dcb942ff7f170f4055df188ffdf8db28d8a76ef4a0a06a74bf1f774
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkVnQ/tbw/2Mkjy6Fr7g0o7:0Nc/zEOVHF2Q/lFTjN4
TLSH
T14E858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 594aa13426f9211ae57ce69b44cad53825dd53ab2fc324115d2480b265995876
MD5 9d940c5dc993fa5860b3b1523573d839
SHA1 6f30a0a682489c4bd439cec27de0372536451b36
SHA512 0a175d71c021bd1d57ebaabdcea33c1977a9cccd32403fbfe80db21285adbc461eea0a92e1ba35ab9265f1e8ed961cd79b659f494baa4492e990bf93c1e33299
SSDEEP 24576:m8kNvNnaFeYhJNtmZBmnnQ/tbw/2Mkjy6Fr7g0of:m8MwBtOmnQ/lFTjN4
TLSH
T11855AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3f47e10a817f20e3ac98982a3b19c856bcef1f9dc4e92cb7d56a6e3397be7d1d
MD5 c113836d09de97bf4cca96e0a429c001
SHA1 7018a4d9e969615710dd7159191bbf895fe8e11c
SHA512 d0cbf0342dd2d8e3f52ff5c833c5cbfbf16510c96616ad74ce72957db08cdd994112b5d5c1e3069d98001d972e565d51a6397e628f86460e5e0840015a82ffae
SSDEEP 24576:vD3FHshBIYQgAAnQ/tbw/2Mkjy6Fr7g0oX:vDVHeBIAAAQ/lFTjN4
TLSH
T12C75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-79-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/704-321-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/704-85-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/704-77-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1192-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1192-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1192-329-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1192-0-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1192-325-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1192-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1192-89-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1376-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1376-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1376-397-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1376-396-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1376-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1924-127-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1924-126-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1924-380-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1924-133-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3108-119-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3108-113-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3108-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3108-383-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3108-382-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3108-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3456-64-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3456-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3456-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3456-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3456-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4152-73-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4152-320-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4152-66-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4152-67-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4180-248-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4180-47-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4180-41-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4180-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4204-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4204-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4204-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4204-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4204-16-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4560-36-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4560-39-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4560-13-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4560-33-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4560-34-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4560-26-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4820-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4820-145-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4820-149-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4820-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4820-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4880-384-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4880-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4880-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4880-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4988-96-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4988-92-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4988-90-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4988-322-0x0000000000400000-0x0000000000542000-memory.dmp

Download