b98af347c2e7f4169d52cbaca3eab17a90c8acb427961a988330a882be915073

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 1.2MB
Sample261024-1cldfaes9j
SHA256 b98af347c2e7f4169d52cbaca3eab17a90c8acb427961a988330a882be915073
MD5 1096026ac80d1ac23d990e6dc4918268
SHA1 56aaf7485905592372651b39a48ec1b7a110c31e
SHA512 9a491e9de76bacb0b97a4cd50146e19c63fa4bdc60cf66b8add3a7b278c5a4c0872a9f5e43e6bdd35434b163ce9c4596172d7d1d338e84d8291858a019ec8ef2
SSDEEP 24576:Fm+GnKuKvV6+CtEVXXC8Ac2YV3swxhZPegenZPwC7:hGnKZsAWh4sCdegmZz
TLSH
T1C445BF43F94685DCDA6EC07D871681326632B88947306AFB21946F3C3E6BDD61E7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2280	elevation_service.exe
1632	elevation_service.exe
1764	maintenanceservice.exe
3048	OSE.EXE
3860	PerceptionSimulationService.exe
4640	perfhost.exe
4416	ReFsDedupSvc.exe
244	SensorDataService.exe
5404	ssh-agent.exe
2012	AgentService.exe
2372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eca3afe0227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000084641edfe63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013b46ee9fe63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007425ec2cff63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a0681e9fe63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3fec22cff63dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000963cc8e9fe63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f21962cff63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe
2280	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	2012	AgentService.exe
Token: 33	2372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeBackupPrivilege	4416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4416	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3704	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	2280	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3456	2372	SearchIndexer.exe	101
PID 2372 wrote to memory of 6000	2372	SearchIndexer.exe	102
PID 2372 wrote to memory of 4824	2372	SearchIndexer.exe	103
PID 2372 wrote to memory of 4772	2372	SearchIndexer.exe	104
PID 2372 wrote to memory of 6140	2372	SearchIndexer.exe	106
PID 2372 wrote to memory of 1400	2372	SearchIndexer.exe	107
PID 2372 wrote to memory of 4132	2372	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1764

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4640

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 79cc69e71da7327a4b46715971b9e98afe3229e0c90d23ac2e9918869b68e297
MD5 59113c92776490e43f0fd1f39396d456
SHA1 f4e0101d89a1ec652eb1fdda33e715e6d1b9cb42
SHA512 71e416be03b9e310138e77c98f6686364828aa7dd1094c968f4f75c6ffa14f1b83359dbcaf2d61d850a050b63518289925cfb9ed3eeef2a982008c4e12aaa082
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnaWh4sCdegmZz:d3q6HjBXWIURZz
TLSH
T112D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 da1b3b48bfb0083d4b79722588d6b76f215fdb69fe538c561db1da2e98dd8937
MD5 0572d194f5d92a215618a30641b92fed
SHA1 6f076b947c7d8cfe9c6aed0e7bc1b7e4342d5b04
SHA512 7fcdc25bef41fe36677f7ff27d3c086d98db5bbafde3fe82153dcc641e70df37f53b54fa67aecbb39917504f5fcd4656bfdc2d514ace86ee40ee551425c07f59
SSDEEP 24576:JXYfDtczA5VXXC8Ac2YV3swxhZPegenZPwC7:stc0Wh4sCdegmZz
TLSH
T1D6050228A79508F9ED7B827CCCA1C515E633BC544360EB9B03E09A261F376D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 40641fb802eba69eb43c93ec9b6ae6038ae6b590895c7b87dc1082847246dc81
MD5 1be5631f45811b7c84e2a71d8816ebb3
SHA1 2864f61cc40ae101a74d4a5f8c15e7c19d2fc7a9
SHA512 1c0a99a82528000ee5c5dbd6e0b409f0c85287f2cd0178f6a5fea24d3feeadc1ec64788df490b5eb629422417685d748ab209254ce34c0274e6627970e877634
SSDEEP 24576:00Le5ji0hmxirMEVXXC8Ac2YV3swxhZPegenZPwC7:0Pji0AcJWh4sCdegmZz
TLSH
T16C35AE26F6748335D073C0B9C5D2A68EED71348257308ACB4286D77C7E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2ce584daef7fbc3f24e175ee995fbaa44dd3fc7f149bd2cf40fa5c595ac1c4e6
MD5 0a66196a0c73c6a39d35f1c5147b2bac
SHA1 75773bf796c6e4ded7692f22b35a7f96a8b17fc2
SHA512 766b2b5eaecd9846bcbadff6c2607d1023fe887b36184001c0a4ccb880f8ffccf656e28aaae9735c82fe5ca8015cd27ee69d282131b3d05d763319ddad25c228
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyuSVXXC8Ac2YV3swxhZPegenZPwC7:f/ezSC6vUzPvxHjyFWh4sCdegmZz
TLSH
T1AB756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2423c311825eea7d7f04771079b1ef93d89b1da535842fc8ca5da2fb091ef576
MD5 bc1637e6d0d22dc11ca063b5b4f47ec0
SHA1 81ba19e84d5c66528ef4121865f10d0c9e09a0a2
SHA512 9ad8ad2dd7215e0700a04469a8f4303006f91d5759fd943e1c59d2bf88fe783ce9e0b6ee9f77ba85c7d895f2b73ee7a78ade225d1a3b93430d27ca6cd2fc5cff
SSDEEP 24576:oVbqPb88hv/l+69VXXC8Ac2YV3swxhZPegenZPwC7:oVO88hXl+eWh4sCdegmZz
TLSH
T15B559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 c53c153447045e1144810b9f69a5420e44217b2a8bd569f3e2f9e543ea8f8f64
MD5 4baa4e8d4d4e85d81570cd9c1de75b06
SHA1 78d922aa5c6b466405be4195f2a0d5545cb227ea
SHA512 34568116534449cc78b09be50b573d0eaf0d37e10940576c4f9eb43698df8bd6ad81150f62f626b285af4b83bc79809fab3b860356d145bcd789cfaea81f47e2
SSDEEP 12288:4RIVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:4RIVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1EDC423A2CE0A9467F7BF0674DDE4E7DDE2289F449084CD2992917F1A6C3C89DA432533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0076849fd0dfe79cb4954b97f4594e7127529d09aa1f4fe95e15e149090769a8
MD5 1fb96c60553f1d89371f858dc48e5bd7
SHA1 4c9b06f5548b1f1fb7476a2459f29f643d7feaad
SHA512 3a6dfe4b4d020f59d66f4be4eeb06a5614dc99dbc475b1cc41b1cb42cd47df604edad20dd86df7343a1f6f72891cf0781792d0cde01d8825d09077b42c6709fc
SSDEEP 12288:0eBNUbTVO86UlVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:0JIUlVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1F305CF3BEE28ECE2C27E4DB85A918340E77278304B61A3CBD165830E9E275E55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fc65d5a2947ae5b007e6a6e4526368224e5ecb170139656ac1f9bcc5cf6e00f5
MD5 4f34d852f2f94e508e6493c596e88c98
SHA1 5078aa65a472f89ecf0ce9036454e47dcaefe5a6
SHA512 60b817ba0d2fbfb4e99ebfc2e34b21147aae92bbc2ca877536e294d9fd0d49a3ff19ff48a3f77be43d94c4138baa40e227166dddc2aeb0ca31bd6da7c7cdf24b
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:TQvGAdlCEL8c/yRNw5CUWIURZz
TLSH
T117266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 4e6f8c13f6c4ac624566fd213c1db97f0824f56809722052f8d764520bb1d796
MD5 8af468348d6ae0517ea9eb08b97d4ba1
SHA1 15cf45b23d9a1a0582b224b8497e8278199a9ac1
SHA512 a119b1ad3d97870645d0c865b6a8fd13fba8608b794271aeec0d93d0356255235a9f4e76d3190f8ca5113a688bf27c65679e4fc1088f8e468777d7f444025846
SSDEEP 24576:ddewsAjjVXXC8Ac2YV3swxhZPegenZPwC7:TljZWh4sCdegmZz
TLSH
T19E15E031FE75E036D3BF0DB61B65C716542CAE204B911AC3E3E89E9E59341D22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3fb205e535a2f6d7cc235644746039814536730669f241fecd17a161120bd3fd
MD5 82e1a330ae3208b833d6d6516ab32eb2
SHA1 a1c3cf74e83cc0e2ef8c9196830bcaa42ea294c4
SHA512 80349570b5fa15e831fc7fc0ae3837b5cc1ed6e1a24f37bb5774ab163bb4f21e742e7f3cd0570dc67b219f8b67e46855bdae3ceb5288c63cdd7c2b3018ec15e8
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4p:2UEtQevvqc2W1cpV2EI328
TLSH
T1CC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2345edddddf6f4627f671142ee533c1b41941ee27948565ee2ca97cf26d5b96b
MD5 749f415360c0a394d56eaadecbb6df52
SHA1 62135ea89334d9b8d62b2b4c37c2fa850ecfd32f
SHA512 83fc0f0465310229666778d9863b1c9d6335fd8dcbecb9db25f933c4a135fcb2c04d6672286e099295e895f42f80c17789f08c9e5c8415f3c9517e82b80da47d
SSDEEP 49152:ECbRquA/m2yL5zLfFiV+XenmE3/z5Wh4sCdegmZz:Noq2VjnmAWIURZz
TLSH
T137D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 44a255ed945b1670b47c03922de35bf9218f8fc792dff1cc776d77fbc66893c1
MD5 034daaae0494fceb3ed50badc075646b
SHA1 ce6f80626a73c0255fe110863476d00553ae6a61
SHA512 135290e32ad3f7b7cb82da41888715cd0f919b9447eee03953d90cca1233352f8a014395f0d4554ea3fe4306c1c12e33ed8ddcbbc682f7e715d5d0f0c59e9832
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53OVXXC8Ac2YV3swxhZPegenZPwC7:ZAMyFoiq5QWh4sCdegmZz
TLSH
T11935AD81EBF955D4F5B3AAB899B69170EA76BCA55E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 51947d5099342a20aacd6d4d6b4f84a25563e2d2842b96826c9200ceac7d7bea
MD5 ea6000d84ab0f54b7ecb181deeeb0a22
SHA1 543e5fd96fab4927118d00a11931ae2bbb02b7d2
SHA512 2c69de08518ac051762217753dba4b3cb0ab4387a2fe0505255d7789422d8adfa519bf101b3a30ed7c625f3929957efd4a2a6a770b0342462b2891f806a50132
SSDEEP 24576:awuoOWvVXXC8Ac2YV3swxhZPegenZPwC7:awDO8Wh4sCdegmZz
TLSH
T1A305F14666A50CF9E9774238C997C136F7B2BC012A24DB1F5360C75B6F37261BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ba627d1b6da1ed4e60b93b52b8a7992d4420dd34a7f3cecc29f330b17cc689b3
MD5 994c2fbf794fcf8f9dbae667cd73dd74
SHA1 48a47b41407d0275df5fecb1790b3ed7b209518f
SHA512 6ad12a203820d6a0f895d630b2b712e4395cb00d19b12351009b37d26016ac73b011e8c64bc3be61e5aece606adf5cb61f43a1a1ce2d4b2963819d9808a744ff
SSDEEP 12288:lBZ1IyTVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:TZuMVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T15CE4129A279460FAF2BB4278CDE09789E371BC51637487CF4251576A2E3A8C52C36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0c6a49602aba778ddc985990e030e6d5a8fefc8e02f095721b9f768785062ce3
MD5 d222fd03c6d5321fcc8abb0a6a45816d
SHA1 e2c721efcb56f65469fab369f6d22d0da8fbc30e
SHA512 488f0bc10044b54f8bab98395d579367982df303c2e23ba2cee612e9763214c8b7d9560287a12e637f5ec6b2f7904ba57924694d4b0d5e8fe234af1424f68ab2
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:BQRQyi36YOcPQLvw2gAf+PN37WIURZz
TLSH
T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 437f5653c0436736356449865f376b90a960829f2e420b09d0f6ee67d1307a16
MD5 75b447b641ff23f1814394efe6cd16f9
SHA1 e79f65b8a03883b3f9f5edc689a9f56516f404b2
SHA512 0da7d4ca0b12ca4990591e5bfa1b2f78f87fea97919724d9045e88a0a23195f8a735799aafee833a9f06e457c425d270f6ff4fbace14c9fc601f31d643ac32c2
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:iQRQyi36YOcPQLvw2gAf+PN37WIURZz
TLSH
T136667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c4b3445d258200608323c68675077c0749a58b55b9d8956fe509bfd7af972a31
MD5 3ed5e0d5af10b7876b2c2374be177907
SHA1 6ad640baee442fc9b129b1d2d28d79c198e31d81
SHA512 f19684e652a5413eb72d56f3adc8078fd12e4a7a4b6089d03c307b285cb0ab45b02dd03037cc781f932df3af86d8af47f02200e91e825a156166b4189fb6849f
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0cVXXC8Ac2YV3swM:i68Qg55nhheWu7PNU3/JWh4sCdegmZz
TLSH
T199B54933B2F600A9D45DE1769F4A872196D17C758FE0E7DB8101720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a20d9d53dcded0ec08abfd8873e2ab3a7d7ddcea70ff0da93ab5c2461fc4b97a
MD5 57906ed1809bf3dd6d239edb59debf42
SHA1 7863683e2c0c93a2c580626ac30f3fea6eafa7af
SHA512 bf6b09881112c956d28f6a1760b7086c05047dc62b66a8327fd9deee81a4246aba46aef43a44577b761fdc8053edffac9db0bc941c7303e3d1884ed612dd89fd
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:ry5112gYy5azzVvL69nLKnhZmWIURZz
TLSH
T179167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c94d7e539fa45b68508c0c4e162adab39209eaf345c571958bb24cd57df36420
MD5 0c28dc5f28ca64a3c41ea22a75f523cc
SHA1 e349d7aa2b44ee3c46d6d2b4589a522d2e1172d9
SHA512 2b7dae3f70c7cac7873cf72d1916898b97ab4bc14238db4dccd4b847a368e543f2c0b9b5d462ed10184021ae2e56cd55382a77a9062f9eec807b873938353b15
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzWh4sCdegmZz:Qu6JmVxd2dzWIURZz
TLSH
T145D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6d2bd88b0eba9d5bd6b300a078879f19dbe4464f5b4bb0b7874954b72c6421d0
MD5 8e59b87df147eabab2796c5cad64bc27
SHA1 274a412c15fc906c3c486573467dd83a3aa004c5
SHA512 e1a54ce42c79784278e54d2fac9f5143692d691c49383ca6644acde35a2da31641f4f537b048e5e9f63df1b1f6a0126efb908cf14ca41641ae5391c106275b23
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4x/Wh4sCdegmZz:+mifPbRAWIURZz
TLSH
T1B1B5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d030c1967de39e901a61fec579d5e1c7be200dcd43a43dfc9c0845e4a1cdcf3d
MD5 41e26e6819948f1a5b3225c3474a1ad3
SHA1 041f6c738f6a74246b58f60816261a55575ecb5f
SHA512 46737c6aaf7e2b074877850728df873764f9705ff8ac4407d2c7a2f6c04577941efc69fd010bf9be99a5a15057b797f10726d043b7a8995c3a5f94b55f5c3fe6
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqqWh4sCdegmZz:u5dKTi61qWIURZz
TLSH
T19FC5BE03F2E940E8E0BED674CB659232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 60dc77db830741717b77040aaf0642000410a47f2635efea51f8c507a04604cf
MD5 25ecd7565f10a6221d58e951d8a1628f
SHA1 4af3a99b8a747e679692240708c6aede6e920d3b
SHA512 909e8b76e70ae332d90bfb5e0602d4c8c98f9fad11f0ea6aa930a084235392b08db321e42140030596d6b75b6d9d216a450a912a1178ca10c21673e119f77a59
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wDWh4sCdegmZz:AX2iyphcWIURZz
TLSH
T18695BF13F2D900E8D06ED174C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 8645c498829463d675abe7430bf50aa7caee6cd81f626c5138820dad2d9c32b4
MD5 ba2b23e5feec272c0f867d04659d9ef7
SHA1 f7bf80ed0f9d4dc21277cb2458086aa206d99e38
SHA512 86ac11509c9738c27e3b55ed7ea745885e9370125a2b8ebcd285f6ee256d3c07d2f2103a544b51b0ed698f761d22b63f6708200765ec224b8616da8edcaa9f3e
SSDEEP 12288:iQVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:iQVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T186C423A5CD0B846BF37F46B4CDE093DCE2289F54A1848D6A92827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0163f74c611353ea2c45346673822eae9e57efb25bcd574a48178c0b21e5a870
MD5 ca86a114cc5023ef7cb82c67c1ff2c7b
SHA1 45b159e24186c081cb17a1e33b47b9c383489aa7
SHA512 1e6a8c2d33c587904d534280f87658b7a3c3e46c26c8edea8a711ee7c1cc27ceab0b140ed7228fa5478d6b607242aef94509c5be53ac6413981821f776ebd0bc
SSDEEP 12288:zHVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:zHVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T123C423A5CD0B846BF27F46B4CEE0D3DCE2289F54A184CD6A92817A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9006c3605a4b2e6e04ef0d078456d90674d492c25fd1cca4b1e9fcb664a2821d
MD5 f0c8f4a1fe4faa628bd73ba578f910d9
SHA1 3ae25c0484ca48c021881ac3e360df2d555dfc29
SHA512 4c7c8b49af2648a0c97a03f08e60ea7f8d649fbcf10567bce68e5f67e47089a20f79ddb5d3f91fb6d1d0eff8f5d627796b709dc8e69b8a014dd5d603c7590df3
SSDEEP 12288:xNVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:xNVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C5C423A5CD0B846BF27F46B4CDE093DCE6289F44A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 42dbfe1fbca8e2778a2d70305e93e26381011522be82b6a5aa6970d35a57fa4d
MD5 22d457dc9abeb00b2a8dba12e34bcfed
SHA1 c8494961ac9c1929554aecb19d6a6a033c9ad2aa
SHA512 70ab2f6d5c9bef475bba9ccbb7f68fc3b6f1c66ed441d735c12f622c0592ef366d9cb507ef2c3bd0985b81d031df792680452775523a5aeab394208ffe6e7965
SSDEEP 12288:AVuVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:VVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T12DD423519E1A40E6F57B8774CDE0D3D8E378BF94A264CA6F93411E1A2C784987831B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 9610bf4346858f9f1b573f9b618b1033546729c53db6e82c8ef5c55177c4602c
MD5 13f3cec5af8a126bdd78f13c2d90e221
SHA1 0b4c2467a6eac571a19c9d6b7f910e06169432a4
SHA512 c3e393ed3e84aa364ce2e811c5bdf673bfb1204516acdd4de5c78a7e7b6dae31dc73e7ef3a7dc46677820a44dbd3ffdd3227e4fdd10f1f3a2c51fe3e42e68904
SSDEEP 12288:bmVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:bmVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B5C423A5CD0B846BF27F46B4CDE093DCE6289F54A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 220330b2bd08696f597c35f2ac1b0d2da08e152dcd44b25e01b7cc31e4305da2
MD5 ec1c1e524aef023aa2e501bd3f78bda4
SHA1 b4fe66731e8313e9ed07df7a984553bb98d33d42
SHA512 0280633b92900f03fc50327c9a50a4ea0a155e16d16c71631df2559231ff2fb35711158b22595837676fea23060ea7c1d0894c501c349e03993dda2f9d9f2f9b
SSDEEP 12288:tLVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:tLVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D1C423A5CD0B846BF37F46B4CDE093DCE2289F54A184CD6A92827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 088251c7ff9efd281022a0ffa3195122e0ba635371136df857ed1ec4c14c620a
MD5 e0b72e2b9a3a07be890a0392eee746e9
SHA1 3485f51b934090df2f0ca3d7b457010ef5f8beaa
SHA512 8cf656c345d938dc7e8d08612f6745dde60f57b0c437fe20c55accccc8a6b2a40ac60ba2b3b69c1e2fbd4a7224f8b166b5ad5b11d79f674f99c67ff7051d4563
SSDEEP 12288:h/VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:h/VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D9C423A5CD07846BF37F46B4CEE093DCE2289F54A094CD6AE2826A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d238b1f8fc4d21986693fe24cc302dac2c271474679a0fd9d0323e582aad8faa
MD5 ab4d7724079e81b0950e93e00e38abf7
SHA1 803a5795e5b6aec11eb8bb5b32e199cc274db0c7
SHA512 bfe0e421f85c7c1e3afa4a5fea68383ce3b6696598bd268dca74fe4f91c821bd30be55d3bf08d1033b386d224c04542b4705ce5ac141c1e405292d846fe87403
SSDEEP 24576:7ZMSzFVSOnVXXC8Ac2YV3swxhZPegenZPwC7:7ZMSzfhWh4sCdegmZz
TLSH
T1350501A5B35018F9ED77823DCD658A45D2B2BC590760CA1F03E4362B5F372A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e4b7f90a19d64d5a9ffe48e6c5ed18b5fa93d3f39c7723a949882acc49ef982e
MD5 3a3a17ff6dcbd7e42e67bcfde3b24168
SHA1 4e2c81c528857c9eb82958a5dbcfd9f40ec8e2a6
SHA512 b4b8e191efff3a97c1c59476c881d954c1f7f47103270fe92eff536cb6768b98bd6a03fa9bb27c6fc7cf47b7cf748639d2ab241d6381b23df3f444552824506a
SSDEEP 12288:Z8VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:Z8VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1ACC423A5CD1B846BF27E06B4CDE093DCD6289F54A0848D6AD2826A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 cb3e2ba8c55e1c7120d88056ffb3e3e534cee97007016d27fbfdfd35372c07c0
MD5 37779eed0e29c5766c8d6a51461a59c5
SHA1 a5d9a643b11cb9dda53c037a1157099df2cc6912
SHA512 5fe7513193a7a203683f724cf80c95771a35200b09a1fd983349f2a32df616884b950e401987a851b460153c2d00e9f727a9ef6bb83d89028cf1ef85c7328712
SSDEEP 12288:w4VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:w4VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C0C423A5CD0B846BF27F06B4CEE093DCE62C9F54A084CD6AD2826A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0e5aff93d9cd9195fb2c36bc0af01531519f1b411d67ae5b4bd93b60e99dc06f
MD5 5a373a44026d89decfd95e788b1c9dae
SHA1 eaf12e25e183b932a11284f17ab32f2d2b423cc9
SHA512 ab45cc858839993609eb507bbc0086a67a59b796c4bba6d5d73100b852645e2194c0b693f15ecdb0cd90aa339dd470055dbae5d080730f3b0fbf4c07b45832ab
SSDEEP 12288:UyPz5L8TVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:NzyTVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T134F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 de04565e513b76b1b4d27af2870897cfd6c1042dfb7c7df46fe3b69003c277fa
MD5 f6522c112b8f1337a6d4f235c746c560
SHA1 c5ae6cc7ef3a6aef577887c947d377ce53fc97e6
SHA512 4385c6f650a8567bcaff8d09a9d5f8add3673887e1591bb4bfb95c36e5284de4cd5a2ce5d00b2a5ecb1be6703a1c6d1e46dd2453e56ed4e0d3572a2f5d0bd1ce
SSDEEP 12288:P8VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:P8VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1DDC423A5CD07846BF27F06B4CEE093DCE6289F94A094CD6AD2827A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 2d4fad2566ad73320909d6f6bdd11ac673a2aa46a57677891eb08620458ccc31
MD5 331bfc15da5e9f5e9620666a596cc494
SHA1 ffcdef3be3a7414ca1a4263cef122ba30401fc63
SHA512 39bdaa6d5c6405bf2db8598e2d360b051abc56c840b6d8ba058954a3a0201459487336438a6bd19bee45950b2ee13cd02a3c586c63fd7d2fe81c7825048b341e
SSDEEP 12288:q8VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:q8VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1F7C423A5CD07846BF27E06B4CEE093DCE6289F94A094CD6AD2826A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0734c148a50a83bb0f479f80e827a9345e5f3e0c484bf4745e344b31688839d3
MD5 f982839710967f3fb63b55cccbbffd5c
SHA1 25ad035be186d93e643c73d915a4bbe840b09777
SHA512 a461003661130c886a7f265a0cf55883aa102861d682630fb7ae5816d9174c2601459647e091b3e3d52da7cafc3ce8918e3b00c09c0251acc69737d8f9208e4c
SSDEEP 12288:VyPz5L8TVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:8zyTVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1A0F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 cad6a14b9fb70350e64d57e317cb10c7a349a01c96ac64560694dbd1dac2cab1
MD5 74f8f1d833e0e9fa5e7c9d3ae135c3bd
SHA1 b27bf19bccae1117166db1c28b4a57040d9c185d
SHA512 50b01d6db17a6110b89ab68ddf3c08e5cc765349553abf0effb5709aeeae4c51c80ccc55c5b405365469274f925cce275fb3b7b91de03382edbe16a8b41fa95e
SSDEEP 24576:7THaLl3z0zDdVXXC8Ac2YV3swxhZPegenZPwC7:7T6LljEWh4sCdegmZz
TLSH
T17A0502A5B35018F9ED77823ECD658A46D2B27C590760CA1F03E4362B5F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 18e957728ce8c62f1dbc64bcfd909d1044cc9bfdaa220e0cdb4ecb71c0f19f18
MD5 aa53667bb49c236d60a48a664748130d
SHA1 d85581bba63b2b8a2bcb98d33b7a3112be0d002f
SHA512 5b6d7d3dec806f008b9d18d68d7759cec243949d7ec8db7704c8d9f27f9503c7c13687cfa8e134642eba6769b548bd3bafc0114db3417e553d236d1974bf7aab
SSDEEP 24576:K37d9CHKy7GZBVXXC8Ac2YV3swxhZPegenZPwC7:s7d9CHKyahWh4sCdegmZz
TLSH
T1BD25CE90F3E414E9F1B78A35CD769611DA767C991B60CE8F03A4261A1E33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 71c28cdd24cad7a4cc538ef563954b2a27153fd87de0c677c9249eadbcadd848
MD5 291b4731dd3c252f9ff4fb1286b468c4
SHA1 7c694ab438b1f92c3ce3fc6c9beda2306da022e2
SHA512 9478e98aea2eb6b89b154b1f00fbd6f226694075b614159738dc543719b86183076b7dfbc38f87d1f57e4887060563277cb0d9ff6cf6538ce8b39347ced56ce6
SSDEEP 12288:7tVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:7tVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T161C423A5CD0B846BF27F06B4CDE093DCE6289F54A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 102e3694b299d099fae0ce4d181a1133bcfe230b228af2270fbaaa4046748e7e
MD5 b84d716d98e41b2e3c1afd12f70cb723
SHA1 293fd71748494e9eb54219f8b72509d6a9cc58d4
SHA512 f5c42e928eaad622d68df71137744c6031589b7e8804b6b452b41bd7e8aca01d2012d0bcd1bf84b1b0cae2fa022f302fded96170965e43c7911f5cdb125a218a
SSDEEP 12288:szVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:szVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1A4C423A5CD06847BF27F06B4CDE0D3DCE2289F54A094CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 1cafc5c66d450b9368d8de87893def5e5bbad13f4a21cfe2221cc2cc1e1b993c
MD5 d8200fd512319cfaf9460827d4e67cef
SHA1 c686b16704069e3fd16544701765c05208d6293f
SHA512 2f41256a64efb0453e26755f97a4c0768422cbcf15404880a4a43960cd7b71a11194c11ca91a5cb612459148666318d82a226797f880318ebf85f9cf6cceef2d
SSDEEP 12288:GKVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:GKVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T15BC423A5CD0B846BF27E46B4CEE093DCE6289F54A084CD6AD2827A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 29c69e29e258a9205a9ebb19d2243108f7f01691fb5318c1a0b772d373a739cf
MD5 a541ff7f2b54779f14f7b26de2b80c74
SHA1 71aa1443a7e59ad5678dfea3f37d28b155a219f3
SHA512 41509baab0da4ef3f1a0bd99220ecf78566ef984f8c79a3f5cd65ca406f9c703c0737e07750e0e1e53ff15fe6dad63b439a256421d74e6e9c31e5be21aa37f0c
SSDEEP 12288:+8VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:+8VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T115C423A5CD07846BF37E06B4CEE093DCE6289F54A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 ba2dd5608d85f2ea5455b9a9c83c20013fc3d801c0083404bb649cb2ded08273
MD5 61010bd6103b7ed9cb87fb4b6427187a
SHA1 e0ec03bc987196afb9e65336fe1827638609b541
SHA512 8d0e831b13417acdd23d4e0a0815130e23e6bde50fbb613d15b9757453127f1e3f6ca17de264880320095ae7acbfdc09577455a5ece591c32a80ab00a265529d
SSDEEP 12288:BtVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:BtVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D0C423A5CD0B846BF27F06B4CDE093DCE6289F54A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 2922db72307dfeaa79e742d6b32724949a52bbcc28f3de08cfb1fd7173b7eb14
MD5 21575c3fd4b93cd8d49bb0915374a8ad
SHA1 3c1a68cb5c506ac63ee023bddaed5b3bfe686201
SHA512 c91c85a240eb26371c3448d9600e8fe39023930dd3fff4fd1665036d5b680e798903d39d7d932209e7b950f56dc5efd639410e5b0fc988fc43b0447e5ae0ac05
SSDEEP 12288:7UVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:7UVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1ABC423A5CD07846BF27F46B4CEE093D8E62C9F94A084CD6AD2827B1A7C7C85D2432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 94365eed915f6732667fdbc9079d155199b20a7f2e3508e52e594ae2906b2936
MD5 61d7b8f6b86520656a05148f64c15964
SHA1 ee3e290236782d1bf7b8553717239c39ff70f76e
SHA512 2ad9eb70ce604e36bec49f130f1ba69d5a0fb92b6aa666a428b86d6b5e1e0248fbfd7d981dc299d0fe4e1799fad4c5b1825a6207a5ff42f38f7bd35cb5afb2fd
SSDEEP 12288:/mVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:/mVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T115C423A5CD0B846BF37E46B4CDE093DCE6289F54A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 664860279b2b47de777d52c3f626aaaae6589caae09cecd274388322bbc3a0de
MD5 abfa35bd6b58aa14d5a0d366e0bc84a5
SHA1 fe5b0580855d9584866b7d6ac9d771af19234dcf
SHA512 6e0be6d4ad11ef485ff487247d80861b007cb8f95b1c8cea7c59d97c941771205da3618fa537d720cc3b7fe4037639ae6ecc2e3bfa560793cd07451e1d7c562a
SSDEEP 24576:7fwvok9RX6wkyAIoVXXC8Ac2YV3swxhZPegenZPwC7:dMnYIGWh4sCdegmZz
TLSH
T11735CF29EBDC44E5E177923C89B3464AF2B178581B31C6CF029A536E0E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 27a4a8662b4cad103614b1275b8f017fc6e0d74ff72b5e73dd710bf059dd9ec7
MD5 b1c3a164a31789a2234802dfe7f5d6ca
SHA1 13e335c8bc4e868befabf184c54f76d086af92f7
SHA512 275e7cdb06fe600bd456520ce2e3c6e9d144251d569b5788f347997a6c46432b390c62ddd730b1b5e46c89e2f7ba8f7ee5f1ae4cd6ac0fa1bbc79607cbc210a7
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jWh4sCdegmZz:UySzPbWIURZz
TLSH
T198066C96A16801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 60bd61424de1ff43f0e0cf9e934089c8cb82ae9c34466d21c38dfc3f721d1a37
MD5 f554272c2795a320c910d72199018955
SHA1 1442f82635db9ae890ca9675ecc9fcbb1a843fcd
SHA512 b7950f34acddcdd500a8e1ad7d40a613c90771abacb4681c4d46ceaed88238c9915798d18bd69272be78c8b22c562a4d98059a2fcf58dea4c1c6245ee7fcb396
SSDEEP 24576:K47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXVXXC8Ac2YV3swxhZPegenZPwC7:K47JUQj1irIhCnDHUPfF/zWh4sCdegmB
TLSH
T1AB65AE1EA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 82aca6828bd394e8418f6076c8c3102c8fa8f87060eb963cc2935906a6223d1a
MD5 80be34d4a85142011f60b7d4d6ca4ec2
SHA1 f8778c79b58a9820e71a190b17ca92bb4c02ee7d
SHA512 d9489afc3b9207d366845cb06ec0872e24762f760d39327220a114ccb6f3ab46e220545656f46160de68ae81ea12aadcc2419ba057ed6c0acc48e42057439c33
SSDEEP 12288:eNsfMVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:HMVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T147E4F05AC25801E9D16E5278CB918684F3377D6493E0D7CB52C0FA3E1F3A5946CEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b3d65ae87e4571c1321ad53624fd83cefa865a10ae33b4395db5e6f8a04412a8
MD5 2348d5b5bbdbed9bcd71650b749e65fc
SHA1 27a86e8cf96d301008afda3da6da47baec30b5d8
SHA512 9c1881d45f6d2a1fe5b9d88a2f9d269b4e009d995f2ead2967ab64f3a00b4bed23ceed787249ac7ae3f71542ce40726cd44a8986c85c79b3c8662e5dd70d1736
SSDEEP 24576:zEMa0UP5TM2IjVWdg3Ro6J7wBIBjhj3h7Ur:20URTWxWy3RoI7uIBjhjZUr
TLSH
T1774506407626DA8FC6A940325E36D6CCA7707D42EE046F1373C9873FD476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 5e23b35ba1ccf5499d15835f46d26cadab425507f12b7d46b47024aa44faf47d
MD5 9dc0adeed7620900abf562195daaa1af
SHA1 31c4eb25bedc04f21fb34d7c620b75125056f57c
SHA512 0accdf4a2a6d22730b26b45d1d415d7491f24295dcc8571d5f6c5fbef3f1dc9ed6c48b58a1f4a58651566e72db69a782b08354af0a839c126da111ca9a93acf3
SSDEEP 3:OlH/lz2bhBdgLq4FGjEclRl3y8jK63mCllltGlslslslslslsl6LW:KymLq+GQclDVKcmCtEEEEEEE8
TLSH
T14B8192288B800B52DA95A6720C582FAC4325C148B882AB971718A1A7CC287954D26E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 afd1e3ff0a3dbb4ef4aece2b8ce2688abb1318e6280db4fbe47e9468a2180d05
MD5 4135b7959f273890fe4e7e2be7d60b8d
SHA1 5c991260d49013daebb83f6e65cceecb4ec9c455
SHA512 4b0d6a5a3d5f2a5f73dbd99f08048c0565cceda12bbc7e841892550d1840fed5a3b7d553977e2bbee49d46180fae1d9deb634344f729f047c6b7a1594a04f632
SSDEEP 12288:ODn11yU+whWRBIME1nwnuhRUt9aPJE+9wCbPN88AcFk/HsktsZBwUtLLphhe6V1G:ODn/eHnGRUt92OwZbNTdP0eG9uHmei
TLSH
T1EF650600A5B7EB4FC97E9037563286CDAB746C07FB452F01734588389867A6FB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4adc2390c7c1f94071bef8a3c963b5695d87594a677a6d8f59126b75c34b332b
MD5 3021cc6646b4ad1b597c57da2fd78bd5
SHA1 850c86044def848da7c469bfaa10933420bbfbef
SHA512 b1e8f1188111a3cec32b98f3efa8eeddb7f4cabf4a91a7f1efe48726d5082fd2bae102d2245ee13f101eed399bf1284f66ff81f9ca77d8115977dea78305ae0e
SSDEEP 12288:TF7kVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:pkVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1F1D42361CA0A8427F67F06B4C9E4D3A8A22DBF545744C9EBE1417B1A7C3C8D96C32637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 85da9c0de6de21e6cfeeba1f01533ed43d1e361e9a5ae78929adbebd5bf96c48
MD5 88a094dda58a40213180490d263e6b29
SHA1 272debaee78c77334aeef1456cbc101cebd59a12
SHA512 f8059eba791b465682bbf0fb02a145892698fca9ba316b20381a994b6925b2821365068c42a1cd9494a33c93935b5388bc9335ef509cb93498005508799e09e9
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYSVXXC8Ac2YV3swxhZPegenZPwC7:Ogb4mBIBhGF9Wh4sCdegmZz
TLSH
T1C965AE1E22EC02F5E1FAD2B8CDA64417D6B278160731D6DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 18545b107316ca3646e0709636d63ecf256d960ac99d4034ca54bbe131fd9ee7
MD5 7bcff7361e4926cbd3264c5ae0ce26d6
SHA1 73ef4390feb79f118c99feefcdae340a56d0270b
SHA512 fa3b5c7e01b1a1a6e0a81281066d54d74ea59e0f45d9f8c29fa102c983890b9eda562b8b4656378e104affc872a6d2a5ee2bd27aee225ef678f37d97cad5a0fa
SSDEEP 24576:fG88u8FpJqH1bzria7/mnVXXC8Ac2YV3swxhZPegenZPwC7:u7ZFPqVea7/MWh4sCdegmZz
TLSH
T1C135F165A6E101F1D47BD138898246A7F6B1B8250364EFDF07A88B551F33AE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 be0ba83b26af129af26cb0dfcc5e645caf750b33a1799a5d9c3e2c5c763be612
MD5 31aa9c360b9347450db3ced32a6fabee
SHA1 88bbbb585d78462c944960be15132f4b559e0719
SHA512 e8a4a8a740ad5309de81f67276dca54cec0570c188450ea2750836e0f901767d50461ce63e411413b38b5681b30b229d02c8f76f64c5f87cad83cce8e97a239a
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRWh4sCdegmZz:yG05lO43buWIURZz
TLSH
T170D5C06A62EC11F9D1BBD17CDAC6460BEBB23815033456CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cbad24116c735a3bca02a9395f808a677607a557906ecc30b9fd5ca096ebe631
MD5 84be3ff461c01c3a682d6107bcff5b3e
SHA1 71b03224c5b0f7c60d4ec459dd92915f50b5a786
SHA512 5bbe8e562819d0c1fb504abd43c00733566262d961279311078fef3bb82758863c7e3c5cf71a75db69e44174b6197c4a08e7381b3b835e6e87c8120635bf9c8d
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnZVXXC8Ac2YV3swxhZPegenZPwC7:Fa5POZ3+Jt2pasx2+mJWh4sCdegmZz
TLSH
T15C65AF5EA6FC00D5E5B9D17DC583861AF5B1382553319BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a4b425b752ef07586dd19716ee339ae871279306252e1102e15397633a2a7d6f
MD5 4934142685e1637cbb418d947ddd2016
SHA1 7136a8e48ebabbba01e141b6be5b22a979c45ccc
SHA512 543ceb576a5a294e321f05a69356a36f020810e32cad00be8e945a39722dd983d1246f7bb047e3c49ea9bbc7d7f0907c34422f7ac19fdd8e09f215d07eaf9a14
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkPVXXC8Ac2YV3swxhZPegenZPwC7:cNc/zEOVHFsWh4sCdegmZz
TLSH
T183857B2622E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5e91948d0a7f202c2d11a758929172757b70d0cafbfac0abfa6b0c5a354b603d
MD5 8ca210e20c1cf4a4b773c09bfc079183
SHA1 7f467441bcfc40138c94ea691419a044c24a2dee
SHA512 558dc511d1a578722613d2a0461d89697b4949fd536af451cf6f96060281ff45110e31259a701153cf52f7fac61a3959908929be4b4e429ddf90a7b229a68a6b
SSDEEP 24576:E8kNvNnaFeYhJNtmZBmVVXXC8Ac2YV3swxhZPegenZPwC7:E8MwBtOmvWh4sCdegmZz
TLSH
T1E355AF6EAAB845E4E1FEC6B4CD238512E6727861073293CB5390C13F1E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 939f67cf32f2541206f801af352278f9c0913a694362ed7626b7d488af27072b
MD5 da3cc4111509a9fbf95e55fe359ba03f
SHA1 132ed33276e20848ab4220ace529f44abcc51dd7
SHA512 8a8042f4a41f8f0319bb5cdec6f37af2349f3efc1bd36e2379d6ef7898f8d4daf350d0a0b0035eb2c3a4e4f149a4825f3c2885f525e49b1e3121ba668ba9043c
SSDEEP 24576:cPUr+NQ7VXXC8Ac2YV3swxhZPegenZPwC7:cJQhWh4sCdegmZz
TLSH
T13905E12F66A918E5F67AA17C8982870DF771B8611311D6DF02D0813E5E37DD8BC3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 986dd815a045f31b3842369c6a8c0d8404c38ede4fa0e2c2b095a1b570550bcf
MD5 796382ebbac26aeba410c4e5496178ee
SHA1 d3205ccf4696792d3ae0af6390c5ac0c8778ad11
SHA512 9c794507a4ec3cac7327f1ff09ba18eecd38ae603188b25549978ebf90f35aa42bbca501a3f077ee3fd581d50dc17f481f4347821b06ebfb91f0f3c25f51bab0
SSDEEP 24576:wD3FHshBIYQgAwVXXC8Ac2YV3swxhZPegenZPwC7:wDVHeBIAA+Wh4sCdegmZz
TLSH
T13C25E17DEA5D04E5E57BC1BCCAA38606E77138A9032159DB02D081BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-315-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/244-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1632-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1632-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1632-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1632-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1632-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1764-123-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1764-121-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1764-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1764-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1764-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1764-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2012-134-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2012-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2012-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2012-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2012-136-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2280-22-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/2280-21-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/2280-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2280-15-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/2280-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2372-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2372-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2372-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2372-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3048-52-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3048-59-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3048-295-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3048-53-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3704-1-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3704-8-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3704-75-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/3704-0-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/3704-7-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/3860-310-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3860-65-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3860-71-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3860-63-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4416-93-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4416-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4416-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4416-329-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4416-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4640-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4640-82-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/4640-77-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/4640-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5404-119-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5404-314-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5404-114-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5404-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download