70c784a310f8430dfa53ef6b7dfc53cd745ab0aec1b6b63b1199b7ec40c03bf6

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.5MB
Sample261027-q769aaev3l
SHA256 70c784a310f8430dfa53ef6b7dfc53cd745ab0aec1b6b63b1199b7ec40c03bf6
MD5 7b30dc25217c8a49569d3da8dfaa3855
SHA1 49001f9f56b4e38ea15807c9c494f61639d74aaf
SHA512 b50947581c5b7011c8c6ef07d9202b25d9632afcb29b24d69491863e9338d8bcaa73bafbb865ec34954ce0b1dc3f15808a1354d79635a352452789a2b6e82629
SSDEEP 24576:G7rh8beS/ewj3yWLlThmUtY0xYROQyDsOqZxuHgE2NAiN7abDs0p:KhErj3NhtLYYYROQyYXo92NVN781
TLSH
T11975BF1A739841E8E537E1BCCA974B06E6B2344A53219ACF07E557AB1F276E05E3F310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3320	elevation_service.exe
4508	elevation_service.exe
5744	maintenanceservice.exe
3932	OSE.EXE
5980	PerceptionSimulationService.exe
1548	perfhost.exe
3952	ReFsDedupSvc.exe
3292	SensorDataService.exe
4196	ssh-agent.exe
900	AgentService.exe
4504	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28fc6acb9600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f45598da1a66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e260d1c1b66dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001baa2f1c1b66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000693b00db1a66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ca8b81c1b66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bef4eb1b1b66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe
3320	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	900	AgentService.exe
Token: 33	4504	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4504	SearchIndexer.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3952	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3028	2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3320	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4944	4504	SearchIndexer.exe	101
PID 4504 wrote to memory of 720	4504	SearchIndexer.exe	102
PID 4504 wrote to memory of 4108	4504	SearchIndexer.exe	103
PID 4504 wrote to memory of 4112	4504	SearchIndexer.exe	104
PID 4504 wrote to memory of 5748	4504	SearchIndexer.exe	106
PID 4504 wrote to memory of 4244	4504	SearchIndexer.exe	107
PID 4504 wrote to memory of 4840	4504	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_7b30dc25217c8a49569d3da8dfaa3855_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4508

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1648 1636 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1648 1636 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7bf7ba103572c0ba60b150129b40ba51af23ae424eef238eea295fb910d0da44
MD5 b345eca011968a1e2a9eea8bd36420fa
SHA1 184bfc14a9a21abf766340fbf3dc30f8baff20dd
SHA512 cb78c150fcf916dfb5a640a84652210eedf9e3023edad03a5e455f1eef3471a9a1eb30a9cbaf5611a19177bc2a60d86312113108eec51b7ea1b5dc807c2a1a73
SSDEEP 49152:mb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnGQyYXo92NVN781:Y3q6tjBjnYXomr78
TLSH
T1CFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3628f26219f1084997994a3484986b881c0c30fa83c3b9810a5eb73be146f37d
MD5 5ff0c84508d4c7ebc501404e57f5f6d2
SHA1 f89923eaa3a00fc5e7290c9e15a590b8491e1534
SHA512 c20b23466dddfe1f5449c611ee6106698b6cc206f7c3ca455d1fcab2dc93686df01d0ac9fa0c62b86c9b0d2c866e56291c3c49b5501b8de48c696bfa3dee1de3
SSDEEP 24576:/XYfDtczA/QyDsOqZxuHgE2NAiN7abDs0p:KtcIQyYXo92NVN781
TLSH
T1EF75F129B7E409F9FD6B823DC8A28511E633BC5587A0E6DB03A499260F733C45D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 4202ca3d4081c5ad290ed8b95d1aa35cebd4bc56cb70a77944f0bad6e17f8533
MD5 0339bab1a870b1614d69462abfdc32b0
SHA1 9360adcb7de3f3dd47f27cf0251be12ccf93313b
SHA512 9436fa36087fc0f45eab77780933b8ee74b47699f59cb5e53ab431dd2042340a55aec221eee87c7e3babe8dc030bccf9a717671568590d37e307d1f2891b6897
SSDEEP 24576:/0Le5ji0hmxrrMuQyDsOqZxuHgE2NAiN7abDs0p:/Pji0Ad9QyYXo92NVN781
TLSH
T18695AE16F6748731D073C0B9C5D2A69EE97230865B3089CB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4c1e3b88f73b4da7b25ee67be1d27189ad788759d51a43c44db5519a39f7af5d
MD5 779141e74ea37ff466f411d252b01527
SHA1 2903365fe6299f884ecbd4e4c9296c6a19d26290
SHA512 88de09094613c97da93eef229024341053ce2956581def9a058a9e69a638474afa398883377dc8b2bb0cea92a0487e373822c4b4f02e86036b01b6535443cbd4
SSDEEP 24576:0a7/ezSC6vUyDZaqgrvWx6q8wyu4QyDsOqZxuHgE2NAiN7abDs0p:j/ezSC6vURPvMHjyZQyYXo92NVN781
TLSH
T1FA756C25F5788323D0B3D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5096389ed31b87c20c9ad029fc97dcbedca2f352dde8f7df95e23025c18ebad1
MD5 793e75b9d68795a677c9c38e4ae8f0c2
SHA1 f7be716872ec887eee5c79fa96e59f0cf1dc7394
SHA512 15c3170c150e48dcb46a0d415a16cb1b465f92c888d2883588e325c25fc8b2b07ec156275c80c0534c00cf90dde6abbfffb79b2b046d13978d3e638812b8e718
SSDEEP 24576:0VbqPb88hv/lV7TQyDsOqZxuHgE2NAiN7abDs0p:0VO88hXlV3QyYXo92NVN781
TLSH
T14B559E66F5748331E073C0BAC5D3AA9AEE3234424B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 b25d6f1222a4be43e2006f14ee46f93430bcd8894a4524a1d84814d3a7075739
MD5 2ecc13ab33856a93c0ad00a28728c938
SHA1 347f15a7566f9784bea04e489ac5b26c09319d4b
SHA512 badcb0b432304600be347a51815091918b443b0765413cf31120eef4b469d085a1399bfb2692cf04acf3fced4bbccad7324ae3e2c8020f2ff9da9798857a8091
SSDEEP 12288:kjV/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:kjiQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T17B55239EE65D6BD1F72F4B39716F8FE420229D78C9D4ECB7E91B392308B92C25811406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 0042051a48243fbeb36c7900a0443ee42acdc9731a6cbf6a5d42dd975b5b8e1b
MD5 502f43e5aecfc8629a8c8e603d18f9da
SHA1 2584089f277c2c83d20b03a64dce6e87a260fe3c
SHA512 824fab2fdf4fd098d17168d1d5e935bf0fab59a92d1329f964cdbbc61b31a2c44a13069d045f67a41600e2eaef5a513f737611cc990ab309b13369751cc886b6
SSDEEP 12288:PeBNUbTVO86UM/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:PJIUbQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1C275CF7BEE28FCD2D27E8D795691C740A77278308F61A3CBE165820E8E235D11D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8176a94eb71fb2ca1fd3955ca1a6ad8224b310950fc3ba7f2ff71dc53a62a4d
MD5 0445b83aa3308e8b239f757cb6da9df8
SHA1 786da83d2985fab0d849ac7a4dda14bb68b9383f
SHA512 3a25c8eff3fc052e5efa4598049dae74f9d7f8f41fed530d6bdf9d7c078344e9fc755b045ec89cf53cbc486275ebe744d4fa3323dc9d2daf775f72df35dac993
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH3:zQvGAdlCEL8c/pRNw5ConYXomr78
TLSH
T1E8266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 321640268be866c3cf521672efd7a3c02d9d0c36e6339d5be13cb1fdd0952363
MD5 25ab094f00de858c941cdce36012d865
SHA1 0075a4e0288a523c0b7471835d76385f888f5d15
SHA512 6e9eb760d557982a95146b6f3df88c54026b0a7c7d699b6dac892f131261e0c276dd1c598df9e0e92e5fe43f5f15f2d2df4b5b3c7b5a9f8ff26a5ebfda29c6e1
SSDEEP 24576:9MewsAjtQyDsOqZxuHgE2NAiN7abDs0p:KljtQyYXo92NVN781
TLSH
T1C975E031FA74E432D37F0DB62B36C716143DBA204BA129C3E3A85D9E49742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7bdde49d15f02937302914dee51a7a130dd53cc4e41d58448ea8cb4e3108e9fb
MD5 97c87cc05926c2e09b152aa649b709f8
SHA1 a437edf8241dcfc8cc84a16a80161b98b7a79d41
SHA512 7ae5f6541358ced95c530ab1f27652ceba0b00c8db3ea4d7f889b02d7f76126f8fee7e66944f678f85935547d34abbcccaf0822bf0e3b59317e916010353d5e0
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHTmr78:VUEtQevvqc2W1cpV29I32TH
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0cc109c149476e7c2a3c0739e41293925c08a5ebb6c5c52cf920282b9e2811e0
MD5 d88142937ba7f331b8ded7e359ff2e20
SHA1 fd71122bd7d22bf3e800457dbd459306e60e9dc4
SHA512 751bd4251edcd59daec0b204a62f33f2258ae975e9857be49bfe45f48e6f32aef713015ad289aebe9b974c3986769b54a4775dbf0bee082c2b255bf51a7c9d06
SSDEEP 49152:uCbRquA/m2yL5zLfFiV+XenmE3/zNQyYXo92NVN781:Doq2Vjnm0nYXomr78
TLSH
T141D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5c0c88169892dab8e6c0e366710958e7496bc29719abbc58fff55a0fda5ba3e1
MD5 8b2171b6e00fe16c490da849395a70e7
SHA1 876d523b452774c49dfc5530945b73db9fa5449c
SHA512 43c93c32c7487d17baed92714a33b3918b545b5ac191404059a9d525502a4969ee4a18d2dcec8a0c92b516c4e0e62f60b9667764685114f7b2e9bf701aeac853
SSDEEP 24576:VAhGLmIFoiwtA5l7S53UQyDsOqZxuHgE2NAiN7abDs0p:VAM1Foiq5kQyYXo92NVN781
TLSH
T159359D81E7F955D4F5B3AB7899B68570EA76BCAA5E30D20F2150D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e03dae513644f9ca9e8ea7d495e95cbe3680d04d8fee3cd169fcd1bf37f1eee2
MD5 4312bcbd248a19c9b2fc6c8c525ed8d1
SHA1 d87978e9864c9bd59a561221632db271ae77f6db
SHA512 6de65771ece43c50494960b7103764e41d883a795c3908f238a5d5a0207628e6a0daf636089bb399744a9bc510ed4271da7abf1abd537dab67fde97fdfa2874c
SSDEEP 12288:gmw5HEjsChNiBFgl0WDm+C7/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX5k:9wurOW5QyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1D375F14A72A81CF9F96B82398557C632F7B2BC112A60DB2F1760C61B5F373516D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 79863433bf6a9a7b92d07c659a8aeb9a81e9238d9d6d0ee83f784ebfb0bce68e
MD5 6dd4703bb2e2ab1a155056c0bcce5d67
SHA1 8e4b6cabcf8f8c816956bea4fe1d6701125ec549
SHA512 a60b098e1c3044d773ca8d2c4f227b8425e3dd685b8a85b7326ac9896fef5207fbb2a60061efbebeb2fa242017e5a4cf12815c6ef193738beef686b76b173273
SSDEEP 12288:OEZ1Iy2/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:BZu2QyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1DF65129E32E836F5F26B423DD5E68B44E372786697B093CF161621260F73AC21D35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 21ef02a6836a75b96aa28fc70869e8818ab1c23b28b3d54efffd564a5e0474c9
MD5 a13b21b09f7c648d3855c0c4d0bb74cc
SHA1 b83292c3366dbb3bb4fed40e9d7c108c839d7ee3
SHA512 a08beeac8f1768b2fd3a527c8b0000d838d1bad333723421e68603076ff9df125b69f1ef5c9ed130c13e7531f928f9f102717268ca4c3a1a1fe1cafa2aa3fdab
SSDEEP 98304:7QRQyi36YOcPuLvw2gAf+PN3HnYXomr78:KQyiKakX+PNxmr78
TLSH
T1CB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 284e516168f08529e82418a4508deb786ee219fa6382b6a4bcd7a7d514991293
MD5 0e5a692cd6552bb55d1a8687247fdfe3
SHA1 c962f984ea997bdf5e1f4dfb64c5228922091856
SHA512 2dbfcc399b39eea43eb6a30a1357d93b4a3e646aac20a32b15a9b8d3ce596169097eb89333b8c3f4a2cb64144436d060bd1c13d0b99e1bd58a4a7fb2d40d48d4
SSDEEP 98304:4QRQyi36YOcPuLvw2gAf+PN3HnYXomr78:vQyiKakX+PNxmr78
TLSH
T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2c3a29fd23837b9d6536b45d0a0baf780b4e870d40179acd7091622ca84aee26
MD5 f56009321f83abc1971f9a95db15b30e
SHA1 d86d6395fbfc482a8e074d00934d7305d9859577
SHA512 951a538f9882e0caae72afe6f2d0ba4ffc4950ab581c6f949d37ce4a20bf3d5fd7d1036346f03f0a6ff210299b83c47353f8fcfcd75aee16aaf8f5e8cdb432c0
SSDEEP 49152:a68Qg55nhxeWu7PNU3/9QyYXo92NVN781:IthGRc/9nYXomr78
TLSH
T14BB54933B2F600A9D44DE1769F4A873196D27C758FE0E3DB850172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a84ccc3e9016bf030e8b3de8c1189c98666124ef9644a6d86cbdfc95f57f15f7
MD5 3cc68c745b16c3a4b25c94fa82be5d71
SHA1 380fc420c1a16a9c25d30f2c53659165365cbe69
SHA512 c8a26bedf53b54f2135b8a069b7bd578f28a2838b5785c8f2e2c7dffcd497da03d47317336f7ee85666043ee3dfb1018fb7414e644ef458e86630164e0ed6a57
SSDEEP 98304:ay5112gYy5azzVvD69nLKnhZinYXomr78:DLIH+Whwmr78
TLSH
T150167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 76a0a00a21b3379fcc0025083ee6bd2a1932950d95b6c77388a9d44e2f301d79
MD5 987c042fbbad5e94a129bb3cd00111a7
SHA1 e3fd9d87c8ee218b59ee5083ddac857c11837473
SHA512 63572267aa8696f1a27332aa9e5119265c8db0a050a780359758f7a36380c22f7c315ccde6ad6eb6d57c184d071f98986b80ecdc209524ecfe35de030c2a5d59
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPQyYXo92NVN781:0u6JmQxd2dPnYXomr78
TLSH
T16CD59D13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8286e42ba0906ee264d9951c175814a0be9d0fea10b137454e7629135d571c6d
MD5 50ebafd09554a12985393de43c4fe4a9
SHA1 c49bcc461fc136c5ff4fd8bddfc58b299179249a
SHA512 836a190dfdf3c47e4445460e46ab2e13fb8fc083a5dc1901ca39d104eaf57607d48864e186e49b45f1224317c2b1b1425bb44944359616bf89dc5b2195af6077
SSDEEP 49152:G1hpsNoJpF1A6yU44CwH7R4x7QyYXo92NVN781:GmifPVR0nYXomr78
TLSH
T1A6B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f1009150c506db0a62eb9ecc24b7c610a0f20dcf66d446bad5e90829de56720d
MD5 66215d49a766c5fd0b87525eaabd6d63
SHA1 1216a3a8ee709b2cb6f1cb648927aae060e209cc
SHA512 70793fc21b4909055c6d3ec2b794d76cf8ca1fa4f4bc705e471f82f0abb92bfd2e11c123abd877e0daa0062d3a126fb99669bcea2b6b1cbaea3bc42bd08e4748
SSDEEP 49152:oSuZQIY0Be2KIRVtOnks6NMHq2QyYXo92NVN781:y5dKOi612nYXomr78
TLSH
T142C5BE03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 46ee412993ad8f2e5d2d70542992381e4f57ad36a81f5118f153edfb4a8c9a54
MD5 0bf22bd83c0c1d9ec180acea5c0fb054
SHA1 50c46e0688340a3428ef1bf3f18b950935d5cd73
SHA512 b2df56743b3c4944527c417a1ed5c8be8e2ca0a7eea032222339cff1659adcfd661a05c5deaa4f6bec19192e04f7ef3d6c2da2641902b2977e482bf611e0fe3b
SSDEEP 49152:yhtSn8EApI0figGgiDn0AP5w/QyYXo92NVN781:zX2i/phgnYXomr78
TLSH
T16295BE13F2D901E8D05ED178C7568632E962BC160B34BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 f0cf56bb7b04ca19bb06cadd1cca03d37915bcce845b19186690516af33d4050
MD5 769774d9ed063def1fe1c12e75e35ffc
SHA1 38d0a0e7893d530f35caacb5bc48f944c12b94a7
SHA512 6cbf2edfd4d624c68dccccce8e3f2ba1c0868b201caf9717b9a0878825202b89fdf20b21ef01df529016d61571ef90d80118b712604a4dd095d96b860db5bf13
SSDEEP 12288:pN/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:pKQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1075523DEF56E6FC1F62F4739616B8BE460259E7DDAD0A4BBBA0F342309F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 e7dd25053deab1108e0b6b7b0172c2bb0d13e98c557b37344c4953d480a136e9
MD5 3660a3eee0aff873e1a86a251205ed8f
SHA1 9411526b65e6835543c7566faab6c175a023ece4
SHA512 6ba5817117ba341adc365a6c87194c9ca5ad84a241982fbabb407e055b808a3413101dc2223c6c8aac65da384c404dd842fed7df191627e704b18a18be34060c
SSDEEP 12288:5S/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:5xQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1FF55239EF56E5FD1F62F8739616B8BE450219E7DDAD0A8BBFA0F342309F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 c668bbfc5ff2ddb7f7112c0c17522573317a53de0ccf8c455721d0c9e600d274
MD5 a02dee295825dc17d8855b0c61db597c
SHA1 7ba516c7b9ea0a52b663360757fe07b7d8725a2f
SHA512 5179468ce42fdc18240e9ffd162547f94b5748d90b49b0f5a25917963ccfeba2bc080cde1f2f9586f78dde9d1ad29c2918c2fa948a74c26707c01998998245b0
SSDEEP 12288:5k/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:5jQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T11755239EF56E6FC1F62F4739612B8BE450619E7DDAD0A8BBFA0F342209F92C11811845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1067a5cc88dbc769ec7830804dd846facd3a2c9b9fbcaeb30a84f28160ccbf2b
MD5 d5fdb5edfb9dd86c8d9b6e4962dbfbe3
SHA1 8ae8e0528d9d4164c8e0cd10831933d13cbe4a36
SHA512 f19bb8d26ea4d76c94f0819419f16ad91b64f26946b94beb5d333a5f6dad32f83342d30270c574ecae19269cf22b0e3410011368885d8d24b76322d02995abab
SSDEEP 12288:GV//EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:VQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1E955239AB66D5BC1F52FC739916B8BA0A172BD79D7F0A4EFAA0734230DB53C11820901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 6014430e4c2b9f186ab7a1c271e342c4c833333821769ba011ce55b6f1e0edfb
MD5 7542bc43df4b8bbed2d8babec3b71591
SHA1 25a636acec28348087b47694a29f32b4d2017c04
SHA512 903270ff4b35709d1db426915fa191cfae6f514f36823e4685ae5043646f66a51c27bcbc443e6906229136f67c32d1190bdd4ba2817d1976fa6406c6d15bbfac
SSDEEP 12288:/n/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:/MQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1B655239EF56E6FC1F62F4739612B8BE460719E7DDAD0A4BBFA0F342209F92C11811845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 f488b46cae607a186a36298ca4447b4596c62dc039232276213948c4c5c2d334
MD5 d4eb8270059fa024b42ca712260b5748
SHA1 cef684a828965f96170f5229e7263c635de60e6e
SHA512 65148773ca2d42d9881114fa929b5bd616d0b10984e8ffffa72e0e41e76b6571fb3f954869ac4ceca34eb64c44c82f7e970d158d0317b42fb96f058b67c2506b
SSDEEP 12288:je/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:j1QyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1E45523DEF56E5FD1F62F8739612B8BE460219E7DDAD0A4BBBA0F342309F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 51b25ed9a6480ce7917ef3bf0aa3ca101871d4b9fa6d11038284c5ec278f61c7
MD5 82e2775713ed0c42756198834e373cdc
SHA1 3ca959ca26ce3f9d3e0cd0f31be2e00816ba7cc1
SHA512 5c881bba3c3d6f96500fe31c17b867ba300d278775a196ea195535a145590dde7b525c2d205b793dfa19bedbd4a7dc990a32573d6b013c5d86434531ae173137
SSDEEP 12288:Ra/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:RJQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1AE55239EF56E5FC1F62F4739612B8BE450269E7DDAE4A4BBFA0F342309F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3616ca499d00628ac00a65c120fbfe50d2fc516060e3d44081897e38efbdc20e
MD5 b76d24df723d4c791c107fcfbd0a343e
SHA1 3bde0fc5d55b404f2b4e6869227681f9ca378c8a
SHA512 191f571cd177ed05b0264a430b41ba3c1382c400e4b70769ffaf7bc167a73e5a7f9118abed6803c52def5983b9763e5dc83d121b32bf0c28a4b758e72d532318
SSDEEP 24576:IZM9zFVSORQyDsOqZxuHgE2NAiN7abDs0p:IZM9zflQyYXo92NVN781
TLSH
T167750199B3901DF4EC67823EC9268A15D2B2BC294BB0C55F13A936271F733911C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 e582d8745be33b64642cce6f0512541d38a6bac531ea56f8c4f43363cc57fc5c
MD5 a35c2bd7a7ff56fcf5fa3bb76caa411e
SHA1 2b34488a8810bc775b73d03ab9c894e89a18b60d
SHA512 095f9aee5501f33352f2b450518443024c1bfefbf3876a80dbde5ff25eeafbf1f98217ef70514dcc6a465503eb672a982338e7c36a32f1eab7484aa075179d1b
SSDEEP 12288:Oh/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:OmQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1055523DEF56E6FD1F62F4B39611B8BE450259E7DDAD0A8BBFA0F342209F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 c221362f99f1aa60bf667abbd5a00e4cb6dba5c88a763e6306ee050f78a847ee
MD5 a6a1c93d407237200e0ed6f90f4d5920
SHA1 5bf1fc622c50b82534c0d3341fe28d93eb7aaa2d
SHA512 2806f1f78da18b79c316ffd82af3c99b360649ab346d4a571475b481db2967457b995d79d50975fd5bb3dc8dc42cecfd83ed8bde3707b39b3fc96d4ecc252e26
SSDEEP 12288:6l/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:6SQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T16B55239EF56E6FD1F62F4739612B8BE450259E7DDAD0A4BBFA0F342309F92C21811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8c1c6bf4f224f8dadb793893cf0a7ef4db820aa4a4885a52c7bd426441eac4fd
MD5 cc5a10d1dcdbe1b219cf0400e844b6a7
SHA1 9e0ba4dfb747161bd555ca4f60061d78b8fdc3fd
SHA512 1b22e8ce1f72e2e058a4cc97df901193df530fa685fabff54b9a0ff3b33abb431595f47e3e41841ae9aad66130a02cb9a89077a9640b0377ec963a7635825392
SSDEEP 12288:ZyPz5L82/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:YzydQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1EA65124BB3A531F9E13B8238C4670A51F372BC364BA099AF676516371E772D05D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 972b39d3bc23d9ba84df3cece32c8d52b1484f3c624f279572f7b4881a3edac2
MD5 0330d2f2fb3c2b378e76b3aad0b6e767
SHA1 66e945109ce2bd26b91c19396998d4e79bba3d7c
SHA512 b2d526c8041ba10b8ec550b0199698891607e4cb046bbfd66457aa2cec886435de2eb3ab1eda95db9ff6e4ffa48fd40c67d5dbb2d6ed0bc73fe0509ce1b9c28a
SSDEEP 12288:Eh/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:EmQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T14F5523DEF56E6FC1F62F4739612B8BE450259E7DDAD0A8BBFA0F342209F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 7bc31650249093e5b5dc9631c3d1b8492158fe213c836b92a4e7ecc1ae29583f
MD5 0bc5024bcfdfb76f2a14841eb0054e52
SHA1 f66ab36b8d1c7e694097e8e5e03e3e3b72e57756
SHA512 4080e91699e8d2efc52148e97bdcf80e3df1b042b2bbfbd75cf6e29e25040340dc5a4ffda084cd4ca4cff1da58f65d2dd2aa222a8c6ed6e305da0986603eb554
SSDEEP 12288:ch/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:cmQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1EF55239EF56E6FD1F62F4B39611B8BE450259E7DDAD0A8FBFA0F342209F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 aa1b09b857db60f29f4c97475404c6bf9e7576aa3e3a2c58902dc112b20156af
MD5 447490ba1239f948fe5c8a22be23ee36
SHA1 acbc8253adb18528cb18d8f6a2778eb36fa36a0f
SHA512 b070c356536334079dba3e30f9867bf8e4be6ec477a6ecf834f36f1713061e12074c6d55f1986c8b1afac3c219a49fa8baa7190cb7990664a03b3f7e6bdd9114
SSDEEP 12288:7yPz5L82/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:2zydQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T16A65124BB3A531F9E13B8238C4670A51F372BC364BA099AF676516371E772D05D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 bb3aeb1bd0ea5492514a4800af02b16647a3b5192e8ddc8b84d5c99834c7a424
MD5 d010df541a984591e529a323635ab1fa
SHA1 2bb2309c6b57a48a13d9c51da3def3b308b3dd3c
SHA512 75bfffee4dad1188105314c3365145e75c6b762a2e8b01ce987a691ef9df34af8be41b1be80843ec443266c2f91bbbf7a8195723570d0720a4c430bf20c79b95
SSDEEP 24576:FTyaLl3z0zDzQyDsOqZxuHgE2NAiN7abDs0p:FTpLlj4QyYXo92NVN781
TLSH
T1547501A9B3901CF8EC67823EC9268A55D2B27C6A47B0C55F13A936270F733911C3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9459a98536ba4ce32b3232d0d6060da28d3489f8007f930aebcd5334a9e7b1b8
MD5 e879a86479fa39d9ea9483fb703591e6
SHA1 2bbf7d8304ee1d3618421004b07c7aae7d77f82b
SHA512 cf70e62435be8b6c58d3e5b3f50c3fbd1d0eed023ce967977decf4da63d9063bd544e51144860dd5868daf73235f133785040217116c499bbd20fa876484dcc3
SSDEEP 24576:O3Ud9CHKy7GZnQyDsOqZxuHgE2NAiN7abDs0p:QUd9CHKyalQyYXo92NVN781
TLSH
T1ED85CF90F3E815E4F0B78A3589768611DA767C6A5B70DE8F03A8251A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 2c7db6c07fe284f28e9722ccb62a02b35bd0ca4fc5e678f6a3fa0970e5bbb1ff
MD5 8a37e981f3c58e0930ffa4935a43d852
SHA1 127fa2e60f74ad78d8e28a2b90812b6128e2831e
SHA512 4b93bfda7e45b1b9472575fee32eb0b72aab295c291f98dd12360d6a03dedd63a8374a8474495fe845956ba8e6da340fcaf1a6974a43bdeb708a83ef6da658b7
SSDEEP 12288:oE/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:oDQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T14355239EF56E6FC1F61F4B39611B8BE450719E7DDAD0A8BBFA0F342209F92C11811845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 1c90e844fc2a4e12abc2ab40a638f22d91b9e012e103f02fc571e8e25df418dc
MD5 ae39babf5b1ad75c7ff08c4b343fbd84
SHA1 b78c6ba4e7d03f6a5739982e522418653fed3920
SHA512 5048813f24fe7b6a8de7786b589a50f5f78501a47da9f2301615017b6567fcc70ee613a7955f765dffac2c29244d7efa5302604c712e8e5fa802cb71f796f3c9
SSDEEP 12288:1W/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:19QyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1E655239EF5695FD1F62F4739616B8BE460219E7DDAE0A8BBFA0F342309F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 08f03ac08a6ded958ec7c41a0c56fad7520d49302947c80ce745b202229fc0b0
MD5 c71c5970e55b4fd007c39bd5b960ebf3
SHA1 71976b18e3e918536f0d174615da40b6a48ce1d4
SHA512 4c7f16c889db8d018ea1f1af0bc47246dad239efe9ddfbf7a64be890274c1e368b8595dfd8b8080dfd743cba6ee5743f7395d92ee380f96f02fecb783d11232f
SSDEEP 12288:MD/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:MQQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1FD5523DEF56E6FC1F62F4739612B8BE450219E7DDAD0A8BBFA0F342209F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 80fd8cbd95f7bdb14c2294c4164a56387e6025210daedaff32d298f44f9a51f2
MD5 0054f6be1e6d50ab2bc202912f541733
SHA1 0919c32eef6625c9c3f278b61aec2f67b9e8ac38
SHA512 e791129ef7202c2ad30c308b0fa722947bde0a43b2e70bd35b5fd52b9d6334790e5c21a129ef2ee49bfe8c6a867308b2ec36292b8a5e3486654da22e50291eb1
SSDEEP 12288:bh/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:bmQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1515523DEF56E6FD1F62F4739612B8BE450259E7DDAD0A8BBFA0F342209F92C11811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 648a428358e8fa8b3d1dc908a9db6bf95d00fdfc899583d8274ef76bc35c8ad8
MD5 1da9bf70d2fe832d9e200559d27440ba
SHA1 1abafa897ccfd25c656c3272ce6a110219b06356
SHA512 bd11fd84b21f432e2e8bd6d309274d0b341b84be387db4a407e7e5565bc1cf7d071eebaa98324c4b4140c85603b6911506f994833393ca0cfdf9405b58d0fee9
SSDEEP 12288:GE/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:GDQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1E255239EF56E6FC1F62F4739612B8BE450619E7DDAD0A8BBFA0F342309F92C11811845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 5e55725ef4652b5197afe5ce77e01833e375a644d8c9efa22ef086a0eca0eb41
MD5 0cc1e0b6f885abc4b5c5ff1475ed56fc
SHA1 12a3a4cfdb17fce11e80b5c157ebd0539d927087
SHA512 bc35af29afe611996321a65abd4cde32766943fd2693a5b7235ca736fc0fd7f4142bcfd8ec76f9c231cda1d4510d00af6d3c7529e4374109ec8ca74f21b63dbe
SSDEEP 12288:fp/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:f+QyDsOqZxuHgE2NAiN7abDs0p
TLSH
T15D55239EF56E5FC1F62F873A615B8BE050659E7DDAD0A4BBFA0F342309F92C21811805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 92e66611661ee6ef9f6e58a3bb7621500b39febfb019f3addc477c04c4c4278b
MD5 02a5af1a49e32ff7f5059ac2610bba8c
SHA1 e48fea2d332d05dc497307fa3d5ca75c501a1d02
SHA512 6e14ea61d5346c839d71c70215864e3fb0385d0ada762454b8dcc85300235973f07533f4e787719efe826bc62c0334e3206d4e765e46df5c9c2872712d99ede3
SSDEEP 12288:1n/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:1MQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T16655239EF56E6FC1F62F4739611B8BE460629E7DDAD0A4BBFA0F342209F92C11811845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3024e06101ff5bf5043973f5f9daacb65f18a92b0c239363f5e105eb59aaa719
MD5 7ecda249e75cd3d0618e51aa5f7c9c75
SHA1 5f090b1e3fccd79ece5efddb284e97a3ae48cc90
SHA512 a8745b0d04ec5e269f638f5a2efd590bc8cb4bb54366cfc89af4e4421d5f5f86ed25bda5809b336eefc18b8a993e6a8f9e091996118f98b7f54fc1b8beb57b98
SSDEEP 24576:/fwvSk9RX6wkyAICQyDsOqZxuHgE2NAiN7abDs0p:LMnYICQyYXo92NVN781
TLSH
T1C685DF29EBDC08E1E177923C99B7460AF2B178691B71C6CF125A536E0E37ED05D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7d3a59deb947bea1e751d183115c29f15f03db25437c9d62b64f6601a530e26a
MD5 075b3ba80eb2d785dc9d71314cd7627f
SHA1 1144d7bd83356b2e87027fd8b4cb1896f08cfb8c
SHA512 be409e7291c9604cb8cb6397e6cd1dcea6702919a0fbf4cfc7ccb8c315ccd3b48cb06f240d7e5dacdd770b193a1fd0b28fe53eaebb2017e369bc9b910e790c76
SSDEEP 49152:MYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fQyYXo92NVN7:AySzPnnYXomr78
TLSH
T171066C96A1A801D5C1BDC1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c1293b3d1b4ce0d1e79e6bfaacd14eb9af474a4a8d3cdec4b32f68ed33518c48
MD5 a0084f5b697d6cc9c4cc3a5ba6b28b35
SHA1 0fd2780a198c3f96b17a49e7ebdec171277706cf
SHA512 fe371949a5a01596b0e5bff4fe4096622be039416e5bb1b06b18fd0726b80e593395a9db47940d6602c875f4145b4f7d61c192124bad9fe1697ae9b00da575d5
SSDEEP 24576:r47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYBQyDsOqZxuHgE2NAiN7abDs0p:r47JUQjairIhCnDHUPfF/PQyYXo92NV+
TLSH
T1D965AE1EA3EC02E5E1BA823885154A5AEA71782D5F31CACF2270437D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4faf8dd2d2244c72418480da7c4445409cc04a6ecf13b1bba9ca96b8aff8f747
MD5 e711ebfd77d17605ad28c4d3ff1b5f59
SHA1 b14a38dd4c3df3ab6678951878efb4c06ecd8928
SHA512 4625ae89d6a62090ea0fc4e4dce2be37af051e362edf392ef2290983d79b6887ef2178cb08fc5c69f1b8ed981348b7d92b1a22e07c318c2ef94856eb098b4246
SSDEEP 12288:2gsfR/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:w2QyDsOqZxuHgE2NAiN7abDs0p
TLSH
T12A65F15AE29812D8E06F5239D7568A40B3337C2587E1E2DB67C1F53E0F766C05DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 ddfba1d294866ac20107767a71d6138630757830b9d1290f0549a3a4cc29f885
MD5 3a607a90f1ae80aebf96adfff6dd86d3
SHA1 9975048a5a3e306e8f5d5ae52a9f3e8095f7430f
SHA512 7611f285a0921eb544a32b667a8533dc6059dfb7c538be525de1bdc1853036869f5f0ca9afeea94ad1f3ebaae333f5cfcdc19f7346394b9c5bea5ba0739e420f
SSDEEP 12288:98vvk4U3fHvH1uOSt7gg3I/RRM/wjJJ3yhxGTp:98vvtUPvStMg4/RRM4jv3yhxG
TLSH
T1A43528507626DB4FC6A940322E76C6CCA7707D42FE099B0372C9473FC476A59BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 40498e97b0682e29650484dbfe1d06799e6e97e305bf3cbc8aa88f8650ea6603
MD5 75eb5f0a411c11ffc210d1a5461222ef
SHA1 16d98be97fc41e9f730a9c2d50f7219cf3a38f08
SHA512 3213c71e30a65a3c2f780076200a1f0b431d81d585a6bffe0edde1fc13525faba1616dbd17f3a6da3c91a569a3f1915e1ed65de1709178e4881947363537bff6
SSDEEP 12288:H7kI2aDN8sBu1h7Q4rdBulgb2aLVG3LoztMA1kqVc2XTgy3zwQ/Q/ZzA5THqF49V:H7kI2ax8/1h7QYPY0y07rlsl1qqxO
TLSH
T112754B419573EB4FC9BA9033533686CCABB4AC02B7493F02738589399867D5EB1E53D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 872b79972d5345ac139d634360d219e95309a8cd55f0c92cd6d2ee1660cfe3be
MD5 d759e028f26a6b3b3663459c96c43cdd
SHA1 b6f62b12c4a9d9ffadca502a97b6ef56ab31429c
SHA512 6fd07aeb974b07972cdf2ebebd79710fe684fd45d881ea83e80940d24c22b56989f677d9a0f00f8efdd54d2150b694011c112f0b0e6c4b2b812b6ee09a93a85d
SSDEEP 12288:zC7Z/EDkyLnoiXsYtqZ8uMAxqz7bYIgooWZANxKJibX57a6+bDs6/p:KOQyDsOqZxuHgE2NAiN7abDs0p
TLSH
T1BD55239AE69D6F91F53F4B39616FCB742026AE78CBD0E4E7F90B352209B56C11C31806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ab43369c13e5f4c9f1b561b6c891fd27723a9a9c3ba929678fd6b9231613ca43
MD5 aa7e9fe645b167e46c3959bf536b7a9b
SHA1 9387542e1504de4220a7ac869dad742c3594d464
SHA512 d4cc460432c28e1b7e2593faa395ed9e2b33eceebf919bf947ea4fe80b0a566734c7ef7f25d19f2cde3c7f3715da39454c948dd7dbeb76bd138b6aa637d13fdc
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bY4QyDsOqZxuHgE2NAiN7abDs0p:0gb4mBIBhGFBQyYXo92NVN781
TLSH
T160659E1E22EC02F5E0FAD2B89DAA4417D6B278164731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 bf50724f63019e40fc160bc93dbe9368611ee8322223249c81a5fe030f67b014
MD5 d16bd8fac36cabf54265da7ebd3afc6f
SHA1 7d190cba61e865d29b706f64169c3304c579549e
SHA512 58cc7bd0211676a908c301fa8ab3c0c510fe8b893e51c39f6c830109f743bc97d64842574dd32c32fba0b91390a2442db79168633d3cb1855241c1259f669cf2
SSDEEP 24576:MG88u8FpJqH1bzria7/mRQyDsOqZxuHgE2NAiN7abDs0p:v7ZFPqVea7/wQyYXo92NVN781
TLSH
T1B695F165B6E502F1E47BD13889474663F6B2B8250364EFDF07AC8A511F23AD10B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a5638fdad40931d0f1e2635fcd90dc8d46e04bec5fc85f585db8b0005f1a097f
MD5 3c0e065835ef8d9ced8c81b78768c358
SHA1 f5ef1f01098f42403be38f7b0af36a019a32e1b5
SHA512 5e839ee0d15061c1d1de8218ad9ccf6273c9b31d4cce3cb4527b6a016713e2e984ee582468a4c42fadde3b0e94578c4c550b326541eadf8a30c603ab0d62cd91
SSDEEP 24576:nPUr+NQlQyDsOqZxuHgE2NAiN7abDs0p:nJQlQyYXo92NVN781
TLSH
T1BE75E12F62AC1CE5F67BE13D85868719F772B8620751E2DF0291913E0E67AD87C39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 11570c80b1def702247303417769ba3e186bf3a0e16df6e250c7234a0322351d
MD5 3507426b3ca48e02e98ff8f5bfb17d3a
SHA1 2b676909151f0834234f8d279e49f31e3b8814dc
SHA512 853e18f9ee47b4e5f16e69ffc8debf2001731c9109daae088db634b724dabdfc6dd336acdc6518f76452852a88869c39e862a2914edd275bf2537a5ee65c0351
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1QyYXo92NVN781:5G05lO43b6nYXomr78
TLSH
T171D5BF6E62EC11F9D1BBC17CD9C64A0BEBB23825033556CB02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 79a6aaa4060ad3a205d73cf14fc84ec621d5e37b13bbd11e904056a1e502b581
MD5 a5b3cbef6b71ea748a8cc6797d4406cd
SHA1 d90a1ae6db9372f1ed8fb1822a47137cd46841a2
SHA512 c269aaf226cb021eb01b82dbcc2001b52f5b944adc6766c037b8837258b1e64ce9ac5c579ee0d284732d4d673038e12032adfe28fb14775854b8120f51ccdda9
SSDEEP 24576:ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnfQyDsOqZxuHgE2NAiN7abDs0p:na5POZ3hJt2pasx2+m9QyYXo92NVN781
TLSH
T1AE65BF5EA6FC01D5E179D17DC5838A1AF5B1342553319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 184d6265a61d27ac5be5a6230c230e5eecd64dfe18778ee503bde3040ab0cb3e
MD5 c900d9e8b72ae3123eaf519002dd9d63
SHA1 3bcce44055305fb457274af1a85993337dfbfcef
SHA512 0570b444672b0fd73d9b2641134aaf363778117bccfde70cf89acb8d3c726435b49624d41b0e5c252f1364c1a88fc954f5c308d438236f146743837a7f6c0530
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkZQyDsOqZxuHgE2NAiN7abDs0p:ANc/zEOVHFQQyYXo92NVN781
TLSH
T18E858C5623E901E4F1BBE1BE89779646FA71786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 562ab0eb511daa0e1e2bdb7281e1fd6a644bb60a7ba08d6d6e805fa3cad2210e
MD5 c9be685e437dc22cea993ac220ff0b74
SHA1 d87778c49582bed7fc91d003ab42b9da7ed1f9e5
SHA512 4987aeba1051f1a77061cff503be16773d00505727ddd533dc6698a206953173d53b07b26a38871e95e604c45db2495b424995ac1756fbb364ab56679ab1c47b
SSDEEP 24576:e3kNvNnaFeYhJNtmZBmLQyDsOqZxuHgE2NAiN7abDs0p:e3MwBtOmLQyYXo92NVN781
TLSH
T1EE55AF6EB6F846E4E1FEC675CD238512E6727861073292CB9290C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 86a46be7ac4b4edb81af9787eeb1940eb54ad3d0a53104bfd611fb8817b41d17
MD5 963aaebaec4caccee0124451d1752c3f
SHA1 01ed107db2f6e0dfd6cac4da19e71f57601be15c
SHA512 17d1d423590c31d9ee2679511c07f54f6f18deb19ab8355ba822b84689d91855d400085acab5bb3b25d59954327aa986cc26df00fd50455acd420d2492f7a9cf
SSDEEP 24576:LD3FHshBIYQgAqQyDsOqZxuHgE2NAiN7abDs0p:LDVHeBIAAqQyYXo92NVN781
TLSH
T19285E17EE6AC04E4E57BC27CD6638A06E37138AD032165DB129591B61F6BEE43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/900-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/900-137-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/900-134-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/900-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1548-79-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/1548-296-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/1548-80-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/1548-85-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/3028-66-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/3028-1-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/3028-0-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/3028-7-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/3028-8-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/3292-314-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3292-102-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3292-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3292-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3292-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3292-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3320-23-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3320-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3320-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3320-15-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3932-57-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3932-219-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3932-55-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3932-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3952-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3952-91-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3952-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3952-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3952-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3952-328-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4196-117-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4196-123-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4196-115-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4196-313-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4504-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4504-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4504-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4504-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4508-108-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4508-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4508-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4508-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5744-39-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/5744-47-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5744-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5744-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5744-51-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5744-53-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/5980-69-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5980-67-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/5980-281-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/5980-75-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download