0fc5f75b52ece7f1296200779945c5ea9d5a3c35a46fe54c3deae97daeaaa0d2

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample261027-sg2bfsvtht
SHA256 0fc5f75b52ece7f1296200779945c5ea9d5a3c35a46fe54c3deae97daeaaa0d2
MD5 6c32fd81f6ecaf1d03029af2bbdaf0fc
SHA1 31893bb563ee79794cc722ccb776edfc67d7ad7c
SHA512 4eeff2e2ac2a79054d89d0620b2742c498d5a9b9a49aade2bc1cb9cd23970675d340bb02c6592c224a5fec6a229ee69449282cd9762c31a6c851acc054b8dcea
SSDEEP 24576:JhNVU+0ImOT62S6aSB1bbfYH6vQVSKNx4fl5Tn7UOy/t3z0+ld:J162NV1QSmSKNKfXTnC9T
TLSH
T1C785BE1A725841E8F577D07CC9B68A07EAB23C4A132196CB16E477AE1F376E05E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3400	elevation_service.exe
3144	elevation_service.exe
2400	maintenanceservice.exe
2780	OSE.EXE
3912	PerceptionSimulationService.exe
2804	perfhost.exe
5020	ReFsDedupSvc.exe
6112	SensorDataService.exe
5068	ssh-agent.exe
4512	AgentService.exe
4688	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\21c88f5767fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\BlockSend.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ec60a102566dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d99c2ad52466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c54fc7d32466dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004aafe20f2566dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c58d4b102566dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b65fad12466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dc0abd22466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3144	elevation_service.exe
3144	elevation_service.exe
3144	elevation_service.exe
3144	elevation_service.exe
3144	elevation_service.exe
3144	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5000	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4512	AgentService.exe
Token: 33	4688	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4688	SearchIndexer.exe
Token: SeDebugPrivilege	3400	elevation_service.exe
Token: SeDebugPrivilege	3144	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3272	4688	SearchIndexer.exe	100
PID 4688 wrote to memory of 5360	4688	SearchIndexer.exe	101
PID 4688 wrote to memory of 5832	4688	SearchIndexer.exe	102
PID 4688 wrote to memory of 4392	4688	SearchIndexer.exe	103
PID 4688 wrote to memory of 3440	4688	SearchIndexer.exe	105
PID 4688 wrote to memory of 2708	4688	SearchIndexer.exe	106
PID 4688 wrote to memory of 5488	4688	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2780

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6112

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7ae167552959f5bd2a0d981b0b141c895a52df33fb0a8aa00bb9a2c1d73462b8
MD5 6388102539eb890485605d5edce38180
SHA1 3dc7b598f418d97400638f4cf6d2412341f347a6
SHA512 81e585d82de802c88b0aaf468e714a39648b3675c17b0268065df0aa34cb84f0f1229afdc78469bbeac26c246f293c9f4bed5d6a2c1fa4ed7f3c33ebd79ee5b2
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnIKNKfXTnC9T:13q6HjBtKNij
TLSH
T10DD59D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 62a399a52fee3e8fdf462a7f92d0f37839851a983187f55de433ac0c89a4cee3
MD5 36849bb1e25c501caa9d98fe63ea3604
SHA1 1d05b1832a5fbad329e3f0cc29fd4aaf990e3656
SHA512 66ce360790a7c8156ab93082a96bffb3f8d11257610fb45b2464db679e6cd4ec213578d7ecf7edbdb364dccf77a0a69a1e003f08d93aa69431c4a8407772d8d4
SSDEEP 12288:R1XLsswWkxy2lRq2czABts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxn:fXYfDtczABKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1F3750125B3D448F9EDA7817CCCB28515EA3378554760EB9B03A49A390F336C89D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 75c97f596ff83c946aa00b16b7b895fb5419052911cd92136adb6de4cbc7bca0
MD5 f7cdd5c0ce6de6749775481a6dbcea3e
SHA1 a210fd738efa3e06ee86f800376b3ec447b93758
SHA512 8448369fca897542e6f4e529207607e3074ab4b7a5961c84bc89b79e0a9c58b79753bf217314a885f52fe36725a5ef8e8682600e2a3965b91bdd7eacb7d37411
SSDEEP 24576:I0Le5ji0hmxWrMgKNx4fl5Tn7UOy/t3z0+ld:IPji0A4HKNKfXTnC9T
TLSH
T12B95AE16F6748335D073C0B9C5D2A69EED72308657308ACB4286D77C2E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fdb1ef9fc8bc682b368365b4cb5df082360b8f677f2feb9ea0735809fdbae8fb
MD5 1f593598d8de8e131f2332e11f861936
SHA1 552434cfb6f8ef04f93ab4c33738a8baa2b9eeab
SHA512 93c70c00cffb44c0416afba19db09c7dee6d6cee7af293d30e0a36c5019d843f42be647a1b31b2a7e5c8b2a615bc5054f68212c9979d179197a018bb9cf962b0
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyuyKNx4fl5Tn7UOy/t3z0+ld:z/ezSC6vUzPvxHjyrKNKfXTnC9T
TLSH
T182755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5ede2d99533065eaff234869a2a872d5324bc0378795f9d91598f68796d70bc8
MD5 3992e9c7c0fdf4bdcae896e3c9064c1d
SHA1 80c0df2e0b5097422c107c9299b5f45082630b8f
SHA512 32c60dd94d1173ac5a47449d5fca676a62b8606f0d44ad8eef2f48a83b243fdf9ae68bd6eb83ac621f53b12112ef5e46166b8965d27fab7782be8690ce56ccb5
SSDEEP 24576:nVbqPb88hv/l+6dKNx4fl5Tn7UOy/t3z0+ld:nVO88hXl+UKNKfXTnC9T
TLSH
T107559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 9eb51298f4affca51f827d2cfa587f96b8f1b40e8874c9a44cd8240aad36fe2b
MD5 595faf104c8d99f73c6bdbe09515c992
SHA1 c15628edd17f7d5a525341d11b214de7ea50c674
SHA512 663fa2362ba18c900f6626ed21485012126e8eae8a6200f774a8039bc42a41df7aead2b036c7131709aecf2ca70532449f80977f6cac95e64174ceb639326316
SSDEEP 12288:8wcts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:8wcKNx4fl5Tn7UOy/t3z0+ld
TLSH
T178552353E59CC9E9E7E304B069F459FC4A133E25648A8C13E6607F7C497E88AE83B4D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f6242d0e8b81d5f34521f12d782155b76b295a53596904ee4781ae6ba3c12a8a
MD5 403bc7f893a8b9b84aaddaaa5ee2c30b
SHA1 9ac34300b62e3adb92d48e4c14ee4d6347da6c63
SHA512 e4c39a270fb41753c741a83b7c2adc2950bad311702081eacf360111cb0d3cec17c11ad781cc85f9cffdb30afc73e67939aeceda9ccd6e8b01a7e09384dbc95c
SSDEEP 12288:reBNUbTVO86U1ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:rJIU1KNx4fl5Tn7UOy/t3z0+ld
TLSH
T1B075C03BEE28FCE2C27A4DB85AA18640D77278304B52A3CBE174830DDE275D55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9ff771c4285da76cc3aeeee0ce17a8943221a6499ba29c070a5021cdd2baaf13
MD5 b804fc897e0971f3a8af1f9ceb07ad64
SHA1 928c6d8ebcd5a49c5cd58afbe160808f17604c4e
SHA512 f8b2cd21b7feaccfdc4cab32c3d7f80d661c827b63b85710dca855f3958320abf31608865a275e81b231042f09003602289429646c1969089a4bc34e775f9a90
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:HQvGAdlCEL8c/yRNw5CiKNij
TLSH
T18C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b34da0978d91a611b8e4b5b2d1168ca15b44fad15e3dee93552e8f5634cc2163
MD5 7c6effca9725ee420ec5d4385fa00ae0
SHA1 5a4c17e927a798b033790451303993b09f633684
SHA512 e8d9e7aff5680ef5b1678db718b5333f88909517e3b75eb4e07f4429e5f9742dd5f634a4f1205a3c28f88c20c4bd2ca21c2b14b408670fc2488f85187246f17d
SSDEEP 12288:8AwSfxL/2Dc3EDLLmt0LDQewsAj3ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zwi:hZewsAj3KNx4fl5Tn7UOy/t3z0+ld
TLSH
T19575E031FE74E436C3BB0DB21B36C71A182D7A204B5219C3E3A89E9D59342D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8dc2a0f26283432efb51e64e0e2110bfbe574233a99c7453ad9da849df71f7c5
MD5 9c1325e4cdae1ba5c9a57833fe00ef09
SHA1 33777151e12ccd9068e4de850673d081673f31f0
SHA512 0d6e19f6637f86b85aa9686757256e33c8cd3890ee6334aa8afc78f61f247969f715d25a90a802f1b6fd018656f4cd4cd461a70c2583bb572a8fc66428614996
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmE:PUEtQevvqc2W1cpV2EI32
TLSH
T16A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5d9f530d39a3f2de36195bc85b4837d5bfd000d1ed6d01e3e1f93b3e06a8060e
MD5 73da75e2902ba646feec6180ae6be9e6
SHA1 0b34d52db204ef3ed16439175a1bea8d6c25ca3d
SHA512 408763e259c8afbcc2d43d20b4abe804b0052db6dcd41fbc175b3ce1b71ccf10c74b65290ad22bfc57cf9e725d61592a9df1b786c4206f9e64b9e0ff210b7bf3
SSDEEP 49152:zCbRquA/m2yL5zifFiV+XenmE3/zXKNKfXTnC9T:MoqHVjnmGKNij
TLSH
T1AFD58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4dfdb8fd03845120f7070265450e96932db8e89476a95d06f1824cd7f9bbf729
MD5 f85a85433281e9fdabbd6578a0a20cbc
SHA1 2d29e1b61e5169b3a3b5ab1edd8c6a13dce74b8c
SHA512 de67974e6ef8cb83b5f110702c12ff6611574b99a00690f8fbd270f98bc207950da223ae07a691f6e02d3aef4678cd7bb2c013cae7514e186bade6e6dfc5a6a4
SSDEEP 24576:RAhGLJIFoiwtA5l7S53mKNx4fl5Tn7UOy/t3z0+ld:RAMyFoiq52KNKfXTnC9T
TLSH
T17B359D81E7F955D4F5F3AAB899B69170EA76BCA65E31C20F2160D11F0E33E409D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 96435a7207fd0f03129a98cf1c668db9d84198cf2a2d037ca724f52cc9af59ce
MD5 83cbca28271c28d9cdba75ad1d51713d
SHA1 0e978869a6aa118d788397319b740f99a97bc842
SHA512 6b3951b253863492dd62584c8268b2ca447354eac6207811d580116fb5b1cacc213069fb92a2a462e2b8d5b8b2c0b4a5828e57d4a8f43155833791d436a49ce0
SSDEEP 12288:kmw5HEjsChNpBFgl0WDm+CSts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iR:BwuEOWLKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1AB75F14672A80CF9E9A3413885A7C535F7B3BC122A25CB1F1760C66B5F37251AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 a53167fcc21a7f27134eb6f562e7ac050a4e69acc7417662f7c23f2c10f39bbd
MD5 41abe606e7b926e58734c494d236f49f
SHA1 59b632af7ac2744a9d35c61b968f91dc30e70517
SHA512 fd695fdcf121f156fa680784d6b0c8d7cc811ac09fc5d1c2cfb32e235108e6401df5017ad052df5871c3d6f14229a768a8f66fad3495b0354d06d7cfed335eca
SSDEEP 12288:kmZ1Iynts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:lZu4KNx4fl5Tn7UOy/t3z0+ld
TLSH
T17565125632E860F9E2E34178C8F14698D7333866237647CF62205B781F37AC6AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5ee2adb6cbf03b3174d4275253ba524bba9ea51d8aebdc3b64fb58d2a1765c19
MD5 e83e6a3910eedb720cc70e6153cd6128
SHA1 e676eea5928d84d764b32fefcd86c2b0d88ad968
SHA512 c2f3039edbdf7ff8bb4b783d9139b2aaa685bae82f332844e383bea5726c25ebe60d0fb1687eafaf7e04b8658c8544c004a759cbedfef870040229ec329b5258
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:UQRQyi36YOcPQLvw2gAf+PN3ZKNij
TLSH
T16B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0edb7d5a8c0d4b0d3da169ea71277b71951e4ec3dc2d5ae86dbefb51d8e6908e
MD5 bae08951224946132bd0dd3e37154b14
SHA1 b58eda3577b3a7183b9a747292c7d65328cf5f4d
SHA512 e680ef00397b27d7f23c03542f6aa1e7e729220517c81fb626109ecd5ddd3fc92c66cb68ab6c2d5d80d0432f15f8c47a553bb3a9057155afa2c16e145a4b5544
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:DQRQyi36YOcPQLvw2gAf+PN3ZKNij
TLSH
T17A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6b43174368c0e24486c01033a31fffb864873a71444cb40c4465b46a0574805b
MD5 d413bd4cb0054307942c0fa2c1f4d553
SHA1 8114f75f3ceb0be73e42ac326bd39f18e5b99951
SHA512 7cd163fdc43e2fb98ef82e7d0c39a0aff13dda9b3b20e36f15dfea5be00767a58d35fe18308bc60e2395efc88b037795cfaa84233423b1acc396fdf20be58033
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0IKNx4fl5Tn7UOyT:y68Qg55nhheWu7PNU3/HKNKfXTnC9T
TLSH
T17CB55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 83632aaa44640c25fe25df800c37c04a2264dcad27de01bc7d5362e5d47594e2
MD5 47ebb54d476eab7ca1fa68669f20008a
SHA1 ca3b6ad4aacbc7e2db62f12b3625336d0636fa19
SHA512 6f1b0d7f101414c2902cab16174bb58c0035129106a6c1166df3b0bc08dece69704fd6d333cbc75d53e68c3961c2020649ed9ad39a5ec83957013dc53275f037
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:7y5112gYy5azzVvL69nLKnhZcKNij
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c60d5620960eab239b015c118f1f936dde93bf41ca2e994a9eee8ae22ef9c7e8
MD5 95f7f5afc0930c41a04f78c5a2b1cddd
SHA1 20edcc88bb6967c71a3b2bdf0b6b65acabd7299e
SHA512 932109017d1c7b106fc2692b570692279379b55ca37d9c5d98b46cc3325a3e06716b0cf60fb2ad11cb1200f5dd0a31222ef9a4fedf94b00468ff51a096d0c7c0
SSDEEP 49152:AB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRKNKfXTnC9T:au6JmVxd2dRKNij
TLSH
T14AD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f79caab35b1d0a24c517c4cdf4ff78d8d580b67c2c495d701391ea7c48c2cac4
MD5 3a52c0d9b54d83c375793ccf9551ee98
SHA1 9d566658fdbce93ddecfa22a6c89e8d7ae79caec
SHA512 fc44a9ae6d391a1d76dae8a54096650274ee769a9433b5cad3c9e693d489814a5deb70b4ae99452f4fa5ebf67c5dee4f3372a38da58615e4c180faf1d0267ada
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4xVKNKfXTnC9T:3mifPbRGKNij
TLSH
T165B5BE13F2D801E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3a54e1772926dee22a42d98bed27402377959e2ea557e077ab7e6c26d8044cb8
MD5 2f7765f64d30ffa3ece71feb4e8adf0b
SHA1 fd08e9c130abac48fc5c6853d67f3958b14c31e7
SHA512 599001080e3681080d6a5dbb2be3158f04db2f39490f45dc3850f689bb2445851e37abc9c5adfaa33a60975911cb6a7c93aae253f6f3bb46b3c1d8856d919728
SSDEEP 49152:jSuZQIY0Be2KRRVtOnks6NMHq4KNKfXTnC9T:B5dKTi614KNij
TLSH
T170C5BE03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d93d998a12ca83e7357e23d8498b9e4790b344d2d8bdd92d8ca3968afb0836bc
MD5 316124267e07faaecd12fa4370b96dc4
SHA1 1a99ba104d68ba1bf04ef45d6973a48880a5a139
SHA512 c3db435f8fa9b3168a89ade3c808698a7532ececaf411f7a59817e9b0967fa86a904f1de60ce14700c82d43701b91606bc1520ed19ec5e0f6945a96875bf751f
SSDEEP 49152:0htSn8EApI0figngiDn0AP5wBKNKfXTnC9T:VX2iyphqKNij
TLSH
T15A95BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 5f518bb16759cf5a39d1a75315b19cc2cfd8138cdc3e60574aa2e4c162198041
MD5 cd7f4cccc4f523d80dfec6810f72a7a3
SHA1 afe32b70ca8f30258201a899f2b490c900291bf1
SHA512 8ce2635aec7ebe58a6f6a83631ddd05eb73dc8a2c60bfb21aad4714e0ca2288a79e6a22293134489e644d86b1e50811c107d617b02c79f87fd49a013c1d5a7e1
SSDEEP 12288:pUts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:pUKNx4fl5Tn7UOy/t3z0+ld
TLSH
T184552352F49CC9EAE2D304F059B055FC45173F6AB58A4813F6547E384A7E88AE83B8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 5bacd334eff840c4096cef9d09cb1eddcd9610838d1eb3a770b34e2ec0e2eb3a
MD5 7de9a6c0367c1e277c6bc9017178cdb7
SHA1 209dc15ffd9061c4d36f2c5d9918f1725296726d
SHA512 1af4df7b30460d7ed76a285c32267f39cf0cdde53f4f28c7c78971d39ba46de1214b35644768680ad692fe6eceabc9478a1db0c388bbaa5d2a33e75d12b17154
SSDEEP 12288:RTts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:RTKNx4fl5Tn7UOy/t3z0+ld
TLSH
T112552352B49CC9EAD2D304F059B055FC49173F6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 6a75fafedb66da971be2cb409ed4023fdaf5e105893320437a2fbc6731b03460
MD5 ad83522cc27982db8c919829e014042e
SHA1 91856b6cf4efdd673a81b6db361ea38bd8a0e354
SHA512 2c8bbc570844837f817627e04aef68a9ff1ccd45a670795b7d730b7f55522fbfef6c7e80a722d4fef8733d3315af981f82aaf85c8904061f8d1fa8739ee16304
SSDEEP 12288:5tts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:5tKNx4fl5Tn7UOy/t3z0+ld
TLSH
T119552352F49CC9EAD2D304F059B015FC49173F6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 380e585f77b169d96c0fa0631af320525e1eb4eafed8bad550fefad1ad0fc7b1
MD5 014cb57ec769f4799803cdca261736e5
SHA1 2e332486812f41348925a953c6d3cec1ee757f6d
SHA512 27325d0bf0fb7a03d60115b20e9732f35b1702beba984fa28436f8f1aa64393e55027686560a650ac641dcb71f0ee50d114ee25f1d0cf6ffd1c51b9d7b90da88
SSDEEP 12288:IVGts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:NKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1A5552312769C85E9D5E380B0C8B145FCD6333E6AB3564A5BF7102E380E76685EC3AED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 9b51dbd032f1e3d79d13ce2b6c9c7e9809a0c52477122fe3bd5293321861395f
MD5 b58d429be4112b06cfd2121b8a57cbed
SHA1 fff4d020a02e0e553e79aea8568eed2f1541e8e7
SHA512 9c57be7e17ba4578058f0d8ba4f9ac293c7c037bcbf297abd558d622d96bf39f60534159b73025e8dbfa82f3357fe8e323efe5daba4f2ddbdbb01abd080548be
SSDEEP 12288:ruts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:ruKNx4fl5Tn7UOy/t3z0+ld
TLSH
T17E552352B49CC9EAD2D304F059B115FC49173F2BB58A4813F6547E384A7E889E83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 2e3b919244d3f126e94a979f167ec1069b7ba3eadb56fb688f9a5a1a2b97782e
MD5 983e912c9c6a7ff34361ba9f2684eb56
SHA1 1fcb3a1fcc570bf04df2283c6a2e9542c25b0a5b
SHA512 6a1a1c8aaf0cde1c4346cf496cd53b2804176148c5d22128020cdcad974e2b0a9e588c333fb4ec832054fbf99920734bfa514009ea9b56a04eb9dbf8e8be78cd
SSDEEP 12288:1Pts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:1PKNx4fl5Tn7UOy/t3z0+ld
TLSH
T127552352B49CC9EAD2D304F059B055FC49173F6BB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 671e6dad00c64a42f6869fe9bf01ade286a9f8b537143e6b74850e3db8903e8e
MD5 91aa4a118cda47416d4527fff6e34581
SHA1 3df7e8454363ae363e733e815421e0c94a6cfe8d
SHA512 1c84272b8df83abfc4cf4703b4011338ebbfb32fc4a8b73e49cd19e95414bf39772f92c25209bd4db8ee761a713a54770cb81d68910029f629fffd248533cc96
SSDEEP 12288:Bbts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:BbKNx4fl5Tn7UOy/t3z0+ld
TLSH
T13E552352F49CC9EAE2D304F059B055FC49173F6AB58A4913F7147E384A7E84AE83B8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 9269063aac480fd8cc2bf67e2b350044ff5ab63dc3621a44ef01d54758b78779
MD5 2a55c6e437dc1cedc3a3bf6fb092d0eb
SHA1 38b3d178a4304ad75e35969fd39d2132efaa0477
SHA512 f6ccae2a31cd9dd30697e3c381b54ce0f09cff1cbafd79203f3f282cf7ce1c97693473b827bd31f919ce357781fc5d1529de22f54b108116c1f8fc040c515414
SSDEEP 12288:6iZwbWzzFEoS2cPvyzts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugd:dZMWzFVSOzKNx4fl5Tn7UOy/t3z0+ld
TLSH
T13A750195B39048F8ECA3813DCD658955D6B27C2A1760CA1F13A4362A5F333A15C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 af581844c460ec727b42508f60587e7aa2b5eff4fcefe88c833002f72461470c
MD5 fe4e9a0934158e2eecc0e981b9d208f0
SHA1 aa567c62b287c9a3949fbca73c5d2beede0912b2
SHA512 cdde4217741a0fe12d227a3054c0e5184473494e5fb8cab2c849c69a54993f6c20d0585d5212f3d048896fda155f7a4dda7d73dc1c09fb7f69c44bbeb3494b69
SSDEEP 12288:Wots3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:WoKNx4fl5Tn7UOy/t3z0+ld
TLSH
T159552353B49CC9E9E2D304F059B055FC49173F6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 993fc3712be39bfb531dcdd7464b529bf1005e065a65689d51c0419ea026e016
MD5 29f4ebeb1a5f3720fd03b334df14040e
SHA1 656c81b58b6c7a65b1a8dfa40fb5d89a143c827c
SHA512 57018637389b5f464f830f8aec5ebc4eb765476f6dc4152318ca852227fead46d125e4c954e04e949f6d4da4c293a6192f1aceb5fdac145d6c836c3cd5736462
SSDEEP 12288:IMts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:IMKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1F1552353B49CC9EAE2D304F059B055FC49173F6AB58A4913F6147E384A7E84AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0d391f1999281d561a39ca0abd92efc11162f1838eb4d853070478818f347e06
MD5 0aaa2884a90ca8465f456d3faa9bcefd
SHA1 f7fff45b2e82a18f3fa27845d04f79af235a3333
SHA512 49c01dc5634cabc19d333c14d1df3ce2921cae887ba814c641b625971bfa56585ede181c68858d971359f8767081e32e30a010fbeeb8565935e67b470e481e33
SSDEEP 12288:lyPz5L8nts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:szynKNx4fl5Tn7UOy/t3z0+ld
TLSH
T15965020372A420F9D1B3817488B21A55F772783657648EAF63601B7A1F376D1AD3FBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 8a0f6e8f92100aec956be9251f6949648d796a8ffadeda648c7b5d38218b20bf
MD5 ad2f5f28b6f4b1edf79a76a8c4efea33
SHA1 b71dd9c69370b156ae9082eb1f0c1fbab98d3931
SHA512 a2b692f90935f7fc1f1e59ddcb5d7c7c3728d1c3efe389b5cf701c227e92dbce4e53f414bb2791d6f31c9193e15d2f82267697d2560cb5cea0f5f5490c58cfbf
SSDEEP 12288:Sots3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:SoKNx4fl5Tn7UOy/t3z0+ld
TLSH
T107552353B49CC9E9E2D304F059B055FC49173F6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 2c2f7d9e236ab7a53512e80bfb4bbe63a6a81e731bf5eb7312b5091202d563f9
MD5 e8991f981bb692092063198864b4fef3
SHA1 db594dec30045a3bc5df47983c0de78b91f84ff9
SHA512 4e2680552ed98c1bb9c5848f88feacde4d9d28b7803cb09e9f43627f2f49f3e2a4c12cb976d3b198671a9564f9d5d0b8a2b5e83f87036da76e7351a3276070ae
SSDEEP 12288:vots3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:voKNx4fl5Tn7UOy/t3z0+ld
TLSH
T12B552353B49CC9E9E2D304F059B055FC49173F6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9bae7543d967c5fab35fd83489a77f5b9146c149751db2699c519fab43da78bd
MD5 56eac6b2c4513e5b0887dbe5c7010c58
SHA1 9b11ccefcbb9b96e9abc0b356736d3fa9f2977dc
SHA512 b301ec931848750934a0c1281ccab90b40d3ce3e63dfd3b0403acb7b6110bf6bafca660c230cf0f4f1ac43fb2e0ec4cbe1fc27b65de568869cf7dea3d5068b73
SSDEEP 12288:CyPz5L8nts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:fzynKNx4fl5Tn7UOy/t3z0+ld
TLSH
T16F65020372A420F9D1B3817488B21A55F772783657258EAF63601B7A1F376D1AD3FBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 0450683b817d5cd292f7ae1ea2f3f49997bc11fe4e410567978cf060c81ee848
MD5 1d720bcb16c734d8068f02c52f90e454
SHA1 ba2d1a52f9c99f6ccb36f8e1e7a639d19f0d7a85
SHA512 4a2331396357065b363be2e9c1a664f6e98291b0bb557889949e7da5821a3a175aadeb63f1f4314f51b127aedf1c276cf756bfae61c6e39b991016a00814d695
SSDEEP 24576:MTjaLl3z0zD9KNx4fl5Tn7UOy/t3z0+ld:MTOLljyKNKfXTnC9T
TLSH
T1F87501A5B39048F8ECA3813ECD658955D6B37C2A0760CA1F13A4366A5F333915C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5588e66093945ec659e55ccea4072e2158bfd650909156fe1ef27c698dfc62ec
MD5 13d4d32797fe6b67a9ab9f8fa08d5e30
SHA1 85b0170f3606ee71848e6c61db2dd81b23de1130
SHA512 a95fd59f7ca5a71cb0ea364167e7023b008b17213fda6549c29890726a63f6519293a582240f61fa238a949b3506820ee43a4d6c74b961771be6fce411c14577
SSDEEP 24576:F3Yd9CHKy7GZ5KNx4fl5Tn7UOy/t3z0+ld:lYd9CHKya/KNKfXTnC9T
TLSH
T12285CF90F3E814E8F1B39A35CD764511DA767C5A1B61DE8F03A4262A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 0eb6c6e25ceb2f7071cef97f71463245e2d1950e65f47411bb0b434d1a8e6023
MD5 7e38e88b5d10c1dfaf8ef50078ac9e40
SHA1 ba5468c19ea72ecac393940d5cf8ff6661a72fef
SHA512 53d7a1a34cc2c3df5d369a943f45c21a9d2bc397e5dc0d0339389db170651a93ba5990ad128666353111beb5a8f35fabec8aeca6646bfc7ff6b9cbb6b478bca3
SSDEEP 12288:lNts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:lNKNx4fl5Tn7UOy/t3z0+ld
TLSH
T157552352F49CC9EAD2D304F059B055FC49173E6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 7f100fe77d8bdf620929f13cd18324201d1667d80435092f88a54c518e2211a2
MD5 211e4d4ddf5c4a57ebb58e73d4422755
SHA1 880bbab2260f71b14f973e2068ac4aa7b6d3276a
SHA512 da513c610ea148f3e08feb52421754fbfcc4d49688af8b51f9b916578f1a3f880e018f4943e3ccc02d67e327619b891b09cf1b6cb2cf640338180d35bd8672a8
SSDEEP 12288:bHts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:bHKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1D5552352B49CC9EAE2D304F059F055FC49173F2AB58A4913F7547E384A7E84AE83B8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 b7585e5dc3c5d3edd94ed01f9b2dabf0929fc129eefe2f232db661dbdb0d3d4d
MD5 09bfd2a2d07e0ca56343017016e2eea5
SHA1 3e2063b8e67b71d8e2660dc16e6bc757e1d3583e
SHA512 bc5d5ad629a103e26f7767614401679a3a5e08d176c31f5036af27caca41ed1446810566df98f69ccacbaef984362a5743d318737d543af2f573e74412312258
SSDEEP 12288:eats3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:eaKNx4fl5Tn7UOy/t3z0+ld
TLSH
T118552353B49CC9E9E2D304F059B055FC49173F6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 014030131b628feba3c7eeb24b65c703217ac1ce28b38ce8128dec307eb1cfa1
MD5 df291fcad7ea912e726f3cb9a99894af
SHA1 9941c7546a5faa22ec95875aa1d3839c1cc0301c
SHA512 2a8c18df3c21c6548bb2701847d485fa6ff98967471df829ec57162b98500b0b4f3bfb9db6332b147fd49ba256ae44f07fd336297015cf37d9db5d6fb9789720
SSDEEP 12288:Gots3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:GoKNx4fl5Tn7UOy/t3z0+ld
TLSH
T112552353B49CC9E9E2D304F059B055FC49173F6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 5845973e02d7f8b0e2ca4cc80cc7ed1f46c741a284138181525bc091fe82eb67
MD5 f697c0d75b3da235e2945f1c173972e9
SHA1 131138b5a44cd9c1e14a22ebaf4617532c46d41c
SHA512 148846eb51530a9db4813f94dd9a6b2b60f61f13a240a15ae435dd3e260e1ae929e7d480f06d408771f9c2de3436e49715d23ac8e2f059eb0a684ce7a4c41ee4
SSDEEP 12288:uNts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:uNKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1C3552352F49CC9EAD2D304F059B055FC49173E6BB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 2a2856e92556d8194777f411fb6cb0f8df00ba9aeb925b47ad5519dda6a942fc
MD5 a66fb5010ef9e7587df5cfa31fe0495f
SHA1 daa72c8f8a4e4a80932b11c7654adee786c60b14
SHA512 6bf5e46120293bf3ae5dd421c5859b4e98745f39ed5964be40aad79127de9d61cd0347fe08c2556a137957720056732406381ad26061f4a99985edde418ec71a
SSDEEP 12288:fwts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:fwKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1A7552352B49CC9E9D2D304F099B055FC491B3F6AB58B4913F6147E384A7E84AE83B8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 1bf7bc63c781ad8a548fe2d497bff093726afbddafcaac01eefca6d2e96c27a6
MD5 9d6d16c0192e8f655c6a7a4e113a7af7
SHA1 e8910cb3376a93a03290ae68e3fe00b2aa085328
SHA512 e592197d4878d2cd41cc3668dc5434a749f9c7c0f8f02eeb6fed990fb7a937b18f9fee972be2579f04c28bc9d50575d752299af340fadfa9bbf88c8ffe8dd803
SSDEEP 12288:puts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:puKNx4fl5Tn7UOy/t3z0+ld
TLSH
T12D552352B49CC9EAD2D304F059B115FC49173F6BB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 8c8cf23e8fdf17ebfcbee41c90120dd9607dd6d2eb59c6e177262bea33a5545a
MD5 75fe285aad055230a6e56cc284c8ba1e
SHA1 4b1f8f2cdc5d3be3311ff4368de80fadd4609fb3
SHA512 5d467de7e4348c335c494eb36d56a744a7eef5e301ecde3839ec0b537533924afb5b69b5853aeec215577e395966ecb7f124029722f55cf98929ce9152a2752c
SSDEEP 12288:Jlts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:JlKNx4fl5Tn7UOy/t3z0+ld
TLSH
T14B552352B49CC9E9D2D304F059B055FC49173F6AB58B4913F7147E384A7E88AE83B8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 ad1eb2b84ff8a724440282cce698680acf38cc55c58c9613e6e4f33661f1b0ae
MD5 dae17bc974ed6ebea55e56daec401782
SHA1 429e7f63f939b0a0314cd24f3d6ab91770012dda
SHA512 499ff220324911386ce64c0da1f575796856c86aad69eda9798db94c5ce4c252d840d88d2714bcd637d6cbc250551e04413683968b842f1f12de84cff83d05fe
SSDEEP 12288:Nuts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:NuKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1C0552352F49CC9EAD2D304F059B055FC49173E2BB58A4813F6147E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 17ca190609cadaf1659080a1173bb2789d7ce122ab6223932db7babfdba785a1
MD5 2c85c30dcf9184468698cbd954072ded
SHA1 b9d07a8ec113270875fbb1c562fed54b9a847e85
SHA512 e070df645d2f779df882d9d2ced14df24ea5710821316c1107143a31467634d926368f929f80ee41b97ada196ca603e3109440db065d47c2aebdde5f7a768f15
SSDEEP 24576:kfwvUk9RX6wkyAI8KNx4fl5Tn7UOy/t3z0+ld:4MnYI8KNKfXTnC9T
TLSH
T19985D029EBDC44E5E1B7913C89B3460AF2B178691B31C6CF125A536D0E37ED4AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d9df279ee959dcd323f8898092ba093f058f1f6f591a44595788e3c5e03a6eae
MD5 c6764844af28e88c3554b55a7efea174
SHA1 b10dd933520c2102d0cdfa1148c9c1006cebe8ac
SHA512 d26572602ad7f680d487f0273e227dcd4bc4dad34821ec8af1ab056142b14e41aacf54f20db876ddee7d87844ce5a9f28de173afc18babc8f9fe55438090540f
SSDEEP 49152:VYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hKNKfXTnC9T:VySzP5KNij
TLSH
T101066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 65982121ba5e5e35e9dc771097fdb09e99e6d8bf5a4b420ce98424f400709c1f
MD5 5e92bf7818befff478d1a05f8d52f09f
SHA1 292aedc92a32865430082ab8c5844caa563fd878
SHA512 d40619ada9874428be15ca53577dbf77cb837b31a1fb4904a2c3b1c2a7be0f4c22c123d96a6b76d7cae7a2fcd5a473412c19f1ed34fcf12c87dbeb1e48a5acdb
SSDEEP 24576:T47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYjKNx4fl5Tn7UOy/t3z0+ld:T47JUQj1irIhCnDHUPfF/RKNKfXTnC9T
TLSH
T14465AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 073bec4e52892eab367530fd5e4788104534c92e65802607d5c62642784af39e
MD5 474cc4d355491dcd87466b07ed1005d3
SHA1 c37826690274fe5277bf9cbd37d2804258d502dd
SHA512 7937cf234b3a8e2f05fece3c5bec88dbff3589d557b3de088b2074ac4b232e08cdd172c72164e7e2c41d12cc6692167f7df6da3258c89d0ef391d6ebc46599d2
SSDEEP 12288:uxsf4ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:j4KNx4fl5Tn7UOy/t3z0+ld
TLSH
T13D65011AE29842E8C0AE6174C7654A94B3333C2593E1D7CB63D0F93D0F7A5849DFAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 add76dc24ff3b662c2cba0ba3ecf83ecb9c3428408c2f1a585fdf33971fa3f34
MD5 599d2cdaba4b62e2bc12179fe3e94641
SHA1 347c3f22b4e5d632060fd3a5f3890b6e355c1f71
SHA512 1a5be9ee2f9ea03ebb07cd2fd6a57fa1e3c178921f11ede6a04866e555ac354e8f73c00dd38f1a03ab519087f2e79b712d7967bbbec8cad8aab04887fef1331d
SSDEEP 12288:TKpJU3fKzc+17knYAlDT6Bat3aRMTUn+k3ILBUY0:TKHUPP67kXG43aRM4nxYL6Y0
TLSH
T1023508507626CB4FC6A940321E73D2CCAB707D05EE05AF1773C9873F8576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 bfbe4cbef2733296df3c8317f0faabc289a6442b80f26b7479c6f1355878069a
MD5 1e62df4a290709abc16b1f39ceb47a35
SHA1 17cd669b17b3a5a603ebc6d6ec985d3b764d6682
SHA512 bb00b09cfd749059c06f97397e199d8203b08a52254f23748997477af7db47db2c81e4f06cc9c2316a90db12dcf0b6c40fedc971d2487e3a00a8c325554eb1fe
SSDEEP 6144:YJfyjqqpJm+1G8rbinL9+xPYAlsHvEtMx6vEtMxlqL6AjWAkYI3XC+n2GcvCuWrI:rg+1GYmWYAlsD3GiXGcvSrUP
TLSH
T1DB650A80A536E78FD1F72032072A5B8CA7A4EC07B7095F26B3C9453AD867755A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 32200778bbd2b59832a60eaa047577050bda57e59fbafce6c7bc23384564afae
MD5 72938cc8c0745c0edc99400b7d3865a3
SHA1 cba910093313f75cfe62cbb0c33428a000aa29e3
SHA512 0f61dcb485ecb49a92ba1a3f6e8588962c53ddecf910d74ab01ed7748cbf81c005f4823df3d862030ae1380ba618a26745623f342df6927354e0e9b1660c4977
SSDEEP 12288:e07Ats3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:/AKNx4fl5Tn7UOy/t3z0+ld
TLSH
T196552313E29CCDAAE5F314B058B591B8161B3F396B4588D3F6107B78497ACC5EC3A9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 153d9fe3686b9ef2722354abb36c7517e62e4df778d2590249ab9a517e9e2327
MD5 9d5762b684baa9e20c0dc36ac4e68ad1
SHA1 50da89e76ddd1d4a3995c6fffff3e9badb28733e
SHA512 ff5c322768780d168cd2eff73021f31dbb9d29910a29de41bf264da774c3a8b326d4cf61d9da44e54408bb02b4f27b11e7022e9e8ea60196b9f650e7ca6c3b24
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYyKNx4fl5Tn7UOy/t3z0+ld:rgb4mBIBhGFjKNKfXTnC9T
TLSH
T177659E1E22EC02F5E0F6D2B89DAA4417D6B278161732D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 74bd8b59bd263c1e1bfb52856f0eea6abc9e40a74d9067b862376e542c3c47f6
MD5 341f0f0b465fb9f3df293286b5e09ae8
SHA1 e76ad8df675e87cc6d41c6ed01f08be2b7e60215
SHA512 b3fa50f7a5cf69a388f97d17ba7d3ed65c8b8e300330c26d58cbd048afb61e1269243e0dcc0033704fd526ccf278a61aacb8425ffc4e705c69467b3898286e50
SSDEEP 24576:+G88u8FpJqH1Xzria7/mzKNx4fl5Tn7UOy/t3z0+ld:V7ZFPqVqa7/6KNKfXTnC9T
TLSH
T16B95F16176E401F0D4B7D138899246A7F6B2B8251364EFDF07A88B651F23AD54B3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 476f103c56781067aa8afd53b3085af7dac874d045af7f3217f36bf0dc775a7a
MD5 effd54d31a24259921f8ae98ded5a735
SHA1 61c866a32c171b386f6b772ca8eb0873446ae2e2
SHA512 b204e961aa0a74e06f3f0b0698e4d791f0cbe175677a61c6a054a600187c76ab9b50a8320b5d4634c06936f47dd407fc2de408c285056fd79a94f339aef13c39
SSDEEP 12288:0HvUrBFrEjwaQ/ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:0PUr+NQ/KNx4fl5Tn7UOy/t3z0+ld
TLSH
T16475E12F62EC18E5E6B6A17C8992461DE7727462131296CF02E0817E4F77DD8BC3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 67808853f8d9608e14e2a5acf45b12b531275b68cc692091c37725ceb657688f
MD5 9678e3ee0da1ca71ba83cc9120e6d335
SHA1 877f9087bb7c733c2da76223d8f414f34e83e0f0
SHA512 4a796fa4224aa482cca79e4c72c4b7ee74ee72d84e78f244bf77337d9874415a080cf166afbb05ff9eb726cf320cc11f61790526590b01f01b35e5cbfc5a2be7
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPKNKfXTnC9T:oG05lO43bEKNij
TLSH
T10FD5C06A62EC11F9D1BBD07CD9C6460BEBB23825033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 50aa19c564a94554539e6f151892047539b36d5fb3211e394dd75e0be14ef1f3
MD5 85d0d4868e14c21aedd78e7be2cc806f
SHA1 9715ac92d2f586c39b0c7d8e7fc1d450072cc15a
SHA512 398fc890b47fd9f03bb40693172bc96cc7099cb245d6e23dd1df6a74fe3d3c4608b29ccf68ceb841f8f72e181437f41cbafe2d3806924df186d58fff7e9eb2a1
SSDEEP 24576:Ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhKNx4fl5Tn7UOy/t3z0+ld:Ma5POZ3+Jt2pasx2+mHKNKfXTnC9T
TLSH
T16265BF5EA6FC01D5D1B9D17CC583461AF5B2342653329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a4ab251f3dd26e7f8f0e027ea4c9bfac7eccbfed505e03542cb965829e5c39d5
MD5 6a2c40b28cff164368b730bd7122febd
SHA1 d17ca81115730b772c860dc08924fb01eafce84c
SHA512 447bacc873feba6bf9445d3c8a9d76cf1d1b04608947ff4c53abbf8f5076af8e79039f238150be63ef4144c2e98562abe672ad0f2f8a1637ee2383090c893043
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkrKNx4fl5Tn7UOy/t3z0+ld:xNc/zEOVHFaKNKfXTnC9T
TLSH
T143857B2622E901E4F1BBE1BE89779546FA71786913348ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f35c1a2d0a21fe45d01dba0ddbc7e7f500e1e3991193b90d59e604eb20a9e896
MD5 90598af54b33fca89fd36601d4ac997c
SHA1 8fed9b36aca05f9c38a634ed3cd0f6ee34b85aef
SHA512 9a2b2129cefa8e39e2566875427f0dc0564a57ca7f0bdabf9b17c9ddd8f4402fd09ede8bd229106f64a611e7ebe25fa0a445dea2fce8754963eaccfbb7f82909
SSDEEP 24576:o8kNvNnaFeYhJNtmZBmlKNx4fl5Tn7UOy/t3z0+ld:o8MwBtOmlKNKfXTnC9T
TLSH
T18455AF6EB6F846E4D1FAC6B4CD238512EA727461173293CB5390C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 4a09070b48a8035fb8c0a1b55cf24dc0fd6e12e8a9ed049ab3cfb6b442288c03
MD5 e7af807e705702603daa97698a376252
SHA1 50d3606e5ab3d337096cada4ba8eaab76eb7d5c6
SHA512 25f5e091946444eaba99eda58ffcc0b7df019ef9213d28d21a9dc4c1f07fc0f354dbb1ee2007a7d5c6711f02dc20d779b0121da5f4c7096a19059ff7ea1d7c22
SSDEEP 24576:eD3FHshBIYQgA0KNx4fl5Tn7UOy/t3z0+ld:eDVHeBIAA0KNKfXTnC9T
TLSH
T17685E13EE69C04E4D57BC1BCDA638A06E77238A9032255CB129481B91F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2400-40-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2400-53-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2400-51-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2400-39-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2400-48-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2780-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2780-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2780-55-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2780-278-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2804-80-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2804-79-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/2804-362-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/2804-85-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/3144-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3144-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3144-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3144-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3400-23-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3400-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3400-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3400-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3912-74-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3912-68-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3912-66-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/3912-295-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4392-381-0x0000019C7D090000-0x0000019C7D2D8000-memory.dmp

Download

memory/4512-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4512-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4512-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4512-129-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4512-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4688-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4688-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4688-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4688-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5000-7-0x0000000009E80000-0x0000000009EE0000-memory.dmp

Download

memory/5000-78-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5000-0-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5000-9-0x0000000009E80000-0x0000000009EE0000-memory.dmp

Download

memory/5000-1-0x0000000009E80000-0x0000000009EE0000-memory.dmp

Download

memory/5000-310-0x0000000009E80000-0x0000000009EE0000-memory.dmp

Download

memory/5000-309-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5020-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-96-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5020-90-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5020-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-382-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5068-116-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5068-114-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5068-369-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5068-122-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/6112-103-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6112-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6112-365-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6112-109-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6112-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download