61da3b7489ba289442e96fd679ed8c35f35225696e785fa6d72a41f88c10bd7e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 15.1MB
Sample261102-mjgryabs4m
SHA256 61da3b7489ba289442e96fd679ed8c35f35225696e785fa6d72a41f88c10bd7e
MD5 ba45dfc741a513771f64e4a20a384620
SHA1 32ef3e040a30f8de7bfe71c756328c91563d3b25
SHA512 d78e30042e4b1ccbfa3d9c19c538f848950524706c4c163642f5006ff9f20b8c55d1a124274f1cc461f7c42ba322fda088a9c45bd9f225bed064702eeed32e9c
SSDEEP 98304:5C+jVE0MGelOtE6pyjyQq3AE3fsCSzi/Z6VZZuyPc3oBb31T5tCOXcchwqmRGCXC:k5OtN+8STZHPmoBz1NtCOsQw93duDu
TLSH
T1B1F66C26769A58EDC06AC474834A4B639A7274CB0B35BAEF41D486753F6ABF01F3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6036	elevation_service.exe
2892	elevation_service.exe
4356	maintenanceservice.exe
5620	OSE.EXE
3284	PerceptionSimulationService.exe
6068	perfhost.exe
940	ReFsDedupSvc.exe
5484	SensorDataService.exe
4872	ssh-agent.exe
2568	AgentService.exe
4656	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\36713590612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e412b41cb56add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001da1a61fb56add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000178ab55db56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2568	AgentService.exe
Token: 33	4656	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	940	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4852	2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	6036	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3924	4656	SearchIndexer.exe	101
PID 4656 wrote to memory of 4580	4656	SearchIndexer.exe	102
PID 4656 wrote to memory of 2116	4656	SearchIndexer.exe	103
PID 4656 wrote to memory of 4352	4656	SearchIndexer.exe	104
PID 4656 wrote to memory of 5136	4656	SearchIndexer.exe	106
PID 4656 wrote to memory of 4520	4656	SearchIndexer.exe	107
PID 4656 wrote to memory of 4816	4656	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_ba45dfc741a513771f64e4a20a384620_akira_cobalt-strike_funksec_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2892

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5620

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5484

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4872

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2592 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2592 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d180ae1924de32a21d54a2fbb214aba05943c1dc8cc115c146ea2f82c0cdc3a6
MD5 adb8c561781746a3e05ff42381addf7c
SHA1 d6c28988d100ef2c01b51eca74fe0ed26280a3e3
SHA512 442970098d26c1604ff6c589061d70ddd141612d9d828d353c197476c378c797864c2e3182acd98df7c839583ba4ec28835235e21db7607a3c97007ebc825f1f
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnSjzQgilV995S1V0:l3q6HjB9jI
TLSH
T1DDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2bd3703e4bcfc4029b229886da1ee0cd42bd767d94329536a6f43c37d1e42b49
MD5 1de3fedf38979f26de9ecee862d7cb2b
SHA1 fd9cf25b16748f5c3efbbe156a327c8426e73592
SHA512 db6dc567688b00531dd5a5907c7771c41ac04cfa27848106819e5d1c86da99fb02194797e33193604b5d429d41612616417f33da676ff2a3c1bcdf08c564f7aa
SSDEEP 12288:V1XLsswWkxy2lRq2czAk8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:7XYfDtczABjzABgioiNV99L5S1fd0b
TLSH
T14C65F12963E448F9ED67817CC8A1C506E6737C914760FBDB03E489261F236D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bb8e246c97659d13ada49d0f36bfe23646a9fbfb51e9b35411d10a6407c6b817
MD5 607800e5ce58f1dccc84006e8990754a
SHA1 c40cf101e73c98263d946dc6c516b5f45fa0403e
SHA512 101df72f9d9bdfa5b02e4b227006ffb6bff8fa08ae2b1472160f4ac41e8bedfdac5e7bccd16e595fb50cf04911426028d1f2fe62194c9920289883ad70d5e090
SSDEEP 24576:i0Le5ji0hmxirMajzABgioiNV99L5S1fd0b:iPji0AczjzQgilV995S1V0
TLSH
T187859E56F6748735D073C0B9C5D2A68EE972308257308ACB4286C77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e9a060b9f6c79611f916952aede0c2bbbfc017769450144caabe7b7078f0881f
MD5 49d31db64f4e17316f936320e67dfa37
SHA1 aeb0d0de10d773fcd8504cb9966ff550b1a2189d
SHA512 f482c875835ef28bec2c978e155156ed147837a3004496a234456d00ffb4c0682a2c895b02194a656b7f875301a3847def881af3bcde5734849b262f66ab831f
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyuYjzABgioiNV99L5S1fd0b:B/ezSC6vUzPvxHjy3jzQgilV995S1V0
TLSH
T1D0756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6dcf1bd83ec6c387e67a4bde487efcea04e126ac9717383b17ab417c24c4e0da
MD5 a80438cfc2c2dc89c19bfa1730aafe76
SHA1 4aade4d1b652bf9bc0dc0e88c6f80424631bf52e
SHA512 c4f07c5082f761785159a23e52871974993653f7242b89b4a5deea2ab9213a243104ab774bdbdd0e0688ca5b291f9e51a693a6fac8c7dc228a9be62729baff9b
SSDEEP 24576:LVbqPb88hv/l+6NjzABgioiNV99L5S1fd0b:LVO88hXl++jzQgilV995S1V0
TLSH
T12F559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB4246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b37a489ca7c3906ca8828eb2b35d8dc0d87c9e765b2176b689bff4c1b228ae4d
MD5 567932e6264dacefa751769b075d49b4
SHA1 0393665c6cc12d1294f5d4ed536fa315f8ac09f2
SHA512 d39c90f1ce1174b86a2b6e29acd5cf6785f0aafbf405b71c41816ed24f2572ec6aa1cf01015e55972455fa444ea9b0d07715b08a444d64d62d4efab03f272101
SSDEEP 12288:ZRl8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:ZR2jzABgioiNV99L5S1fd0b
TLSH
T1364523C79368C8CEF3750879E4A8F90FB0B36CA086407E9FC3E1186A5DB9DA1C515697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9a205328113baaefc805357c2ccfe8a215edd38688c80722453ed8eea901b134
MD5 6f06bb38b3570add3acb093451ae377a
SHA1 e573a18ab743099204291a336784cc6904cf1203
SHA512 33b360c202e2e90488df3717f43b1506f2b73cbf96d1064c78410141e23e6c5ed6234601285a941e12be15143c9b15791577b78bfc05cc21718466fe3cb245fa
SSDEEP 12288:2eBNUbTVO86UI8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:2JIU1jzABgioiNV99L5S1fd0b
TLSH
T18165C07BEE28ECD2C27A4DB85A91C600E7B278704F51A3CBD175820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c0c97d673d72d5a257e9258fbdf5ef7aae500b1f8b8442a06922b609ab4329f2
MD5 a7e10db6a7821cd3dbfdacf1e21485c5
SHA1 859a64ee5289728aa1f2d5f78e1af8291a18dcfa
SHA512 9f04f412a4adf44d8cbcd7dd667a45ed31da482f796378bb3a23324f3d3d1fa469eae0300d1de8488ccec151031329c24e7b2f8a6a067a16b1f0f22a108f9f58
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:aQvGAdlCEL8c/yRNw5CojI
TLSH
T114266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5b9faedda5bfc04b1ed4dcebadf4f84e008465a738f61660ef2384a140a47ef6
MD5 3c7e9177dbfb82ba4382e0de193a81ce
SHA1 1834d99c4c698582fb94c1574e1cb1ed8173fdeb
SHA512 72ed49a0e5ccae16679eaa615da4d39a3ca1c49d1e998912e56536e6fe4072ab387a71a9d927394ce0352ea3194956e21e475335520487f7afe78af2ebb63945
SSDEEP 12288:XAwSfxL/2Dc34DLLmt0LDQewsAjq8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNf2:wdewsAjDjzABgioiNV99L5S1fd0b
TLSH
T1D275F031FA74D036D3BB0CB61B35D70A647DB9204B612AC3E3E84E9E59706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c0785100ad58f5a716e4bb1889246a58c6be1f08ede711b98327886dc2467be9
MD5 809a8b8dbb5467d694c618498dbe4186
SHA1 84bbeabe9d9093c1909b45d1a8133ed1944e7f7d
SHA512 9ab52e54aa042ffbdd91d8817f70ce4f82b54eaf7e43ca2fc5f6b96db7414bd93fe386a4d9e05ccff6fc83064a5a50eff0a0214eeeaacbfd5e473ec16fe8d574
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHb:/UEtQevvqc2W1cpV2EI32
TLSH
T1E4474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bbfb83bdce55ade8c69ef25bc343443dbc5e22cd288a28fd1f4be2367174694d
MD5 d21e420c8f1e3215c7ab04a2e1ec4d03
SHA1 444a616ac1fedd4f7b79089e12dbf78887ff2097
SHA512 381ff4cc80e0ebe301817aa1b8bedd5d7da28a784269ebe5cbd2c10190d15d0a1618d205324bcc07cab7cbed2c0e45bbc3195519113b5618ee12fdba323c94bd
SSDEEP 49152:eCbRquA/m2yL5zQfFiV+XenmE3/zjjzQgilV995S1V0:ToqtVjnmsjI
TLSH
T169D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b2e3a1e32d64912cf3c74563b59a11d2d69beec6f45230b0036df30df724b1d0
MD5 b97e84ed4e2f9881eb84c07a34129430
SHA1 e3a4383e7403cffcc78020df90d5cc9b77556c02
SHA512 31bd663204c5c82c4c822f27d032cad7e6e2dcc9bb2ecf8706fab08dce7370c08577e391418bb5ca301a36f900f87c65cd5a16fda30d29755e4a0a8586b1c5c0
SSDEEP 24576:qAhGLJIFoiwtA5l7S53MjzABgioiNV99L5S1fd0b:qAMyFoiq58jzQgilV995S1V0
TLSH
T16A359D81E7F945D4F5B3AAB899B69171EA76BCA65E30D20F1260C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2ba4f101c4dc17d370ed86ed1ad02921f2fcb2faabdd0c2c51d134890e2742a1
MD5 958374806cf0c0ef1049602dc664716d
SHA1 37354e1999ae8150738e5531b622aa289ec977a5
SHA512 0bbc5fadc99689cc2856aacc51577326987419e82bacaf78b59547b0b158d9ac75656fb6b2501a73155c67a33f3ab57938238ab2345fd368ad2e85d46e457e51
SSDEEP 12288:zmw5HEjsChNVBFgl0WDm+CT8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAP:SwuoOWXjzABgioiNV99L5S1fd0b
TLSH
T1A665F14672A84CF9E6678138C597D536F7F3BC112A20EB1F43A0C65B5F37261AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8c4a8e35b9b55681a37d57f597af30b2cf3185e45078e56c1c6726ab3fddfc88
MD5 926997f6676ca0033fc53621dcdb38a5
SHA1 ff8a25a921570fb36d949a7a8f7e57ad3a0b6f3d
SHA512 504cbf0b8a32e553cfeed5f5ec59da4ec4c0255477e8e6ff59079f83335ea9032fc39d6ed1d1c2a7fe2e84a9a5f23ffbab061cde9db0114035892bca9d95237e
SSDEEP 12288:0BZ1Iya8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:SZuijzABgioiNV99L5S1fd0b
TLSH
T10455128A23A890FAF263457CD8E4950AE3B37CA2573167CF4261056A1F77ED18D39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 875a0823a2601b2063faed8c2e0aa553d91e0672da47daf2e4757c408993f6eb
MD5 3d11ae55734695761017cdbfbe60b911
SHA1 0864b62d6958c8692adb4da00b30a21d8ac4c0db
SHA512 bae1ffc9bf9b2b49b3d5ffe1d4c0e454f118c994376c053d4be2e006655dbe79da9c19f46a1ed6af1fac2a0682dd6f23ab882e161bd7a5845bef1b0d29c8cb58
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:XQRQyi36YOcPQLvw2gAf+PN3pjI
TLSH
T1B2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d0c82165f2eccb72c84e74f4397b58190b9c3f1fb0b88be6c2cc9ab1e82aed93
MD5 a43caa85555880d24d11272bb3a9f500
SHA1 6dc5692faccab85af6f3eebe4658028388a958d8
SHA512 05db97d403cd13d59ad3dbf0bf969f0a70133098b212c66e5c6568763fe5fd04cf07c30e257e111787f093331f567a4a9569f71e86c3585ce131c79eea3e0cfe
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:AQRQyi36YOcPQLvw2gAf+PN3pjI
TLSH
T10E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a25f19d8aaf38846fd5349c829d512c184316f375566347c2950369db0310796
MD5 b94f427fcf9a780b61f9dd829fd77985
SHA1 6906812cb3be0b3efca11f54abbc74e76fcf22f6
SHA512 7f8ff753442152d2c3900260ba8a54347de45ebef522c27c253539786c9d94ec4ee4ea13ff2ce313451f4eb3c8a7383841354c13dce6482ab59fc4b92aff7884
SSDEEP 49152:H68Qg55nhheWu7PNU3/zjzQgilV995S1V0:xthWRc/zjI
TLSH
T1E7B55933B2F60099D44DE1769F4A972196E27C718FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4a10a9ebcee524c805ec9aaea0738bff0b37309fce910e4da525fecaab405107
MD5 5ce1631bfb3361ed6cf05b9752305a4b
SHA1 f160bcbaa27aeaeb7fea0f415fb12b4238c498ba
SHA512 7785b93d0da1e5395e7b6ff9c6958c956f771ba2c1401494e0c640c3f46feac9ac08464677471d357c8d4dbdc1be400acec50bf9243658ee51fd74a3a4f6d7dd
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Oy5112gYy5azzVvL69nLKnhZ2jI
TLSH
T1BF167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 80a914e1e79af39f5bd7ea3d0c7cebf56466e93896b90fa73d7ade9b65b648f9
MD5 4fa9ce08c3084e1f95c9f53813c0a7c4
SHA1 881dc8f05139405e948f115b0fbabf342b500151
SHA512 b6fbe0d219bc5550515d45f5a2408e96e937e56b8de8800394f0e72f3acbf4d98dd60af574ed74393ad0a19ed6c3133697e884cc8c27ab150fac27907e05986d
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxjzQgilV995S1V0:Yu6JmVxd2dxjI
TLSH
T19DD59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5a071958a19f2de5ae2dc3e2fcf8dca8fe0546ae0e4686eb07eb32ada95a5723
MD5 d155dda4aaee3e9e72d9dbf0f199cc37
SHA1 b3605999ff620486cb26b562ee5074d0e84c45ce
SHA512 e5ef77956a485624de53462d00f2072d628baee4728ef019674fc412681806f02ba8d42de77f88831f75d99a26c42b6bcb6a391ace69965eeacc24c73b8f935f
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xVjzQgilV995S1V0:ZmifPbRsjI
TLSH
T131B5AD13F29900E8D06ED17887569232EA72BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 39c09bffae1d100f9fbbf958d0b5ac9e20822c75c8438b257e6d56e7eb88f1c9
MD5 e9ef8cacfa9a43013eeaec6c1ffcd122
SHA1 1824c52ededc14c98efcffc5a5e0d1c2f3bc5c07
SHA512 6b48d8cf6a173b625ec5af1c30f4cd57dfd5301f2ea7a6ddee3ac1bc7aa432acbe7b66a97f67f0d43f6263d51fb5a5aed69d6ef42a79b4bc5e6d3efdaa40656b
SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHqijzQgilV995S1V0:J5dKTi61ijI
TLSH
T1E2C5BE03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 681ed04ed89172ee3b31f0a51c84e493e5ab66e6b88c92b9efdd30aa1586139a
MD5 fd9677d395dbc7bd4ed586bbe991f9c4
SHA1 95e86b67c97211d8b28800f6bb311bdac0784d45
SHA512 5217401771080f8a321687b97abf0e76ea620a42570900b7daa7042f67a95caa8bbc4f54b5852e2ec66a2b3ce9890343a57994b1c13c44b06d77b37ad20b69b6
SSDEEP 49152:xhtSn8EApI0figngiDn0AP5wBjzQgilV995S1V0:gX2iyphAjI
TLSH
T11795BE13F2D940E8D06ED178C7468632E972BC150B35BAEF0A90B6561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b64a90b11823c191b8dc07f4c8b02c8724a415e95c580192843412b50f72e827
MD5 ebca6041aeb4ab68bfa86ea346046dc8
SHA1 0a11efdf76a261da630011ef8c24000cb5edd879
SHA512 97721f23fc56ab90bf7cbf56394ed957f7af8af441070460e5d8b14f9778e11c7af95e5edaf20ca864772eff1b8a424b16f1055e82a0d9f81b4e4a40243b820c
SSDEEP 12288:Ed8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:E+jzABgioiNV99L5S1fd0b
TLSH
T1EE4523CB9269C8CFF32048B9D494B54FF0B36CE596403A9FC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d28f61691c353aaede30907ef3f55044b8a005a0a3a70881a0883b23e1a68793
MD5 8727eb8b59721d8188ee2583efd0ab46
SHA1 80f613d6c5fb17a77dda24e8126eced847d6b456
SHA512 38893e7239659f6241e4386871d0152ac495252c9563044cbd4b98dc56208e9bd13d1b0afdad5ae9c4594133efee7eae34e127ec660526dcc337eebdc80cf58c
SSDEEP 12288:U28jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:UPjzABgioiNV99L5S1fd0b
TLSH
T1804523C79269C8CFF32048B9D454F54FF0B36DB696003A9FC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 32c1b64c7201b056ce30b7e0d13f5e648075db27a05e44f1220709fc7064b367
MD5 d194372ff16a42bb33ea5d18475832dd
SHA1 fa6c8802dff3586a3231ec7c684fcf1739f4b81e
SHA512 64229ccb7ae61062821a4e29ac6adc2b4f69bd4084032b0725bb331d88fca5960b6c919c7ba1a5b6df2ceacce2d59dd1dd35a3cf377b90a58ce98e41ced1fbac
SSDEEP 12288:LA8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:L9jzABgioiNV99L5S1fd0b
TLSH
T1D74523C79269C8CFF32048B9D454B54FF0F36CE696403AAFC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 58be2290f9ebdd7622be9d12a5a08b710a8c4cd5358d7ab151b676903dffc4d1
MD5 9b7f4f418f7e4cdd46702cf24636589d
SHA1 713775eaf0cee104662bde379c7fda5d8cdce08a
SHA512 1c59705a8af0c7ad033685bb167f6199852012b08642472073781b5a7c57523b38d1a842cb28d11a744edd238d36d2f12ee37e7f6e629e6d7562baf32b3eb846
SSDEEP 12288:4V38jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:NjzABgioiNV99L5S1fd0b
TLSH
T1FF45238763A9C4CAF2718578C460A50BF0F37CE597217BDFC791085A0EB6EE08924B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5cdbb55fc152979b726fc4947278c953c5a200748507a6901f179083a907c902
MD5 3b8b7d59250d5adf37946f8e8bc81ace
SHA1 2b0349eb367f3916a5ebc1ea24dd17e6bac764b7
SHA512 ffd2dffab48c9aa43200010509e8fdcdf14b44d8a6438d0b283c01ecd7fd265ca8a229f94415156ad827dd5914f0adbc5eb505880fae9b5699355b93906df565
SSDEEP 12288:rf8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:rkjzABgioiNV99L5S1fd0b
TLSH
T1C74523C79269C8CFF32048B9D454B54FF0B36CE696403ADFC3D604265EBADE08915A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 69dc1becea5e3debe20f7c5bd23921735a703bbfb63c1305085a68b987778efc
MD5 767c59fcb17787c2239eb513eb011454
SHA1 289b719b11443feb127c4160308e664454f44a13
SHA512 8cb0d49e960ff62b0fd689e16226d50257c9600f470893e1949a3d90bcbf2a04e8dc094db06be3bd14a8175fd31ad687832007e9051a1716e2ea3d299eef8ea0
SSDEEP 12288:mi8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:mrjzABgioiNV99L5S1fd0b
TLSH
T1014523C79269C8CFF33048B9D454B54FF0B36DE696003A9FC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c8e96a39c1aaacda202a9e4bb11da6c290fea1058c08b6ef6c2c023631f77517
MD5 4899a316f36cf26eddf1872552c077b3
SHA1 914a7964a99688793596c157e86ec4956f0d3122
SHA512 0d028526b20a3ebe88c738894719b2609f694eeca8f4b1b5a002a922486544536947077afc627c956590cb05b499fd89df4021d99d64b5aceb72c97fdf41df49
SSDEEP 12288:r+8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:rHjzABgioiNV99L5S1fd0b
TLSH
T1AB4523CB9269C88FF33048B9D454F50FF0B36DE596403A9FC3E604265EFADA08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 abbb31ea841e638ba3fa9921b602bb8f6fc71fc060c4569696fb3563270b6563
MD5 41e618c19b60537918dc7920cdae9cd0
SHA1 c0e41f402ace14b18e2cd13a73ec651309106eaf
SHA512 d3ee40f9d2024fe7b40b02cc74f9d10fb357888ab526a64b6d28079a074bcd885cd8a6d3620130497a7489e3dc896b387d26cae0392519a9d71bfaaf4418d2ec
SSDEEP 12288:HiZwb6zzFEoS2cPvyW8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:CZMSzFVSOvjzABgioiNV99L5S1fd0b
TLSH
T107650195B3904CF8ED63813EC855990AE1B27C6A0760DA5F43E436275F737A10C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3ebda824420a3ef7b48edda7f35f37157430c13b72503e1f6d0e97ff3b47565f
MD5 48df565ee0d9cef976059fdc606858c9
SHA1 ba5d78b861dce7e8d13f8bbdb0db42f6df4a413c
SHA512 9aaddd38590676c58ca3b4b62cecee9e1877b5dfd8ca36872b423fdc5ffbb0418b7b530869717b4d9f217b19b345ddffa3a66ba05bba90283bc93cd3428a7f0f
SSDEEP 12288:hB8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:hyjzABgioiNV99L5S1fd0b
TLSH
T11B4523CB9269C8CFF32008B9D454B54FF0B36CE696403ADFC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2c2df0cda2e4d9c72ff63c71901f70467facb0ad0fb64b40d2c0d640a237e52d
MD5 3a9e6122a8310b6d7a2c86bfe6719856
SHA1 8d8edc25ae4709e808b7d90e7d55f35a000ffa5d
SHA512 d18ee01aae9145b81dc3ca7c2741ac719e20cd9bc07e5710dc4709131051687a5fe996c6322faa650ea0dedf7f7b0bb419b428f17cee727dbbb060203e82be4d
SSDEEP 12288:yV8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:yGjzABgioiNV99L5S1fd0b
TLSH
T1844523CB9269C8CFF33044B9D454B54FF0B36DE696003ADFC3E608265EBADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 8905cda753a585cef8adadbc21476b8c49905b3573f9cec1f5c16115c6ed6a52
MD5 c70c3ebb0ac65a33fedf2af5e0346bf9
SHA1 ee2b6f972e3212de329d5468691cee65feb3175e
SHA512 c8a2532308c357e9d5cb15f9c321f4049c7e721a5d36802eca310f6fa68ed1bea973a35f3b021b1447f979cdf47faf8a572aa1235e40d760eabc3bb983abef99
SSDEEP 12288:9yPz5L8a8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:0zyTjzABgioiNV99L5S1fd0b
TLSH
T18855024773A560FDE1368139C8615906F3B27C724720AFAF43A406761F77AE09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3aa96c5b093005b25470a678e46bb5d132e3d3b106c5093fcf8a59357d040252
MD5 eeaed22b1918a7719d6e3e33f558f711
SHA1 7f4073bcefce3ce63ca62113b46d5626e2a9458e
SHA512 a59429e084b711880a213495360ab29643ba06cc06bfa8b2f48f517c58228675940d1ab646441db5871a50b1bd84bfaedca1fd521ca09c991ec7874bd957faa2
SSDEEP 12288:0B8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:0yjzABgioiNV99L5S1fd0b
TLSH
T1DA4523CB9269C8CFF32008B9D454B54FF0B36DE696403ADFC3D608265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ce6033330be7866f58b592c05954f35f9e883353b819bcebf802defb0847024b
MD5 f1d96e2fa056c9cc2a7a79bd79401b59
SHA1 442fa99871829ae6e273be1d4bfcaf7d2bf522ea
SHA512 343d28761b55a2021747a1aa5f500168ac1c1ac7a328166031e35bf887b80ab5b7ad8713fd9ac3a6d77c570eed9cceab167fea43f7cae003d2664b75f7ff969e
SSDEEP 12288:HB8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:HyjzABgioiNV99L5S1fd0b
TLSH
T1804523CB9269C8CFF33008B9D454B54FF0B36CE596403ADFC3E608265EBADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 2f221393188e78a0b4cececd9eb7c9e07839cf230ecf9ea5cbf2e547d9abbc92
MD5 c74465c3f6c8f0d17755562f32f0a8f9
SHA1 31242e1ee61371017a5fd0bfb880ab386a172bbe
SHA512 f1f20d2b8dc8a72b92aace012f738f4b13230d8597a930f9efd12b64b16fc82fba8dd4004053fa7c21e8ceeb261b1d686d3cfa3b5693ed938a48c0f40b406102
SSDEEP 12288:tyPz5L8a8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:EzyTjzABgioiNV99L5S1fd0b
TLSH
T1B655024773A560FDE1368139C8615A06F3B27C724720AFAF43A406761F77AE09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 724f989233e2230af5ba703cc67cbda2f55d628a494ec36244a6394ffedbc540
MD5 d6102efe62d6346c0278ffc0bff8fb40
SHA1 5205a911efa8eceff9b0f71aed861732ea8a8215
SHA512 fc67f268439cc6da1a63482db293f52201a8aad4dc3ace46704b664484a278c38a341666274ef81b346f5ee8a1041209749540bbe77f1c357ff55c227ef7036f
SSDEEP 24576:tTHaLl3z0zDtjzABgioiNV99L5S1fd0b:tT6LljYjzQgilV995S1V0
TLSH
T10E650195B3904CF8ED67813EC855990AE1F27C6A0760DA5F43E4362B5F337A04C2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 64c94068a0e03bb51c3c0a7f77d3fbabef30996e75a47ce36b162be5a20e1014
MD5 173b8381b478305c3fd6cb524b44d6ab
SHA1 0597ca59bce153cea10802f2b397c6ffbb8a4e54
SHA512 fc340226e3f021a79b5f0f92e298ee6f156b89d5016941698c2a78c6c5c9537de7da84fe9847337593fe6c71fdbbb770dba077ccd6f70e7b4f98a56d6ef841e8
SSDEEP 24576:137d9CHKy7GZJjzABgioiNV99L5S1fd0b:V7d9CHKya7jzQgilV995S1V0
TLSH
T1A875CF90F3E414E8F1B78A35C9759512D9B67C9A1B31DE8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 26393f1d9206287b60668c9960f2b2ad0884fbf9ef857e6e778158b1f9be4b32
MD5 45992e5e0ffc4c771b7d3552d0115466
SHA1 65ef5d8c3f9e2c9e782f865149a912e467334b2a
SHA512 1a5e15c19ee463d910b527a837fd634d60f9e21a03f41cf309c85e2cf08931c8a7f512ca070e1dd99d158f14922756670b0e86e2380be18f02139c30f358cb58
SSDEEP 12288:ig8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:idjzABgioiNV99L5S1fd0b
TLSH
T1DE4523CB9269C8CFF32048B9D454B54FF0B36CF696403AAFC3D604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6230eb456c1c5fcefbe8595975d482d5ca915c982500ab85e6d6884d16f69446
MD5 bfcb00e736d17e5e75ea05e160d0f2c7
SHA1 75ef2daf878d3ab5859a495f73f1cde521580461
SHA512 5786e424ec407b95cb693bf5016a72f1caa2a62ef903b0bef1a39b2f4dcb55150ea13e0ae7980f6ef423b1fd28f2101a8657209c094ba78b1d9570f527933c87
SSDEEP 12288:Z68jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:ZzjzABgioiNV99L5S1fd0b
TLSH
T1714523CB9268C8CFF33444B9D494E50FF0B36DA596003B9FC3E608265EFADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ed107fa1d280298421e646fd48945fe9de89bea30870facc62cee16744c2591a
MD5 23cd4dd7f80c475c844c2b7c9564f237
SHA1 c3a02a47f173a877c79e62b3a8e0e622a038b3b3
SHA512 b87de3fb0556e6b61fd0abd3692089c82b093fee5ed881c8b91e1203188d2a708a43337e4884ce45c8d5c9e708867f320a42a1a965c7a2921a5c0b2351b000c9
SSDEEP 12288:Xb8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:XQjzABgioiNV99L5S1fd0b
TLSH
T17E4523C79269C8CFF33048B9D454B54FF0B36CE696403A9FC3E608265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e77ef6e653c333a876b4ba1743e2948c1bc1f89241a42049ccdfeafc2ab89a61
MD5 19cfed2a249bdc3e692650266d8fd0b8
SHA1 3df47f0da09c02046335fe1da024412bda36b2b0
SHA512 c1d0079518fa899255e6618a03c475a1ffd2582ceb47976ccd0e2df88c038880139cc8b1d4e73405a12c90aa88370c75d3d4132aa0758a22c2ba42e0ba80ddea
SSDEEP 12288:hB8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:hyjzABgioiNV99L5S1fd0b
TLSH
T10A4523CB9269C8CFF32048B9D454B54FF0B36CE696403ADFC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 15cceb20f9b07342b8b4eaaa5a143571a2fdc36692228a7a81ca64a5f8751582
MD5 8aa6dee1cbeb840460a184e08a6642ae
SHA1 db0fce192bf114eaec253f06b08486354251e563
SHA512 e575eae6580f903a9b1671f24d22bd6fa9bbc1bf4fca1a0aebfdbd59a1027e93df2548e091ddb4e66e59f3f175283ddc5889e5f316303e9a47439b3ca9f2f726
SSDEEP 12288:Pg8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:PdjzABgioiNV99L5S1fd0b
TLSH
T17F4523C79269C8CFF32048B9D454B54FF0B36CE696403AAFC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6fef524b30018c5ba6f8ffad9e14f65dca5b801cc0c1b689834ba1d8844d3a83
MD5 020a2cc7ed07a351ad3c82ef698fcefb
SHA1 5adc0f2ddaeae62723a368fe231f8aae1ad998fc
SHA512 29b9c0d0e74bf45bf2cc39f17c5f1b56806d1401fda09b60dacb0e1b4eeeec6bc2cb2681cd9bc18f9d08d24ff794f391b46415bbf818b39e5d70b1b569ce6291
SSDEEP 12288:9p8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:9KjzABgioiNV99L5S1fd0b
TLSH
T17F4523CB9268C8CFF32048B9D494B50FF0B36DE596403B9FC3E604265EBADE1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7a07d3eb5e18aedb8d02dedff8eab13335f502159999b2b751253d8802a09216
MD5 80d47f47712b44713e8772d8c9a32037
SHA1 ec9caa013a202232fb97aa227366935550f945b9
SHA512 0be4dff2279b975403f95ec19e75eb9a8e56d27a27927daaa3389ecf37abd664ebcb7414cf65b8492fe5b9ae28be0c3a72128bce00c06e7e57ad74d2f477943c
SSDEEP 12288:Ef8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:EkjzABgioiNV99L5S1fd0b
TLSH
T1544523C79269C8CFF32048B9D454B54FF0B36CF696403AAFC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5269e1eafcdb6654a321141cfc391e3ed97bda79718405267ee000ff26f6d0d2
MD5 f91c7142acd2e8291c92d591f8cf7fce
SHA1 452ad6d57e4bd10ccfae7f9f3f19b1d9ce3a5027
SHA512 43a72d651737599b297b30579f8120c9bf97fc530f0b43e6d9ca1d3979d7ffae615c5b3bd77d39e58d3cb00e279efa0f77f50facbcc37684f05ba78780315712
SSDEEP 24576:kfwvok9RX6wkyAIWjzABgioiNV99L5S1fd0b:EMnYIWjzQgilV995S1V0
TLSH
T1CF85DF29EBDC44E5E177913C89B3460AF2B278691B31D6CF029A536E0E37ED09D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 81b8b3fd7024b50f83fcbbb57d5533184c7a6975dabf8d8e79394aa7fae06fcf
MD5 107c7284711e00c1f60656521c0ac855
SHA1 9e7d6298031a0de58f03cbd791bded38918aa923
SHA512 a1f148807b18675dbc7832fc443eae71e0a6b2391a3073a4bb6fb064fc535f5d1bfc7e5231ffc513ece7f1e8afd197d3d43b2c81a21fd688b1869a0f9e2634b1
SSDEEP 49152:FYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hjzQgilV995S4:FySzPJjI
TLSH
T106067C97A16841D5C1B9C1B98B0BCC1BFAB134090335ABEB03E546935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f8f88253e40e9b83f37e9f86bf4dc0c5a2f97deafd82a88db6aedfaebc05a914
MD5 25551c0d083dc7708a0a5677b32a9a5c
SHA1 f3bd86327663a3c98d42e0dcf5e42fe51f5203c7
SHA512 73ceceb367b1ae23d8d4312325d3126e9fa9894cc9ffd220d32d272611937f64f6b59fe37d3070c49d3a80fa0fc05739c032d8f3bc8295faf1c1aade0365a928
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY/jzABgioiNV99L5S1fd0b:D47JUQj1irIhCnDHUPfF/xjzQgilV99B
TLSH
T1D465AE1EA3EC01D5E1BA927885158A1AEA71782D1F31DACF12B0437D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c9b2c43c0593e4a8352b6ffa9914faffd5a25c7d2d14c41bb15c2523e83db2b1
MD5 6885e453e691a90bc47a118f8dcfc23b
SHA1 5a9f16d2ca89d0389a84118183e3a93b519b7a1e
SHA512 72940f2c68762c6063f28af34a6177dc381e669ea673aa2dc3c86d9a9c1e69eaa6f7f970abfd04f337ead7d3ee5c9a439aeae916f458c261141613e146764707
SSDEEP 12288:TNsfR8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:QijzABgioiNV99L5S1fd0b
TLSH
T1E755F04AD29881D9E16E5179C7559A06F3733C6583E0A7CB83D0F43E0F76A908DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6966bcadebe70f4c3b04229138f8ed3842201ac6283be199caf21ef3046ed49b
MD5 4c63a84543112ae5bea5a4d89e837a35
SHA1 571f064ef2f0e78ea304501f7d6efb899eab8083
SHA512 941dbdfe962106e8ca7b32a2007394041a4d0e1afc318933d603c1b48290e08420b5ea4d4ee00e9e335405d4dffc3099e1915b059f1c054027b1cb48a6a8f9e0
SSDEEP 12288:ZyUhj5zU3f2Q2U3vH7v44dyjCrKoNSyyrQ9SU7N:Z5FUPH2U/H7LYCrZN1SCVN
TLSH
T1EA354910766ADB4FC66940325E73D2CCA7707D02EE45AB0772C9873FD476658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1102a9680f8cba4a2d53984981ea35626e0b978138808927bec82de46ad7149b
MD5 f95682c5a1fd255617cae7c27038e8c4
SHA1 5e2e94a2af212f4c035c5498c7f479822cb09e02
SHA512 50eb6daec1ffe77c593d2328eba71ca522eafacd6d83f0279a87d3531f0f01d8d5946d8cc73644c4ea0933721bc699c64f1eda6826c181044e1cf01e9b232022
SSDEEP 6144:dh7Mhx9FnWR40QdzQSCLvEFC0IQBIpu4PMsyep2K9mSxdLjKYnWtMxWnWtMxat2C:dhAhLFZlzt/eHLjKD4flfTx
TLSH
T16355FA405537A7CFD1B76032072A9B8CB774EC07B7496F26B389457AD86AB01B4B93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1736c13b71d607ddaead6e5f375e13ce53488e37ad7933fb2bdc3a77ee4e14b2
MD5 efa70eab2e7565f6716b308f77ba4b1b
SHA1 4650331104cd7008ddd85aa6efb71d701638b979
SHA512 c6658c63ece2f1cdfe43726a12dfbec86bc36e222a3b5a5dd32e89dd125f98831f58f0a3d067d875b1c00efdba7519768e83f676426b6008f5f579f8cd0a0d0b
SSDEEP 12288:VM758jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:u6jzABgioiNV99L5S1fd0b
TLSH
T1D245228793ACC88EF23549B8D458E51AB0B77DB48B007ADBC391046A5DBADD0CD35B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a454091848dd65779ecd00c148f73bea357d6dfdd86c0deca80dfbc4a1eb0c02
MD5 aa8b2963e2779b08ef3c7a0ed8243451
SHA1 c45b84361120c0cd69d2ff91e73de0e4976e531b
SHA512 2a9912db38fc73d031323c3f7e785c9ffb8fe8299ae900aed0111b3bc2f3024d4b0a1588662410bfce8054e41a442cc3076721922c347e7fb5ccb9afebb75ddb
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYYjzABgioiNV99L5S1fd0b:Hgb4mBIBhGF/jzQgilV995S1V0
TLSH
T174659E1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d66acf0a0ffbd99e4a58b345f8dda00e61b9d584c4df31ce2a9192ce94a551bc
MD5 cda830f2d17e05fc040fa92f3b10c6e2
SHA1 66822deb03afb050a68abe1c5e673565383c45c1
SHA512 55591d11ca3ce450fa903ed0b2e30eb36f8125065d3038f93ed7a746076511f4f0a6a0ec08a0e5a75d14640c1048d033ebe5b29954af56aaa39563ca3d34ab60
SSDEEP 24576:qG88u8FpJqH1bzria7/mvjzABgioiNV99L5S1fd0b:R7ZFPqVea7/wjzQgilV995S1V0
TLSH
T1E785F16567E001F5E477D138C9824667F6B2B8250360FFDF47A88A561F23AE14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 98f8a1e1639696ffe41007a888aec041374321214d60d7fa79e19a1a201da03b
MD5 568f340ee61ba927526d378f75c9eb83
SHA1 7d917064492c957bac3a30a427b15044af0d941a
SHA512 28622f39cc0469fbd80367fdf250ff11cdb02379bc7ac05195952c92d7e6d650fa92f062f228cce90ddab764f808cb3a29507f45edbb1b965f00361b4ead0234
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrjzQgilV995S1V0:/G05lO43bOjI
TLSH
T19AD5CF6E62EC01F9D1BBD17CD9C6460BEBB23825032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 11875f2bfe5fc13522024983e26c1e42650f552fedb47ca7cc77b4408c7cd5a0
MD5 9a71160477c957c3f782fe5d1c7d6280
SHA1 d0f021e0a41ef925a9cb57e048bbc48b326551ea
SHA512 5a119749e1c5b345b11e843002c0e1dfaad0fe6a49434c7981a23e85523688ce58127bb16d4571fb4a6dcf422c47764c18647bf0bb0aec35e1af530c87008cc9
SSDEEP 24576:Afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhjzABgioiNV99L5S1fd0b:4a5POZ3+Jt2pasx2+mzjzQgilV995S1i
TLSH
T1BB65AE5EA6FC01D5E179D17DC583861AF5B2346153319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e2308d98b68d7b88b9e29f98cd152a2974e677b3a33a65f0f5436eb0501e7a3a
MD5 011af1b6c13072d1cd6644592e0a6cf4
SHA1 3603342961a1c2cb31fc9559d529e2af3311e289
SHA512 796234e2f21721f9b66a63fd38fd213b3efeb501e0ed69c5df4038677bdd76b695c81897c55b85483e1d735ed0034a951c599c7952874d66a671d121aa08ec50
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7Fk3jzABgioiNV99L5S1fd0b:4Nc/zEOVHFQjzQgilV995S1V0
TLSH
T105858B5623E901E4F1BBE1BE89779546FAB1786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d71da5465f2a9ef3e87b652537ab5d5b22f4761bdf76880f47ad59d628fdf9a4
MD5 da8bb1fc9fc6c1b572dee4abb88b1e34
SHA1 82a5a098afbb0ed391114157a953fc1c3ca94e60
SHA512 2c7881dddf9a83a360b9a7b4cadc47d36c333dd81eaad73f6e2c17169c29b355413b4f815efccc02451f1aac50c7210653c4db1d7da532e09138f3caacccda06
SSDEEP 24576:I8kNvNnaFeYhJNtmZBmFjzABgioiNV99L5S1fd0b:I8MwBtOmFjzQgilV995S1V0
TLSH
T13155AF6EB6B845E4E1FAC6B5CD238516E6727861073293CB8390C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fda12d055dc03f905a56855ed2c62a7b8755787f30c43d3eeb0f612e2dce8234
MD5 b72a3d88ac6b0077edfb92b607c383b1
SHA1 b6b1197ce8a74fdbfc6ad0058ead1bb21e614baa
SHA512 d6ecf845366283e5e2745b3d21d66736748d6c8bd12e424722601683bc85500659f450800b8bf37a175788a20f586df2b44ef2d8b8ff237d5b46c80ad7d69ba5
SSDEEP 12288:IHvUrBFrEjwaQS8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:IPUr+NQ7jzABgioiNV99L5S1fd0b
TLSH
T1F465E15F62AC1CE5F676A17DC581860DF672B8620311A6CF02E0817E4F67EE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d559117611594336f1bc88c7b28df019128499bfe9efaeacabd7d25987c2852d
MD5 e870cf37c4747af3ccceea3cc294e6d8
SHA1 2f58ffd660edeb6da7b951db309c5b2640321378
SHA512 90f0291e82659fd4fdd2f2e61880d2e492f5cc1e7eebd1199aa9a7d72276fb6b7557dca10a1c121bf508822bd380d171c9a61687c5464e393c0401e4f19db5dd
SSDEEP 24576:nD3FHshBIYQgAejzABgioiNV99L5S1fd0b:nDVHeBIAAejzQgilV995S1V0
TLSH
T12D75E17EE75C04E4E57BC1BCD6638907E67238A9032166DB02D481BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/940-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/940-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/940-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/940-325-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/940-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2568-131-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2568-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2568-125-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2568-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2568-136-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2892-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2892-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2892-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2892-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2892-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3284-63-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3284-65-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3284-71-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3284-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4356-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4356-48-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/4356-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4356-44-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/4356-38-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/4656-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4656-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4656-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4656-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4852-75-0x0000000140000000-0x0000000140F27000-memory.dmp

Download

memory/4852-6-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4852-9-0x0000000140000000-0x0000000140F27000-memory.dmp

Download

memory/4852-0-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4872-111-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4872-113-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4872-119-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4872-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5484-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5484-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5484-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5484-100-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5484-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5484-310-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5620-53-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5620-277-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5620-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5620-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/6036-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6036-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6036-20-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6036-13-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6068-307-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6068-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6068-82-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/6068-77-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download