862dc6e96c9cb09320855d60b895792a5ec97dad344f55f95632807b06b5704d

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.9MB
Sample261102-nvkteaeh49
SHA256 862dc6e96c9cb09320855d60b895792a5ec97dad344f55f95632807b06b5704d
MD5 af291272de2b35549e588b2db581903d
SHA1 878f6676469b0062ee9f8bc115626955653f5d30
SHA512 aceef9185f78e650ce8c29873c489d6b5b8c7c19005eb8c5130be5e0bba62e2f8f52751eed46184c1b1e280029d250232ef43d268b1800475e4f6b832e3b1a71
SSDEEP 24576:CvH41soMoAXDNiaGGbCeyNtDPAZRUkYagJstji01sk0wuqsObMnQ/tbw/2Mkjy6+:CXzNiaBCe8tDPAZBe7lqs1Q/lFTjN4
TLSH
T18295BF1BA29781F9CDA6D178C852CD42E632780543518BDF22A0935A7EF76F04E3E778
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3892	elevation_service.exe
4564	elevation_service.exe
4100	maintenanceservice.exe
2368	OSE.EXE
1624	PerceptionSimulationService.exe
5512	perfhost.exe
3740	ReFsDedupSvc.exe
4628	SensorDataService.exe
5136	ssh-agent.exe
4680	AgentService.exe
2240	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\32ac68d47465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f623305fbf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db48285dbf6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021a1075dbf6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001727b5cbf6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e934960bf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3892	elevation_service.exe
3892	elevation_service.exe
3892	elevation_service.exe
3892	elevation_service.exe
3892	elevation_service.exe
3892	elevation_service.exe
3892	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3740	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4680	AgentService.exe
Token: 33	2240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2240	SearchIndexer.exe
Token: SeDebugPrivilege	5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5028	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3892	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 6064	2240	SearchIndexer.exe	101
PID 2240 wrote to memory of 4872	2240	SearchIndexer.exe	102
PID 2240 wrote to memory of 4296	2240	SearchIndexer.exe	103
PID 2240 wrote to memory of 4876	2240	SearchIndexer.exe	104
PID 2240 wrote to memory of 5744	2240	SearchIndexer.exe	108
PID 2240 wrote to memory of 5492	2240	SearchIndexer.exe	109
PID 2240 wrote to memory of 3460	2240	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4564

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5512

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4628

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d7135c36d514836d3ea8546aed561aa9dc718cc30db3ee45800d1bacd136c9c9
MD5 3bcc171c9e98b1f515b43a49c6754507
SHA1 8b294420634e8cb91fb9c1fd8336df617294118c
SHA512 302c4d9f85c4e67db5aca7098889b09948ec5559aa171c3804be049bc81760f1710cb759e070b4cd27438f215f54cb1860cac6409c7a4e7095a7dd53b40e6715
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuQ/lFTjN4:K3q6HjBmLm
TLSH
T1A6D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8c8c2f8fda0d3a43272abcddebe5f10eee240f027631a238eb475539653204ba
MD5 b34ee3610528718ce8117b108a151202
SHA1 6b3eb7940f245ada63fed54b8d995dfb593ff643
SHA512 91d6190f76094d4f1b6bee7f77c820842665f5dcbaead175da5858a9ac35bb76f7cb6d936b99815f7603ad33c7d78fcfecff39232fb28db72f7e140d8bdfdc5a
SSDEEP 12288:w1XLsswWkxy2lRq2czANGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:mXYfDtczAtnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T17E65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 583596a5ca8634a29184408e59691ccdebc5207cc10fcfe67aa99934ced48c6b
MD5 b80bb654ad3632453c676377c2c10b0a
SHA1 251e2d76fdd6daf54e523a93219dbf252301991d
SHA512 cde7cdc1e5bc2ea4bcf797cf77f1422c882c934adc4f5f1dcfe4e3f9d6ab443ce0856fd551e1f054b25372912440d5d574def33fa7dd35690eee2f091040db71
SSDEEP 24576:60Le5ji0hmxLrMmnQ/tbw/2Mkjy6Fr7g0o6:6Pji0AlHQ/lFTjN4
TLSH
T134859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3b7539ff49a1c4ff07fffbdf5314085a40ed3305adc5eb995c0232bf2bead19e
MD5 c29eb38e789171a59c6713b988160f78
SHA1 e76efd35890944c472684d9426aead02045fed9b
SHA512 51cf83b46fd631a36f4cf0372dc4bc8f9b680dccbd69fc1c37f6e764d65c5e47f9ad7ab1513a27a3c81e2ff7f50468ab81cc7228e5e0e639d6e4c5d11a933346
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyu0nQ/tbw/2Mkjy6Fr7g0oy:M/ezSC6vUzPvxHjyTQ/lFTjN4
TLSH
T1A6755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f103a7a9af5a4a1d7c0e11bdc6bec4988f033754dfe527920892fe41656209a8
MD5 de1f989869704add7fd9a08a3d13d5c9
SHA1 fe3dc31ccf2a5a651da1fe739fb9e5ec99555627
SHA512 3040416d2156b515a288945b22b68cfae3b3837e7d6dfd1a0df04591d036360ec30695aa7a9c8577c6dd468268693006b58f9ff891624d1e333821afec63165c
SSDEEP 24576:tVbqPb88hv/l+6xnQ/tbw/2Mkjy6Fr7g0ob:tVO88hXl+yQ/lFTjN4
TLSH
T154559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7377769c0a1a700540c78df2bf24059bf5bd4ab2afe1263faa395d031de63a90
MD5 03e4b8ad5c90afe37a97a754593ec16a
SHA1 32568b793ccbba2683046711a6257e693df17e53
SHA512 30ca3e7b07947cf95b0ebc0539b24a250ee0c8dbe5f6ce686b28f85e4ebc2027b2e59b2e4781a1d8c8dd82aa22317cf940b7f29ff6ef1761328b82ce345e8e9b
SSDEEP 12288:4zaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:4zanQ/tbw/2Mkjy6Fr7g0of
TLSH
T1515523796A24F897FF2B06B55CC284826B7B0EC1BFD4AB4E6744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ab14ca77a69ea8cd81913e2bc12e84190bcd008e50568a4a88c2b6aeff22ea11
MD5 2c8e21e458dfce26a4438fb487edefe7
SHA1 17f827e720be4c3120c46500b1aebb91299f8d23
SHA512 4b934e58b2d3716cf11754a156bb92923822f748e23027c475a3e7dcb77b3ccbb5685f2270b5c388c4dcc1c08bc6352a287b8f0de8edba54779f90e93cca0e96
SSDEEP 12288:SeBNUbTVO86U5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:SJIUJnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1BA75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 216fbe17c7976c163bbff874410b0623d878f9fad098fc69d352c8f3ae7899f8
MD5 94f7f0a84fff383e817d975b946918e2
SHA1 75fdbec84b3f7e216af71a54609eb4446e63d7c0
SHA512 4250804827cc2494843300a0d81541212a6cda3691f26b3e0ce23d35d79a1a30aaf6dcd01a1d9da9f045d3e33ea523ab8c9e76ff63146278a3a8238213298898
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:FQvGAdlCEL8c/yRNw5CXLm
TLSH
T1C4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8b67036b2051d02f5fec35c39dee362de4b5048b8af8aac40d273292c3c76bda
MD5 1a83ef67109844d79c4c8a7cf0907393
SHA1 19d41c1bf14c619b1d7d135ff666167b2f5e85a8
SHA512 f570a59a304118e179ca427a5351380b76d398e69ff0bba35edc781a4663be5c0c5fc2bfc5deab8dcd3a8a50f8c1c1a3019367bb99a6a20e865535bb3cac22d6
SSDEEP 12288:6AwSfxL/2Dc39DLLmt0LDQewsAjXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgY:PQewsAj3nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T18275E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0f662f5ad0463ae51733e9531566f32891834c228cae3b764bd03800b2a7b2c0
MD5 f197461e1a4fd8588f2370ea3798c0ea
SHA1 21c4184b923d3cba1672fb2a92a35b9ea1e6a664
SHA512 1847d69cc91cbdb4c3cd633919a4ce82b31c17b38932cbbdb4482d5eecde3ce5235d6f59e51aca6d62c4e249c6d5630974cd3b8b18c9b76d856327859004f62b
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUL:RUEtQevvqc2W1cpV2EI32
TLSH
T150474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0dfc0497df7cbce3d0b643f860f4bd341239595cff8660a75b935996ebc85303
MD5 5ef7c7175a8012283f9cbcf781839861
SHA1 df94c6bdc37a23ed5dcf9ffb6469e8ad772c334f
SHA512 b78226a10f9c860cbe1bd6f4769fa9d76d46cfea3c4e57b23c0d315e4d311c6c8a04375df79811d42ae7b5b598bca829bf8928125c53ab56bfd60109ef805841
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zXQ/lFTjN4:QoqtVjnmTLm
TLSH
T166D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 591f1a65d2ea241146dbc6ef59603864df72a4cd4e26358b9ae45f2347334819
MD5 1ed37f905aa09f3849c60f8db838b625
SHA1 b118ede6f150c90e46af2185eb701326890c22bb
SHA512 0353713a1adbdb633e200cdc2f1678df19e2b10918d374dc281dec4bea9d8213c654f2fe88794e5ad74e87b37195cd7f2f135e976bf711c8cc3b74613eb82850
SSDEEP 24576:DAhGLJIFoiwtA5l7S53gnQ/tbw/2Mkjy6Fr7g0oP:DAMyFoiq5wQ/lFTjN4
TLSH
T17135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4e4a9dd63b7d04a1b53098d33a73e46fb8f512cb71694dfeb184237470603a89
MD5 dc783f287ee4d6554babb40701a13819
SHA1 898f70c38cdb58854e33493e53ca33bc0cf7bbfb
SHA512 fcb424543b10aad70178ca4043136d9dbb51638f989961e0c1a2b21e38a8b313473f841caf1d72ec8781ed9c1254384500a821dfdc107ceea299ea867412dc81
SSDEEP 12288:Umw5HEjsChN2BFgl0WDm+C0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM5:RwuHOWznQ/tbw/2Mkjy6Fr7g0ok
TLSH
T14665F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 27098e34519cd92bed3a28440490a4b22417874995ebc3a0341401f9fdf7dbe7
MD5 4d452816cb0d014c62cca75908009d43
SHA1 07f76525813e48ad5996d661894c51829a85fd92
SHA512 4244ddd8d4f1dc6983f4e08d170477b730557d79ed70db2d67e6666ceeed2e449fc27259419ad6f2eb25d4556ab2f71f51204e425813fe4087f01372a3951f39
SSDEEP 12288:WXZ1IyHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:mZuenQ/tbw/2Mkjy6Fr7g0oP
TLSH
T17B55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c1371c052880fb73f918eb2a8bf03cd40337742bfd2f31b89b361f6fb3fb1b06
MD5 46db56a48bade50c27c58305ec034eb2
SHA1 1675c579c8bfe8ad3d0df30399ffab1396f70c30
SHA512 5f127b0c1bea14e7ee6224eb596b3f2ad39d84667ff1f8a36c8de5e82fbe06b8b333ffdd0c5e857d39b2b8d96d590ec4bf17ee25141da581c4ec76780cf1e86c
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:CQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T12E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2d9cba667b48861aff4cd1142f90ae13ebae00c7d4a06d572e11b62a679e928e
MD5 b87308b2d7c1bde1a7bd8c18ee63c4fd
SHA1 e0836aae361bbda12a2dfc988178e6f5ba91211d
SHA512 45417c37da031a9b18a2b8b4173965ee1e829a66db528a892d0d5260648bb232e5c122b103dcf52f9e1711595bbf5f6fb77bac2d1d2778d448f439ef7a5fea6f
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:MQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T1CC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a003663812bd711673a0301e73d9efe625c49262354c9208a45be719c704b681
MD5 68287d481e9c98716d90fb238eb27f8b
SHA1 7da828797d5547b59c82be92dbd6c9419b0f9a12
SHA512 d8e6613200860552e68031f3283fca4c4242c534cfc59393c9c589b92a81a6db75da1c29d7c27c28d1eba8cb0710c2436733fb5f16b04c729893387f06fc7d64
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0unQ/tbw/2Mkjy6n:o68Qg55nhheWu7PNU3/HQ/lFTjN4
TLSH
T185B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b81be2df0fda426fee29a34d23773deee7c42017cdefc94343e077d7eb189b80
MD5 2ffd4d049b775a71732136f04d6e22d1
SHA1 8de977cd593b3ef68fb0952203b2623c5f3cb09b
SHA512 61bd46d54d5ee20c20d0013520db19727277360dc34eb9442b8576e4e7ca0febf199ad29eee3305fcbaf039100a28ed4371ca3234124cb5fca89af6183866336
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99/:Ty5112gYy5azzVvL69nLKnhZVLm
TLSH
T1B3167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 500d2869b047ac44199b475f336fa1b46bad01924da27f967aff315878832176
MD5 c30584b9c9effcad09cea94c8d065c77
SHA1 9b96f12f0ded3da9844bafc9c89aaf97fc294e03
SHA512 3cb09387c1a03eada51d14bb8a181b8d2315cc960a5044b78d722f180b98c3221e75e0819c92581d3a3906e2b6fc0a0ec407134805ac71cdce72232544ef4509
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl9Q/lFTjN4:ou6JmVxd2dyLm
TLSH
T1BAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 edcffa507b76e70bd6c3e0957484c868aa23f74140750643af5fa882f4120cf6
MD5 2349327a15d6430e3b106b593b5e325d
SHA1 b0630d2ac6d7c789a4b96b3a4a83224dfcecf642
SHA512 3aabed93dc69e6c388fc0585e1ecf1c4044a1ffaac3e4aa4a3862a2a4b7f5607ebf24ae0c8c6cf135a23f5ea63b146d99e440e9934a26759a2c654ade25335ae
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xpQ/lFTjN4:pmifPbRTLm
TLSH
T150B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e0033a11e91f233b3624c16acda0fc126a69a92bf912ae62429ba5ec4006b429
MD5 47ff903fe3e52ff1de52cf4a0726775b
SHA1 ada74d31c3fd26a4ba7670feaccacfe24449955f
SHA512 3ab3ef7b36918df7c13b5722aef857fa262bde6b08a8196cf2dfae40b57245021841ecf3bd8e6162f2a1d16e35a46dd6af4fa0a4a477049ddf002083f70585f7
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqeQ/lFTjN4:G5dKTi615Lm
TLSH
T147C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5ef7885c6172ff0cfa329ff61eef2d23c4a754dfb15b4c8aa8d4bbc79bd28825
MD5 494ef6e90fc9b7217c4d5fdfb110b18f
SHA1 c7ad548c58125e3bad551ef6d2570ce2d8f13482
SHA512 dab19d81e210950b30944deea1b45f06ba97ee6b6de376fbaa4eeef56ca570987a19b7af0d4bffcd87d5d7343c00b3d47c4973928d5b21450be92b3a0c91f19a
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5wtQ/lFTjN4:yX2iyphPLm
TLSH
T15E95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c96545c302f6983b8fed4beb2221bebb0e948277544a1cf3db8d3e8fce3063a5
MD5 3e6eac19dfafa70513f831a504496b51
SHA1 0c2a82a44c846992d13edb6b0a002442f8acf6a6
SHA512 f93c4a68d11a49b0954478c7ca26ec36a0830b909ed520630e3bf11869ffbca2e93f34ce81de440a95153cb6ab1f087007e222ce7bf74ec27376a72c10c32eaa
SSDEEP 12288:1yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:1ynQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1985523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 572abe06931567e02710296bf39d7792f2005aeea13bb8287279eeaa67b7ca60
MD5 5b68bc09af5deae3af2cb0eeb357f591
SHA1 7a393062cfd5799ce3be6f0c11b471fd88a84116
SHA512 c32a19d645b8bf2c4d0f2bf9f67cf7682fff259254d4c066e2ea630887ceba7aefe4a844b6ec147708a3e77e297509c0f14aebb3b708db63ed68d6e3786300a3
SSDEEP 12288:9rGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:9bnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1235523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b5d8d9e873532dff1efaab0f1255556139b1498010673992800df3bca4777aa3
MD5 4de9fe8708e328084c4a61ac6853c480
SHA1 476378134c830f7a0520cc986c672708047b5c5a
SHA512 4dc602a08a9936f952fa59a09fd7154ee7d59cec780d1e137f5ac636228b19c1b03217652f25864a2c18ba48c765bd3350b42571eb814e69f150ea8acae2f4df
SSDEEP 12288:uxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:uBnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1AB5523697965F98BFB1706F14C8281829B7B0DC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 583b57f5a1e826a7479b178fa9719953a33c2bd704cf29ec8c199a22b71df2a5
MD5 64d780a1142032c2718789c3331f388b
SHA1 57998f2eb67bc15ee32ef3a515680fa4fa9f6d5d
SHA512 36bbb2559542a367ba601c7479e407930e0257e721728c1cd34436346163d18163ffc5e80985baa00f2ab875ac0750c7089c60ec079505cbc046648a72eda9bf
SSDEEP 12288:sVgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:9nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1045523693A69F4C7FE2742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9efb75d9446c70e74be6aa7519482f39a11711db803384b5262d49580bdc6062
MD5 2bb3a4a26e422c3d7b2a9104a12618cc
SHA1 207a44acfa293c9e579dad23b97db7f00d35af65
SHA512 238708ef33a3036b0583f1d49e67baa2f796119eecf5958eccb7d443ffa79af7b88c4908c87d5ccdcd5157963009daf495d45b666b461c88ad3508e828385341
SSDEEP 12288:eIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:eInQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1A35523697965F98BFB1706F14C828182A73B0EC6BFD1938F77482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bda1d72fe2450a9de0e66fa9f6ede150231236c2f5dbb9494823443b10d3c015
MD5 febbdf474de52b20fffdbdd3bfafde37
SHA1 7722d8a583f6884c047c1ccadb7bf908bfe135e3
SHA512 33eaa1780c6befc2234c3dc5c0759c9949438ff4fd17654ea8e59bad3fb8a3f93d9b51de61f18d83895566ab4b31c91b42115a50adb4cb386f93b7e7d1ee5f43
SSDEEP 12288:FvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:FPnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1E75523697964F98BFB1706F14C828186973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c111d95d4380299fbdd5dfe8cf26dd26363f81ce76e7afe67c777e8d5aa84d67
MD5 2c3064ad88fafd2ba7694e14c8bcbb91
SHA1 824b1c82abe484bef2ef08968d6801dd877fa28d
SHA512 d3539f9e01a831956857847d4e8d7e062fec86572e90a20a7f3ce0c2d744f35e53ad0962e83bd2b6e833d48e376d6937c74c96176822ecc70fee275a529c8b30
SSDEEP 12288:aTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:aDnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T15E5523697925F98BFB1B06F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ac7fc4fc9943d130dbac182a1c96aa9800606822db1d45f2266be9168e491810
MD5 d155a7a5c2f8580c96933971ef858902
SHA1 9b71398df452e212955638bb45a90e44aeefa0c7
SHA512 a4e417c4d33ae5d62ebda930a88a9c5a747fcd1dd1a1792a7d86ff482ec74e6f80939efff2b801420b11ed8138e44d39a801c6a70f8828b61f98854353a5b7c5
SSDEEP 12288:/iZwbDzzFEoS2cPvyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:aZM3zFVSO7nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1967501A5B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4da2b1ca47bba9af7b60b28dc4155a3d0aa71171816f591120fc9f2f988b7014
MD5 5ebce3f43a3178f501fc5886d5591cae
SHA1 f3ac8523f45ca8bf2942f9235aba107b54245579
SHA512 462be77206dabe25ecc5fdccda7aa69d76629678612482f6b39db9ee5d63433412d29dd2d148af1db1c234f6dba8cba0ecbeb671fd3e8669b25745a6fdf5f8fc
SSDEEP 12288:GOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:GOnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T13E5523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3b73768388f6643b9babd08cc1862571de1a50c1a7a868cd585c82b05fc979e3
MD5 8a2d1a820ce456bfad8d02908cd5d0c1
SHA1 47440954863d40fdeee9304a96a22f25a57941f8
SHA512 32ae25080cfcc7c45813ff38c0263819c5798020ad2b7673e8124b7d0b10b2c48933f0dcff18b083051c3d7d55aff65a21904012e0b24fd3f17c9ad7cadf421c
SSDEEP 12288:rKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:rKnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T16C5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c6aa03899d59e6d447361bcdccad6d5c792a9b0729ed2b11d33440814fcdd2a1
MD5 35cbe72175cf92dc7c5e5dd60f2207ea
SHA1 5809db1c527b8da2453ef3e585dd6ac5cecfb975
SHA512 9098ab0c7b5ac4d1376db388d8ebea974c100eb44c4e4e0f2a6f5ad55218297f887067dd17aaba08a1665dad6f3a2356d602d39f8a125a9ca0f233bb094ccbf9
SSDEEP 12288:yyPz5L8HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:vzynnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1E165021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ef5beff29f982d7ef1a6af563f7d86e882ca6db719963078656a046b67e5aa3c
MD5 a69d398837f82a3ea8f2b2e3bd028bbc
SHA1 2a2ef00a470b6fe8244dec8ba44c85753a5f06cd
SHA512 be21773bfb035bda4d46bf576ab8a892e9da7f2d57a4d02de06cecd3e2fc4bc6c4b42e2b812df02d115d9c11a8febcc956377903c887f9dc30b7f5ac99f3229a
SSDEEP 12288:5OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:5OnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T17E5523697955F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2c3c8e172c70a83e3335b6438e074bd151a7f97802a77da4ed3bdcd9e82769bf
MD5 2c34958d68db1e17c252734b30ac9aa9
SHA1 f0741236a1d60d5abab70a89320b6469aa15dd8e
SHA512 7cd68b890bba217772e41f00fe6a4f3f7d319d72fe5884e3ef0c12e1af99980ac5b7739f4e4ae682a6596a9dc60916e78d85c811f7990ced5ebe1a7786c53cfe
SSDEEP 12288:eOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:eOnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1C15523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 258743ed716d8e001a2c66187b4ddab342a31541a8667aa0a84774753fbf91fc
MD5 ce4aa98a2ebd9839e0e64521119304d5
SHA1 b0c13a9331407a132b82ba48ef6fa39200e2ea92
SHA512 36cdadbad12d5926825b5001950d66f5b5970025579d97309211c96e17ce5a7e640b700b80e81012873562de4e0ede41acc6bbfb86cc791dbd42bac677e97e56
SSDEEP 12288:9yPz5L8HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:0zynnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T17965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 678a89cb7e0a6634d4c83d5565c2799f8b11d7d1663d7a69ba38c515784be49c
MD5 b96b2cfb335879754a41e5b68452dee5
SHA1 c2ad1fdcc3c5399c2dd23686b7900b5b7c192d31
SHA512 c7d094afef4df0f8a96abb8eaeb0ed1406ece9c241f111400ee6300c28163771123289a6f2abc1b4c3c2d86c69234e6a054cd85314350316c6ae44913d3713a8
SSDEEP 24576:qT0aLl3z0zDRnQ/tbw/2Mkjy6Fr7g0oj:qTDLlj0Q/lFTjN4
TLSH
T1467501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 056e48213040218bf68c69957ae1265cc1787610d2f29523cba1ccf7a5d2c361
MD5 31a4eecd905b6fc75eb7f42e2dddc60d
SHA1 cb5d950d5f9eebfb1213002ef9831bed4193c6c7
SHA512 19b0289cf466e268f979167a2b6079a700b1e6fb8b12236ca094e2447f609a78f7075b59cd4da7a360794459308e6e9263381a25cb40d24c787c49a214bda2ff
SSDEEP 24576:Q31d9CHKy7GZFnQ/tbw/2Mkjy6Fr7g0oB:a1d9CHKya/Q/lFTjN4
TLSH
T12285CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 394cc736a4c092e42042939ed60d62c9dc3324ebd77329e1012797b14f7e8cb5
MD5 31d482daecea2fa654ac45b61f3976e7
SHA1 6f39a1e1bfb1eef825c1b84ae0be3a0bbca85e64
SHA512 65f9a257a4be5b9e867893b31bdb53ae056140753788d7a60f2d9772abcbccf320222b6e4ca26111c90872d0700eb12e579648f678ac37e0c7c7a838c7bdcf1c
SSDEEP 12288:+RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:+hnQ/tbw/2Mkjy6Fr7g0of
TLSH
T13E5523697965F98BFB1706F14C828182973B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0ea3e3648f274b02dd94e6a5054d9b1072d989b5c55bc7bd38de27f2f087164d
MD5 8bc77f6aa051144aefa3921c878ed61f
SHA1 0daa1826c2f19a61cae8b988212a200aec52f5f7
SHA512 e1613c2c962221aaa490454ad3d15491f49751b7daf8d0698974caeb2a61aa6efe208deac4c81c0677555fe84fb1d7505cd7a8a88791057bf692c379c561e930
SSDEEP 12288:GnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:GHnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1985523797964F99BFB1B06F14C828182A73B0EC6BFD1938F7B481129967D39406CA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0aa9d1115038fff5c22c528d5cde9d0937c10c861a751bd3fa7dac8df880859f
MD5 975db6eb4688783a24f912bfb24d31d4
SHA1 a6e08ce7f32a78a4a9d3797d88c35c8535ba7c97
SHA512 65c790762028d3549ce56ff988c77d5c183ba8c3b1ab7e910b3e0857b5c4fa10644dd26faef3c7822bc1419235c6f2d96853026a4d3466704fc3499dcd3656a1
SSDEEP 12288:McGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:McnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1285523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 857933cad29713af8692431485251396f06e9a88be86eca3b83ac400858776e8
MD5 d89b429dee2dcc75222992a5cea14403
SHA1 39f2e5dee66f2b8bf559cc290ea3ebfa27495df5
SHA512 f2ae7ff5a782513cd0ff2be3011e1d25144620fe9d596695db34dae8fcbe399a8a35a00e3d411231eaaeec536417a5cef08c6fcf6b662a7f9e8e16e3d122e40f
SSDEEP 12288:oOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:oOnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1045523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 aa90555ba77083ea3a16512c88c5ed1ffeb027a88bc24f5604c4860c8f6cca33
MD5 204667815340ef560bbfbb2f60fc80c6
SHA1 d31caa6b49464ffdc08fbdbd507c1058f8c8d0f9
SHA512 81539418ac3e982f5681bdcbd79eb21c6289072fb9d6634a34be7edcfd062e9fedb6b140df3a00555dc7f121b2fcc5603d358b1d8f96d8eac9213204cc29998d
SSDEEP 12288:ORGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:OhnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T18B5523697925F98BFB1706F14C828182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c365614b2b09b6af55568072953673bd87be7f6ae9e6d98202fed0fc9c76d5cd
MD5 98c926c3f7ff115cf30bc6adea446518
SHA1 77b317cd2b38e6d1f857299ec0bd7e54b18778a3
SHA512 44f974105edefe5be6fc069635e83f82d0f079ab5bf85c66fd42a8292a52a142438e42c34375bb72bd71012ce52fbac683406c9401d01f45229f9f0ae7979445
SSDEEP 12288:aWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:a2nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1BD5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6df9d9753c6f9b01908bb55ad60f7329edec6b61cb06c47552d0a80c2dbe2ca2
MD5 c0ff2f2adb8496aad443258385f6f44e
SHA1 608327018dc79f1515f1c5d4adaf5663a7b5e05c
SHA512 6e646ef24c8ed97af291c1b21e87e214ccd4e92e1a27ac3b05a2267489bf944e98093c16de2d99757e8bf30331a67ad7234ad8c82ced92432215a25d73dfe8a5
SSDEEP 12288:GIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:GInQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1D25523697965F98BFB1706F14C828182A73B0DC6BFD1A38F77482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c5410c7a438fee1c5c54da32cf41073328111ef13648d69967d50570fc0d8d99
MD5 4ef453583c06c8e1b56c24e8ddf3f6d5
SHA1 db365d31c3fab99c7a9612443d55b864b4b4d88c
SHA512 bcf0b1e25287d23978311051ce298e215e8b9370625cb74bac10789fdbc59b122ee69edb721113cac8ee3a296e0bed4fbc19d7d85c0ccd89806a5e379bef3e15
SSDEEP 24576:Qfwv/k9RX6wkyAI6nQ/tbw/2Mkjy6Fr7g0o6:vMnYI6Q/lFTjN4
TLSH
T10585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cae1fe6dfc8edfeada613e4516c08bbc317830c8d92cf2f093ec62a71f10a0bb
MD5 41ed49a80f82ceef7bf4f021c4a9f656
SHA1 b3dca8903c8531f175a54d5a92dbff00d2882846
SHA512 6c9d86361feaa9bb6c474b46ebef65621d4678c95c287c75abb87fa86c082c6f1136590bd9f258cb89abf3e52b4fe4f1fcb1f172853dde70e7452ad1afe7e9ee
SSDEEP 49152:jYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NQ/lFTjN4:nySzPqLm
TLSH
T1A6066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9f4550dfa96f9c70b128551cfe83dd21fd4103124fec2d6fb75aa7f15a1e1ffd
MD5 9070c0279bd9dbd0daa2fa3dcc165034
SHA1 693c6a3b39f4874b3df3accc0fe646ab5cadcbfb
SHA512 a56175c7869feab16bf3a38e409b5019dbabf5b23883e60013f0ec03a0a38461ff352bd5cb4902c0d3cfcf43158315262a81af50048089a7cd8a9691665c9003
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYrnQ/tbw/2Mkjy6Fr7g0oX:x47JUQj1irIhCnDHUPfF/9Q/lFTjN4
TLSH
T11265AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 302c4cc9812f6ce0f53c77c178ea4a84b8655c213c55fb9b37a6143952f1a6fe
MD5 1d0dad1057e3501415081a30b26cca44
SHA1 6125ff4a7a5933835a49baaabfa048b90c72b07c
SHA512 fe35d6ea6210ec24d840f2a232b387fd83ac0bc85d393088f3adfccc552ff8a872b0bde42b0fa958abe0bef5e648731856d76cb388de9e829783b59f61d96f0d
SSDEEP 12288:7ssfeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:3enQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1FA65F119E29852E9D12E5275CB828641B3373C9597E1D3CB63C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f528865a7ccf07199fe352bd9f1b5af0cf9a88784fca24a9210c6c0710fc3a4e
MD5 efeb41619d940a8e4231a16908173dad
SHA1 879364563a743fddc95b08488054258e5012a5b5
SHA512 3058940bbdcbdd64d52c2f7c9c34b75462c01e1bba2dbe68e216db98ab5a708f7ed253782d5b17e71bb98f9620f43f00dcb836d1d18e446c0fb8e267ddc84f7b
SSDEEP 12288:KA6D4XcU3fIyEPsInOGPqhcXIF5w98jRMWpxZA4mRh9Rm:KA6sMUPkIGScXm5djRM4a4mRU
TLSH
T1E04528517626DB4FC6AD40325E33D6CCAB707D01EE046F0773C98B3F9476658BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 5063df425396264d35d4c63265171861ba4b3cdd6bd32a3778a97abc67a92336
MD5 b9a584349e66b0eac1a9be70f190631f
SHA1 bb99d3cab6ea3ab50e8412b1c6c7fc29abe24a28
SHA512 4613fee51b34b9c577422095d71610e400485061da3aec86fae1bd6465cfe806916980f0e8caa54d20ac8b99b59bd9346e203b99793ce246866e222d98a51d5a
SSDEEP 6144:3G81kIib0JTYebEg6GKd6RW9JURWXF1CaBZmGDBQytMx7hJRi8Vna3rJ8Um5U6W5:2ukIibRd6RW9eRWd0ETVfdX
TLSH
T11645D7815136E78FD1FB6032072A6B4C7764EC06B7096F26B3C9453AD82AB55A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5ee0f4383e13cc699e872dad1a283b3c2dcb6126381ed705e9277eb42c3d3a6f
MD5 1c6720f5c02662f6df16a7dc55385126
SHA1 f0afe325dc83de5d585cc77d0e6ebc7ddcf64c62
SHA512 ad83fd46f23f2235945f0e0a2a3787668f1f2fd3ba98c6059696367f8319a7d27ab89b4e70b3ff39f7e58e31f720fc88fa6e28b72c814c60dd171b6bcd4442bc
SSDEEP 12288:y67mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:FGnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1D45523696668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c59a06f01a4e37bc3614b6b0944b7e4a3fdb94d2ab985ce64840c5c9b9391b2c
MD5 26fc8862d72829b42b991ddc9ed88265
SHA1 796ce60c8493034220c04dab956d45f85331712f
SHA512 f53f90c9d07574e8ad07883cbc856ce4ff8e049062d4c6e3b68c76386b8fcf017e929b11c855cd70f54ad31339758111e1cb0ada2a6055df9ccb1906d140f370
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bY0nQ/tbw/2Mkjy6Fr7g0oY:+gb4mBIBhGFrQ/lFTjN4
TLSH
T11265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b901213f589d8a1f03481126b6d9c4de70c1e3b15ba0fd0326f07c2dc2e44ba0
MD5 1ebca54260ab003f9cfc59a85fe3b961
SHA1 474ad32bcd192e4a777bbddb8a1dfcd7d3168656
SHA512 f9902b7ee5fd202282169cceec70607bf8c701a1ddd5a0b8bf28a4d2f0278b5a80350a4b1e89f3e5f85e9b1a0113e05a4b0deeafb4b92f9bc5e2871c7d020fe5
SSDEEP 24576:6G88u8FpJqH1Qzria7/m7nQ/tbw/2Mkjy6Fr7g0oY:B7ZFPqVva7/8Q/lFTjN4
TLSH
T1EE85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1068df8cffa1d4a739b3ccd20621708d6e1007df90f1a6bb49f162db8744e593
MD5 c6b0abee06426f0427bc682dfd45a625
SHA1 b39b4c3c7194754005d3cda0eefb8c6f9b658161
SHA512 962419cc908101db161965328ededcc7f846806e36a8befa2d60037e2fb3282786f1a1dddc43e455677cebbb5676b5528c0019254307f0b91e6bc46c896ab795
SSDEEP 12288:eHvUrBFrEjwaQfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:ePUr+NQ/nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1C565E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 310d3190bd94cc2a47982f86b5f917ccfc41ab57a0ee2cf009c0102644b08758
MD5 b651991123f6c348d581d6e790c2fa7a
SHA1 9682e305044d6390d175bcc27eb58547ad39730f
SHA512 0f450d0990cafd5394b8bc241723c80217c3c685e0f8f95569a9736b8454710936a7c6d6e68115e2809f038a919acb5bc3dfd3699ccc8640dbf2371c846ce482
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPQ/lFTjN4:lG05lO43btLm
TLSH
T104D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 621053a587b5ed4e8541a91d64cb956f24eb5e5149197adf3611ca9f2a6d4e0a
MD5 1f24975d2a3cfd17d145c0be2a3b2bed
SHA1 e35173a45729a83c9fa506c3b97f8f5123e62ca7
SHA512 e45bf47bbb3903baf60bd11d8fd7a3531472898341c849a13d3cf5fcf221ab8f910769d9c42e2a6599532719923c08c38fc3931235f5417db1efc4140fb22c39
SSDEEP 24576:9fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnNnQ/tbw/2Mkjy6Fr7g0oG:Na5POZ3+Jt2pasx2+mHQ/lFTjN4
TLSH
T10465AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a84f56f2d98988e98b790d198193627368939755dcc17cf76ad113fafaeca0bd
MD5 097935a7e00d917be6906525a9362586
SHA1 7c2fcfe2776ec9354cc8821a023bf01c5d571357
SHA512 680f58afe2be5f0257e7459ce167d119176f4ef9caea2160bad0b986db364107204713b6b40d7c5b898a1a245a34df5bcaca8117fcd512e78cb9c4cd6d87e64a
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkTnQ/tbw/2Mkjy6Fr7g0oU:7Nc/zEOVHFcQ/lFTjN4
TLSH
T19C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c16f20955486cc5445cf5ea8fb1bda02eeee63d19546db84e043e2e6cfcce69d
MD5 8b429a40c40d788cf737e9821b665f78
SHA1 11fdc3606316e96f47c8a812582e8775056863fc
SHA512 95d78ff0d5a0ab963e4353545240e2393cd4c3f08418094eb2abff808fcef38f3089d3d4c0bfd48a769be923f9c360ef81c450d97037e6b09c90a35f9c9edb57
SSDEEP 24576:c8kNvNnaFeYhJNtmZBm5nQ/tbw/2Mkjy6Fr7g0o5:c8MwBtOm5Q/lFTjN4
TLSH
T14355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3d144621f147a60b0da62ffd92d0bc739292c9ba4df1befd106263a48a99364f
MD5 df83f456dc30551ab563cc7f1fea555e
SHA1 e20e3fbbc4f95b019b99cfa9dc2ffde2490b1526
SHA512 fb7ec2c30c8bb77c8fe8a1d8095457a43a53265cb960b1ce60de340255d2d12850a017255d76efef8741fcdeefc1207fcb7326d500b732fdc249025296a6f4a5
SSDEEP 24576:nD3FHshBIYQgASnQ/tbw/2Mkjy6Fr7g0od:nDVHeBIAASQ/lFTjN4
TLSH
T1BB75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-74-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1624-66-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1624-68-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1624-309-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2240-317-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/2240-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2240-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2368-51-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2368-52-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2368-294-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2368-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3740-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3740-330-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3740-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3740-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3740-91-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3740-97-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3892-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3892-21-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3892-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3892-22-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3892-14-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4100-48-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4100-61-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4100-39-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4100-47-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4100-59-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4564-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4564-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4564-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4564-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4564-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4628-314-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4628-103-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4628-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4628-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4628-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4628-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4680-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4680-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4680-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4680-136-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5028-78-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/5028-1-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5028-7-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5028-0-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/5028-8-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5136-122-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5136-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5136-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5136-116-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5512-79-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5512-81-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/5512-85-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/5512-310-0x0000000000400000-0x0000000000542000-memory.dmp

Download