Analysis
- max time kernel
73s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 00:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe
- Size 7.0MB
- Sample260708-a2d3jsgx5w
- SHA256 d02d7f76f23f00edb026297dd4bc1fec20383f6a78c08a98896af2c0b823dc28
- MD5 b2bb06cfe9ca8d81b504f33de450c2ec
- SHA1 147ed8e3922be1a95a6af1c266dc8566b0565c99
- SHA512 420f2e196f420e4ae762a99110e654fe0423d8b762dc4bc8cdeca3fd67a75a01642fb7b6e11715a6c5a5f72ed61e3419bd4c4e40bfb34ad27f9f54bc86fa2a1c
- SSDEEP 49152:2eTxGVpVMUpr61lrXeAugKj+U0OviGemlMXGg9BuoAqZna2bx4tSyVLTPkRPfPy7:R8ObGfLTPkRPi38dJL10/+K6b
- TLSH T10576AE1AA79442E3E66ED630CA5EDB33D2B1B8460635874B1806D3462E776D1CFBF234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 256 elevation_service.exe 2124 elevation_service.exe 2256 maintenanceservice.exe 4000 OSE.EXE 5968 PerceptionSimulationService.exe 5048 perfhost.exe 3992 ReFsDedupSvc.exe 2856 SensorDataService.exe 2952 ssh-agent.exe 4576 AgentService.exe 1288 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe - Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ed77c1dcce3e03f1.bin elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\javaws.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000656c29ab720edd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5893cab720edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000321c98ab720edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000957431ae720edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002e910ac720edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{C0DC3F6C-83A3-464C-AB48-490AAEAC000E} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{464AAC6A-0084-4D91-B2C5-947789626A43} explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2752 explorer.exe 2752 explorer.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1292 2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe Token: SeAssignPrimaryTokenPrivilege 4576 AgentService.exe Token: SeBackupPrivilege 3992 ReFsDedupSvc.exe Token: SeRestorePrivilege 3992 ReFsDedupSvc.exe Token: SeBackupPrivilege 3992 ReFsDedupSvc.exe Token: SeRestorePrivilege 3992 ReFsDedupSvc.exe Token: SeBackupPrivilege 3992 ReFsDedupSvc.exe Token: SeRestorePrivilege 3992 ReFsDedupSvc.exe Token: SeBackupPrivilege 3992 ReFsDedupSvc.exe Token: SeRestorePrivilege 3992 ReFsDedupSvc.exe Token: SeBackupPrivilege 3992 ReFsDedupSvc.exe Token: SeRestorePrivilege 3992 ReFsDedupSvc.exe Token: 33 1288 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1288 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1288 SearchIndexer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe Token: SeCreatePagefilePrivilege 2752 explorer.exe Token: SeShutdownPrivilege 2752 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 2552 sihost.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe 2752 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2072 StartMenuExperienceHost.exe 1796 SearchHost.exe 2752 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1288 wrote to memory of 3788 1288 SearchIndexer.exe 103 PID 1288 wrote to memory of 3632 1288 SearchIndexer.exe 104 PID 2552 wrote to memory of 2752 2552 sihost.exe 105 PID 1288 wrote to memory of 3324 1288 SearchIndexer.exe 112 PID 1288 wrote to memory of 1440 1288 SearchIndexer.exe 113 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_b2bb06cfe9ca8d81b504f33de450c2ec_cobalt-strike_glassworm_megazord_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:256
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2124
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2256
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4000
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5968
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5048
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2856
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2952
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2752
-
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3788
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3632
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2952 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3324
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2948 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1440
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:5384
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2948 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2352
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2952 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5732
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1796
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 a025cfa2f4ec900ac74623ad9722264bd508c5b38e289f6de39be34d4867d893
- MD5 b77d4d25e6b108bfaacc4919181a6015
- SHA1 004960190f079274e66cb8c32ffda49008817fcf
- SHA512 5121d034b72c596cab3371e75c668d559841b5fa659dafdfceeeeb18f336aa23ea426bc72d7749d1ff10621835da7493c9bbdfd80322852db094d45fbaac7af3
- SSDEEP 49152:6b+632BuPkFKRrdE6ohQstBhuXjfS4LWxno0i/+K6bxW:s3q6tjB7/+K6b
- TLSH T164D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 04af2de6a833067ae92913366cb97c3397979eaf2740eb4d040911df121d35da
- MD5 cb1fdaa7de8fbcc2eebccaa7e9243372
- SHA1 c70c40b1ff0ada6ae2cf28fa0de779d40d2eb51c
- SHA512 d4bdf6b48fd5c1165da0438bf67d12782fb12410f6ecf08f6e38a3620f50e78865871697de1ea3aeb2f2c0a1b9e63f71b4ba0c03c8d6f51a225321a0d8f51390
- SSDEEP 24576:FXYfDtczAD051dckw+1MCO6Wm/zLPFGn8W:QtcK0i/+K6bxW
- TLSH T16205012877D008F9DDA78239CCA18501E772B8A54770E79F03E49A6A5F332D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 d3fcc95fe4a51f64cebc5c72dc08e0e4399b2041dc73dfa27fed9f5eb29e07af
- MD5 46a4c8e0dedf7ffc0cab090fbca42ac7
- SHA1 3a406392cfe91ab40d53c1a4ce8aebd153682706
- SHA512 8a36b4aca50e9a3ea7573288504f43e43683b2a73adc1ecf22735f1edb9f1d964e7759c3a05a606ec282439fa419b6c0de21c0f8cd5ff147a0b7bbfec215d4fc
- SSDEEP 24576:K0Le5ji0hmxnrMQ051dckw+1MCO6Wm/zLPFGn8W:KPji0Axx0i/+K6bxW
- TLSH T17035AE16F6748731D073C0B9C5D2A68AEA7130865B308ACB4286D77C7F67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 9aaa3021e9e7e94c15a3f1fa99ee11af298701cd8976fd2ee792b612de1ee92b
- MD5 23048fd33e586bc1e17900bbd2e8d1ec
- SHA1 f0de0d67779838a4a573fe4d67ec458479d357a2
- SHA512 871a4be87e05778190a9413dd1dd6e5b6fa0bcfb1163b0005c7f6f710b1b98b43f9f73ba16344bf746217f2ac5f9bc6bdef0d4105939a18b4bf66642c14a5e38
- SSDEEP 24576:Ka7/ezSC6vUyDZaqgrvWx6q8wyua051dckw+1MCO6Wm/zLPFGn8W:9/ezSC6vURPvMHjy10i/+K6bxW
- TLSH T1D1756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 cca4504359dc2a3d8a108f5bf644fcfb43804c4ab5749e2d1fb348dc50588530
- MD5 6161becc988045b84add2612800f3e50
- SHA1 3f79d87d915eb417a50a1e3b2660d3a29584429f
- SHA512 3e416e130d5402c91f7e79a362a93691fa32c4d33dff202d2b4136735cb189b252755bcb73ea105112706f3896d1ff8bea8ec276ca8f6188c3f0b030e097e7fb
- SSDEEP 24576:DVbqPb88hv/lV7v051dckw+1MCO6Wm/zLPFGn8W:DVO88hXlVb0i/+K6bxW
- TLSH T1AB559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 5167286369c150e0a4e9c7e5b23571b3d90ab043afc7f302302a273db8624f0d
- MD5 a5649c5973fcd85cc18e4c2b623965d3
- SHA1 4ef84fa33f90607f0b91a81905731c5aafc79cbe
- SHA512 3ba6d306f5023c3602f714bd617211beb108d676e14d7fc305ea7956fe025f726959b09343bd844f369a03155969b30fd2d41b89f42428b69bbc9f3414180515
- SSDEEP 12288:XGKTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:XG8051dckw+1MCO6Wm/zLPFGn8W
- TLSH T173C4230A9F060961CBEB8A320C78BD813794CCBC5979563F0D69BF8FA37D93A8502755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 37cf9ac5686518855dae34a750160be7c3c29abe84ed22995e78fd5a5864050a
- MD5 97887d0380059a87b6de1d28fa472a2c
- SHA1 2cffce74d6f3b7b61d70886e26f86e76aecc7714
- SHA512 33b3c3ffd10a2a2287554c247ae747348c74d399adac8faf509e8f7ccb149b0cce87d6483d6ab5f3f463cedda04898cb8fc2b56641437b6e500356d247d4ed74
- SSDEEP 12288:ieBNUbTVO86U7TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:iJIUX051dckw+1MCO6Wm/zLPFGn8W
- TLSH T11305CF3BEE28ECE2C27A8D795A918600E77278704B61A3CBD175C30EDE235E15E75C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 6c0bf7a257b4dab7b44a288082523fb25ab8fcc89d8017c8dfd8aa60e463d9c3
- MD5 089d43c9c45aac557069f4aa68b40467
- SHA1 a9988c34113ca2078df92c783a3a35f4d0c73e02
- SHA512 6763b2b711a2a86440c948924cbfb37dc28e03b9c35808fc7b3f906c8a524d113808f9cf7232e30fc525938ab9a585e49aaca61553ca389a2c641dfac18669e4
- SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THd:OQvGAdlCEL8c/pRNw5C0/+K6b
- TLSH T186266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 3b92c68bf15691109140a24140721f5cd70a755ca79f96432d1561e39cdb6fb2
- MD5 39ca28d939e2c5745ad235965fe2eb80
- SHA1 7abf701be01f8e946712f593a3b86d11041c9722
- SHA512 ec813dd892ac23d0d589895184090a099f3e21efcf068298230b06cff81111305d674a849b29c92965da3c64dbc457dd281e8d97513d1a4806ccfebab4e182e5
- SSDEEP 24576:KwewsAjB051dckw+1MCO6Wm/zLPFGn8W:jljB0i/+K6bxW
- TLSH T1BA15E031FE75D432C7BF0DB21B35D716246CB9604B611AC3E3A89E8E5A342D22376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 63198e0ea56f3b71085515586879e12b45bde36062dcbed014be1031a562b7be
- MD5 2e7be9bfed9ad99bf220df0036739d39
- SHA1 f0bd0de667e1e3f1cdbc728001542269b96a0042
- SHA512 8631d90e187866e965c34dc1d9e2872c2f082b79afcc01660988b467e3794c94e5a8eace5717dc2397f40a2d2fb098103393207e4b132977b65ff4c5ca7620b6
- SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHF+Ks:zUEtQevvqc2W1cpV29I32
- TLSH T179474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 099598e296d9a53ab1876583f0c62ef010db8eb303ed6ac75f0d0e25881bde63
- MD5 a582ff3b2284ec63814dcc97104dd64e
- SHA1 b98255a4cbaf44103f187225ee9739fccd129c94
- SHA512 bd1185a0cdf23d0019cbfc73e67a30d3d91d596908992ad4a0ee9e0941fed72aeb5e42d105eeac53418c46e010401201b809f04c1dc255161337dcb730556132
- SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zh0i/+K6bxW:7oquVjnmg/+K6b
- TLSH T11BD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 c9c735f7fbbc9528854cbad45df0d83518c6dd9e22b39fbfcd62d723c64dffbb
- MD5 467c71e128d6e457f6c3708474db5994
- SHA1 86235bdddfdd92ad213e4655b407f43c8a17e366
- SHA512 03c3ca8eea4f3545c7bcc87261b3eacb8f9041fc7bada290025eeec04deba52a3782a3df77c0b3d1a154ee4ef41d439ee949f2e97199aa02cc416ed111916d57
- SSDEEP 24576:GAhGLmIFoiwtA5l7S53+051dckw+1MCO6Wm/zLPFGn8W:GAM1Foiq5u0i/+K6bxW
- TLSH T1E0359D81EBF945D4F5F3AA7899B59570EA76BCAA5E31C20F2160D10F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 6386c958f44efc82fb7edaeabeac2897498f42d86b484f362f44cccc7a29aa31
- MD5 666a234d55e3045011fbe263d7b164b9
- SHA1 7bd16b7e083553d6da9481cc1096697b498fadf2
- SHA512 bc20c33f92a4ab4331fbb1ad86e9d9da908352016589358dbaf49b3e6534faa72594546139b933184ea25eac704c60ab15ef47057e1076f5a39d097241f24e8a
- SSDEEP 12288:3mw5HEjsChNOBFgl0WDm+C0TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNo:WwuXOWV051dckw+1MCO6Wm/zLPFGn8W
- TLSH T19505F10A77A40CF9E9A782398957C532F7F2BC152A35D71F0760C65B6F37221AD29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 407e7c12d681e3fcb4b5a1f5bf3b4d29e8b6428b30bbe0781823e01797adc4ab
- MD5 8d77927e51ea186fc0206baecbad90c3
- SHA1 3eb87ad193ed30cb5bd2b597274147982f924518
- SHA512 5fed69a199e3ba1f07d80d9b5262c1b35ac6dc4e9793b98df42c6f81a8f7fa88b21049cc9670cba187b030da236222ca3ded196ef9494d6fdb976e61bdfcc11e
- SSDEEP 12288:obZ1IyxTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:wZu4051dckw+1MCO6Wm/zLPFGn8W
- TLSH T120E4120A379410F5C6E786398CF45A01E3B1B8B6233643CF0665979E6F37AE64E35722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 4093eed14dd6f7458d8bb1b44459de72302a31a4da17cc664153ddf15ffcf27d
- MD5 e3f6f8d9432547e1d59c912c27f7b024
- SHA1 84c8e75d68c811ceb2db2dae8db6b7886dfa4d51
- SHA512 85470c2205189e1798ad97c4c472dbe58c71a388d9ccc730ca052ed5981e93dd0a6377d4f2b332c091a6d69683f7c399c4bade9802d3771335c31f0a65f47337
- SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Up:FQRQyi36YOcPuLvw2gAf+PN3f/+K6b
- TLSH T1B0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 a8048005dd85d7f2a5b9d7d3714d79c8bc01a0759de646143165356ebba3aebf
- MD5 fde045c3026a7255e700c15268d6a311
- SHA1 4ecd7310d4ad8a0c31a6567e598f15d6f958fe14
- SHA512 16281e1758ac70eb88281030275c0269291f599590344b760779c668b20e98e332be645a87e6f46917d4bfaca60aa266a07d627fb0b6d21582e7f9f2fe6bc4b1
- SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Up:lQRQyi36YOcPuLvw2gAf+PN3f/+K6b
- TLSH T15B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 aaab31896e1e7ebe0df9aa9bc0cfbf569aa135b47eadc6f10b1a947978f740dc
- MD5 e50125bf3c93799db5a71b1838455df7
- SHA1 d1d5a190406b47bfa39faa23b045a2ee3fe26fd8
- SHA512 ac13964e78299cf4541f0166f040a9b0c5fd68df7e06761a39dbd97b3ed806643b80549ab4c9c8c891131f8712d5c4e650b5ba23fe02c6e3733afd139281e36e
- SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0o051dckw+1MCO64:868Qg55nhxeWu7PNU3/x0i/+K6bxW
- TLSH T13EB55933B2F200A9C44DE1769F4A973196D17C758FE0E3DB8515720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 968d142f7e81126d9be8dc3b947d109ffb0107daa19f915305c551ecc205bf6c
- MD5 c2b4e155b9cddd01174f35727dfc039f
- SHA1 93a605eaa232821a440819e747e59dcafc99e2a8
- SHA512 b4e7a7f714d2ee13ac82ffa0860f9329d09e31f62ed99401796a2855187855edca2812baebb1880b0f41ecc8c39b0e06bec9be0f3ac2ddea1f2b391db0f93283
- SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:iy5112gYy5azzVvD69nLKnhZu/+K6b
- TLSH T185167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 b59ef742ede99c6e5b6a2627a11c665ebcbfb2d04c45adb0cea7c927ef2ba56d
- MD5 4c1c8071e676252bdbcbee31d3fa689d
- SHA1 17bea4671454ed796ed02d7a8b9e988a4e622bcc
- SHA512 009d8be423be0cac5d1c984a34980ac5480039f0b3df1b98d8f717b2348f9213de6d4dedc6dd92eed9b3b6ff1a76407cae4ab48287dc97b44cc5e4146dd844b4
- SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glz0i/+K6bxW:mu6JmQxd2d3/+K6b
- TLSH T147D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 41359248ed25758a4f66aaa5be84763062549dba20746de07ab8887182a4f9f0
- MD5 9f23767287c8992a828951c49b8c5576
- SHA1 9b32b580897346d9bcddc4f80903a4de4ee344c4
- SHA512 8362e200528cb4ba56a2f5b02b4dc8ed448225f8e85c253ad4d131dd8292b11048cf566d27a7d0edd13745b1bd0b6211ae917cc5ff3011a2d027f798e51edbe8
- SSDEEP 49152:+1hpsNoJpF1A6yU44CwH7R4x30i/+K6bxW:+mifPVRg/+K6b
- TLSH T12FB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 a484abddc387df3a788ca385dd18136bf052b9dad69c5316ac08135f32b40e76
- MD5 5f0873216c69521110e022010e6a7166
- SHA1 e142c6d4756247cbef087efc830fb14408a2ab75
- SHA512 2111ec41b35aeea8cf4f29043cf81a8d8b5c4d119cd797f34ed44263cda09429b3015f0351b62902adbd7a2b8d5395aa904a086428a06dc27a92ff698e34b39c
- SSDEEP 49152:XSuZQIY0Be2KIRVtOnks6NMHq40i/+K6bxW:N5dKOi61y/+K6b
- TLSH T1A0C5BE03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 d9a63f7345fed6c4b133958002c7d946a07c82ce2d41ad77bfa6fe5796964356
- MD5 31892f5226e2c86055f08439ad6d69ea
- SHA1 1ba7a15edab002641ecec9acd842044d98c2df1f
- SHA512 78dcab91ba5183cfb8352c1e34bea3eb632e618a68e3420117f7a705edddeb0c681c63a927df679ad7de72c80f4785b3fb7c0582f95d67c0fd2962c9c225f51b
- SSDEEP 49152:ahtSn8EApI0figGgiDn0AP5wD0i/+K6bxW:bX2i/phc/+K6b
- TLSH T12A95BE13F2D900E8D05ED174C7568632EA62BC160B39A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 79689bca593364c5fd0d506e90a06882787844d8fafbc6439bc1007619567766
- MD5 5ff5d8c644f35c56ee1eaa6c25b8c92f
- SHA1 494909d2dc3742ca76c4bd331a8e77b1b627f6d3
- SHA512 1b3920c7d1d3165880cf3de05651cdf9014651ac55d553786a54345cb980fa79c377cb0cf878e75ebfd113d57949f3740ff28b55e48d79159e3071b0a971404a
- SSDEEP 12288:DyTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Dk051dckw+1MCO6Wm/zLPFGn8W
- TLSH T10CC4230A9E470A65CAD7CA324C6479807384DCFE667E117F1E6EBB4BE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 e1a6d8500576777db9906d0d8bb95d701808c35e3f6780c4c220e1d5756c8d10
- MD5 aafa59f66bb05ea2a0aa91ee8fc11df5
- SHA1 26bf3b8285d677c84bfdd2c6d751446c860fba0c
- SHA512 b5bdaa02568619a084c6a1a0155a763339c963c4894f024e55b1eabade702324e941bdc4a34ae5a354748dd56a53f5a189ab32ae69a496f124adaa7f27346d7d
- SSDEEP 12288:ZdTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Zt051dckw+1MCO6Wm/zLPFGn8W
- TLSH T141C4230A9E470A25CAD7CA320C6479807784DCFE667E117F1E6EBB4BE37993B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 33a2042662dad51e19f0337519e760062266f0b29e4018a478913c60ef055130
- MD5 fefcf8d21b58ae2e6697105bbffc31cf
- SHA1 72a2e7407af026d5f371ae2ee6ba6052ed5bf42e
- SHA512 f0e01c54d5baf2fc82aded0c19b6c147fead47b0a74ba282c3c7a7f54ceacc8af58766e556a35f2286d66cc0895c00d0f1626ee250465aabac48e9079bf31b1f
- SSDEEP 12288:qDTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:qf051dckw+1MCO6Wm/zLPFGn8W
- TLSH T13EC4230A9E470A25CAD7CA320C6479807794DCFE667E117F1E6EBA4FE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 d778a87327ce573ed1f716fec1ddce7d918d3b7bd49c810420f0efd094fb9a90
- MD5 f1d995b0b65f7ce7bd56b15e02726ee0
- SHA1 af874861b3d0af89a7e01f801af53e020fa95f2d
- SHA512 f36b5900ee4c604d09da0de69c95fc5294a41b37308cbf9612f2ffb7ee712f62311a4aba79e245d6c7622e0d022f0b776a8e44d0751fa9165a0a3fcee192b08f
- SSDEEP 12288:jVITauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Q051dckw+1MCO6Wm/zLPFGn8W
- TLSH T16AD4230A6F5A05E1C9E7C6318C74A940F3A0FCFDA73A13BF0E156A4F9B7667A4910B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 82f51e3e0f0215928cb1fcf43f9037e2597106ba62788510d6e4e366d875e6cd
- MD5 5e2634b4c7064e7cf409eaaa6bfc62ee
- SHA1 465d8f9c3a8b3808be4e2eb03a31abbc316a2611
- SHA512 00dd34f65a0c349631d8208d702a6980d25e8edf95ce3566f865a7fc6a74e5394b013b84023ecb2cdc8ad369a9efc6e8f07ae7e01c78f60e765678dd44d49660
- SSDEEP 12288:WgTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:W2051dckw+1MCO6Wm/zLPFGn8W
- TLSH T15CC4230A9E470A25CAD78A320C6479807784DCFE667E117F1E6EBB4BE37993B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 5a06dabee1668d022c1ab9f478c689af7bf2960829c927f3853f5ae37dbbba63
- MD5 c6e58a033f16c11c9fb089378fae83ec
- SHA1 f0b1dd64263c3758edcd162c8f126ccf6ce4af5e
- SHA512 a98d87e1ccb8261cbddc1d71e2f91fac7edf03ed5ac6478b76b330497c28434ea36d1c967492d8e48b20a7c55cb8f292da4bb9f794f718b024b1701143f6ea0e
- SSDEEP 12288:KJTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:KJ051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1ABC4230A9E470A26CAD7CA324C6479807344DCFE667E117F1E6EBB4BE37993B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 25b3404903ac1372986f75197ae2cc4c6b195ea3b9d2236961fca80fb8ef2bbe
- MD5 07fa098f894d869603c33916b9491ea5
- SHA1 48142d4c6c163eedc3093d284caac46132063b8b
- SHA512 a624c4d6e918fcec4fcb2685811f5e37061ea738d9f18452fb795ef08dfd437eb11d0334d06370e93ee31a3ba0f8300435dac56b0d84d25828283347e509f20a
- SSDEEP 12288:S1TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:SF051dckw+1MCO6Wm/zLPFGn8W
- TLSH T114C4230A9E470A25CAD78A320C6479807784DCFE667E117F1E6EFB4BE37993B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 156417d42c51f5dced8bdc30f58aeb3879018aa482933fb71687e79ae5c33e6c
- MD5 b9e37dea109e2bda3ff21f93f87afab9
- SHA1 fe9a21b99fcf34a6dc76f1650500002e2b01838e
- SHA512 b6e4a8ab937aecbfa514e686f1859f829b57d5b51e5b38c099b2140b2850bdf3c32edf3cef5ef9041b7242fa378842253ab9bfd20a486488a2e1a65074c946f2
- SSDEEP 24576:/ZMJzFVSON051dckw+1MCO6Wm/zLPFGn8W:/ZMJzfZ0i/+K6bxW
- TLSH T1BA050155B3500CF4DCA7823ACD659901E6B2BC6A0B70C61F07B8366B5F733A11D2EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 d96aab49304d6cf2a03381b6e234d0ed2244672b7dc6721de86854c4127e4cd3
- MD5 433d4b86ae4ae1614e272ccdb62fd85c
- SHA1 3b1f7d0a3938190de03aa374de325845272e69cd
- SHA512 a1bec5ed6909ac6f5e5d8a457689ccc2511adee114a1d32095a6e38b45c5122ddc04a5e36da34b2493024d289b1594a4fc1dd1a5ec7a1af14e141b7c3af4bda2
- SSDEEP 12288:8GTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:8I051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1A8C4230E9E470A25CAD78A320C6479807784DCFE667A117F1E6EBB4FE37993B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 b6b62769831ccdff6092d3e780f7de97090ec9fa4eaeaf1e04d08757fcb3b35b
- MD5 e4bbaae005f7f2346fcea9893358bf1a
- SHA1 8d9abb473212dec90517de6c8d23df30e5fef804
- SHA512 82da52c5a49e474b73e0e6d9ad9a7c9442b32c9351cf89b0f1d62c03ab3790cf699c1d3cf3acd0cd3c74e1b5d11dbb367e329fa989a4fabc8e1e05918dbefb57
- SSDEEP 12288:W6TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:WM051dckw+1MCO6Wm/zLPFGn8W
- TLSH T161C4230A9E470A25CAD78A320C6479807744DCFE667A127F1E6EBB4FE37D93B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 2389a887ac1a94017748a0409147387e6d899f7eb1077793d65d0d3976fa4f77
- MD5 97b791c5c439ab81c40941e6046dfe33
- SHA1 8081e3bb5a57200cd25d0b755376cc54edcdca3e
- SHA512 a6727cd7a7ac9da678527e44c87a353612c64305e659ae3ab2b65cbb2b0bab432d0c7e766ec58a5e647fdc65e3a695f91381fe127f5a8bd7b8faa6988f137e6c
- SSDEEP 12288:kyPz5L8xTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:9zyR051dckw+1MCO6Wm/zLPFGn8W
- TLSH T126F4120B77A220F9C5B782358C611E01F371B87607348AAF17A4577B6F376A15E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 e9467afda3c6ef81436ad5bdedff66eba8279cd743faa0640957faf6140a3022
- MD5 45b88bf456c41b93c78a544708b9c297
- SHA1 087afdeb557026874a4f23c6a6cbdf210c475f3e
- SHA512 f5338f4a9f68ec1cbdfc62a47d74d49e03d2fff46330fb6299209cbd91ff307694c2982e767a5e19b359ead62bc3b57582e9f63d7e062fbddb5a89b4d4a02f75
- SSDEEP 12288:UGTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:UI051dckw+1MCO6Wm/zLPFGn8W
- TLSH T167C4230E9E470A25CAD78A320C6479807784DCFE667A117F1E6EBB4FE37993B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 aca13c112cca3c117c3f784fcdfdfdcccc1f1d7dfb9c1076a9d518fe016324f7
- MD5 a53c733762f61688256dcf8dc1f0e028
- SHA1 ea790a0dc39fa088aa21b3d11f454f20801a7e0e
- SHA512 ef029daeabd7bc4606835883b9b28d59d9ce4db9b02b4473e348f15fbd60cbd27463e9534f2e51e48a9896d1056fcd998e6ace56d8b562eeefe12c91217ac9f3
- SSDEEP 12288:nGTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:nI051dckw+1MCO6Wm/zLPFGn8W
- TLSH T105C4230E9E470A65CAD78A320C6479807784DCFE667A117F1E6EBB4FE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 5d328fed04584002ec4c08b130df9bfe79434f055f5184f56c9ea42c6a86a5c1
- MD5 c4398026b067d011ee839cedc62a8000
- SHA1 27eab85abcbf126678d10f1c69ec930bdd263e0e
- SHA512 01e73d6e3a1d19c07ffb742dd36a3912e12b2ff06dc899ba92bd4968fa11c7341c5ee2de39a3277bd37596185d859a5eb339314403aeba6d03973adffd3b8655
- SSDEEP 12288:YyPz5L8xTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:5zyR051dckw+1MCO6Wm/zLPFGn8W
- TLSH T163F4120B77A220F9C5B782358C611E01F371B87607348AAF17A4577B6F376A15E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 479ad73650f61273590c5dfb41b47ca1ad4f4c8f440c53fe1681f4e5c083096f
- MD5 fefce1e41237261960553cb1437ae692
- SHA1 41cd6d2f940bc1112a8b2901be9fb217390840bc
- SHA512 4f713a865e35dc53c03916ef54c0daeb3a173e42ca37632ca0170fa330f4a14c0e8c3e1fcb6750a0d5324af5e1cc37976e5c93db84b601b25288adaa53418448
- SSDEEP 24576:JTuaLl3z0zDP051dckw+1MCO6Wm/zLPFGn8W:JTdLlja0i/+K6bxW
- TLSH T1D1050159B3500CF8DCA7863ACC659902D2B2BC6A0774C61F07B8366B5F373611D2EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 a884329be0fb3ca644355efd89a8e9bca798721ac54e7e716d119b1931c6a08c
- MD5 6953f9fdc4bebb4d3c331d1208dcaa5f
- SHA1 54fd40db3b2462c202a8afeafd2d3cdb88922a06
- SHA512 95df39f84e8a6bb6c921ae9ae12b89c7769fd1f4fe3129a0563678a8c3b84293c3687586526f846ecc749db9edafcdcb490bdaa72cbac089c8423f9668bedc65
- SSDEEP 24576:P3xd9CHKy7GZr051dckw+1MCO6Wm/zLPFGn8W:fxd9CHKyaZ0i/+K6bxW
- TLSH T14A25CF90F3E414E4F0B7CA358D755511DAB67CAA1B31DA8F03A8661A1F33AD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 4f244345b72dfc9360581609ac104e1b121e607e654f4fe75ab1cadc30a02613
- MD5 43e47b3debbb1e1685428fd935e5a2ec
- SHA1 27549e17685de2518801614e6ca9a4387f4e2c54
- SHA512 697497253acaf312a3f6de2ab1e106fc7d398decc4c0ccd2ce4a2b7047909678aac0372efee75918a03c05083faa5b9acf1e1f0143d27bcc26e1f313521a59b9
- SSDEEP 12288:jjTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:j/051dckw+1MCO6Wm/zLPFGn8W
- TLSH T135C4230A9E470A25CAD78A320C6479807784DCFE667E117F1E6EBB4FE37993B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 014cab5264778f3aa98747950b7fdc2f06afdd356267fc12429ba6fb7fc032bd
- MD5 5474de3a494a7d1df8e984216735e118
- SHA1 f83ff05a593395095735f20fdb67ad986ae9987e
- SHA512 a8e40078222e8009c8adec3025f3acce06aab104e5c5a6cc1a93ad22c7a1119ca55c4795ceb25c7cb89be55b3201a9e5a60b1e5bb74a26b7f39bbe1361e18c58
- SSDEEP 12288:PRTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Px051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1CDC4230A9E460A75CADBCA320C7469407384DCFE667A127F1E6EBA4BE37D93B0501794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 e2a13433ab81ee23432956de6edf4231a4809533b6d46ec6b6d0dbb072b3bfef
- MD5 fe26ce97cf0e9ab0e02bc55b4fd88548
- SHA1 3297c26e782c17392bb4a1505c90e9d491c2cc1a
- SHA512 e5a2648e0a566148a64b1374cdd7c45cf02255650a60a586c606fdec9b319f82ccef12672ba1ab19627f2640b753c0b1e9d3efd535bffc975183bb3058e480cb
- SSDEEP 12288:tsTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:ty051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1E7C4230A9E470A25CAD78A320C6479807784DCFE667A117F1E6EBB4FE77D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 96356acce58d0a7a4813295e9361941a33ee51150a710b49275bb2685c933b97
- MD5 2756a30bbbce1b0cc272f11b5d2fc53f
- SHA1 cc7e93f65618994fe815745079e8aa37ed107f58
- SHA512 d1385669c56ea2d2e6934aed25bfaf61344eb81e81bce61400e85f25765ccb8ae0512f84104d7cd996f9efe941b1c4762eb63b4ac89677a0069cd349974ec7b4
- SSDEEP 12288:TGTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:TI051dckw+1MCO6Wm/zLPFGn8W
- TLSH T13AC4230A9E470A25CAD78A320C6479807784DCFE667A117F1E6EBB4FE77D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 8c590a4731adc0a502853f9a15db475134b2f27ffcf4e122ecf7ab1b5a73316a
- MD5 a16a67f62db74d34cab6544ad568d9e2
- SHA1 62fc204513e5a102898af2b24ca06d58ab1df77d
- SHA512 ff54d8a840eaa96dc5261c8d475f41f421c67cc3f42de903590f24d7d442c8fb8b307454079d7954664bfc631c9e8f09593ed082728656ce976e2557e8cad4f5
- SSDEEP 12288:1jTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:1/051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1B6C4230A9E070A25CAD78A320C6479807794DCFE667E117F1E6EBB4FE37993B0501B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 2f88426c3361f08dfae1c9162cbe8667a74471ba3d80b8c502e76d9427c1806c
- MD5 c736e1a58a41f07a774c4b972265a89f
- SHA1 4b1f7ad3625e9b409c5ec0bdd13f594dbab84633
- SHA512 dece73c568d338d764e8274134fbf8dddca30103c6a5e364a70f1521a3b8caed47b2908eebabf00a963c74cafcb76fed78e60fce7ac502734da6d879999aa987
- SSDEEP 12288:p+TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:pA051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1A2C4230A9E470A65CAD7CA320C6479806784DCFE667A127F1E6EBB4FE37993B0101B54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 d9d6396e8ec0ed8409f75712d6de9c974e972957db85b53f84886478fc76c509
- MD5 31c69f133c74b43222267985d2612092
- SHA1 4565bf1ce15978278be243202a512e34b7be87b1
- SHA512 27772f40cd6e838eda0db4f3a0992404d4aa5aee984c09fbe7b0dc4f16853987dee0ef90ee5cb7d054e766e01e2aaf0f714c89ff423a6945d31c0ce658797570
- SSDEEP 12288:KgTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:K2051dckw+1MCO6Wm/zLPFGn8W
- TLSH T14CC4230A9E470A25CAD7CA320C6479807794DCFE667A117F1E6EBB4FE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 6d60ebd23c765e86b85865d5d8c7891c398dda8fbfb5e96e2c79450afa0e9223
- MD5 d8076a5661dcfef4725702398f020019
- SHA1 74094464794de44ca005c4c0d407534a99718a42
- SHA512 fefac9d7eadd6b6dfda9a240ad756c55168fff51096ffb8669f08ded79331c329cead151dff099a07a34231574251c3316504b9efe13451d442206f56365e48e
- SSDEEP 24576:9fwvOk9RX6wkyAIc051dckw+1MCO6Wm/zLPFGn8W:BMnYIc0i/+K6bxW
- TLSH T1DC35CF29EBD844E5E1B7923C8DB74606F6B178691B31C2CF025A53AE0E37EE45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 267c3cc5a0d8aca49d6d7676806da53070f7def56041f6983d0ca8ad40a0b933
- MD5 a2a08b4c5a0f78d276cb6b1373dbaccb
- SHA1 218e0e781d6e4139f67b46c74850bb9800be4f84
- SHA512 6c0544fc9f0eaf8daca506f05bd9ae479b18dec7a489cf8113ff359252b55890fd32c15a35444a8d58fab1751ce38d69e30d689ab99988b4fec386737165e23b
- SSDEEP 49152:aYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0j0i/+K6bxW:6ySzP//+K6b
- TLSH T1E2066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 9836318146e9e85993375e47a12e11e9b2e892801f1b357ddb85593e13255b49
- MD5 3f1486103841ea915f7421d84908bccd
- SHA1 51f0eb6eecca92d9a101a266cf81cc402ceb9d62
- SHA512 18501e27bce6167f6fc4c7c7d1a3aa23e5c40cf259ea4b4a4d75070672bcb4d91b9c308a6dee685cd9b07eb2fb1f67980aed915da7fd560314c205cf5d16679f
- SSDEEP 24576:x47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYd051dckw+1MCO6Wm/zLPFGn8W:x47JUQjairIhCnDHUPfF/z0i/+K6bxW
- TLSH T11665AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 1d504799690366241e062191e740c4ba254cbec4f26e14ce1c895d67c7372675
- MD5 c98b2a49ad576182de632affc5be1a75
- SHA1 df810fa6ac36c25b91f055949803a2d09ad7dd7f
- SHA512 37851346415afbbe8d6ea80df433b2b8a1e58f770f2e94b807b180d4ce6c6785b22fa057f922381325486b3d1709383d0c40a4145a8a009ff2b7a94688ab6e19
- SSDEEP 12288:WksfWTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:s4051dckw+1MCO6Wm/zLPFGn8W
- TLSH T14FE4F10AD25802E8C0AE9235CB555A40B3237C6987F1D3CF16D0F63E1F7A6A55DEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 16KB
- SHA256 3afd03fe16df039487deee02d88750d6801e84662f49f4e140beb04f01277339
- MD5 3bf6da4093f440de121aee2d0bb5af0c
- SHA1 e6a838345a277c9b4ece00fb510bdc83d22a3af9
- SHA512 6ead4cd2e645910b232a03558b58130cba7f42e853ff1ada48a62116e022d9483e2220873a306799f0bb7dca1d877ede8adc4fe0c71e50e0c212cf3cfb0fd082
- SSDEEP 12:KQrpwWEEEEEEEUrHBfEzBRMtrC0EEEuJ0KhcAq5RvUlIqwltXWkEEEGmskaEEENN:KQFvhCeJ0KhcPR0IqwlA5d
- TLSH T18B7222659F88ED31DF70657D94DD6FAC0B71D8344C82ABC3316521B01E5D1C94C10274
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 2a3801505ab638dcff089a8a4e4ce094783f3e6085d97cb20b9ebdba2c1a5507
- MD5 1aa1b046b227cb692a0cf186cbe76c35
- SHA1 36ac44ce26f81d0f2c47a29ff00b3897d8080e99
- SHA512 e051b2b2c9dd3f9a4fac808aa088380e565df55abd192b3291001c54c681d0d944b11fe2adb201c5bc07e496448f51d4e08cb823df66ce0eebcef3d2b71a1f7e
- SSDEEP 12288:S07OTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Dw051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1DBD42306DB4A0D21C9FB8A310868A9103348ECBD5B3951FF1D19B78FA3799BA4D21B59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 19e230a575c378140920beb383935a6c68d51e8f781201fa40ce928584317598
- MD5 1b5b828f0bca845b0196d0ab9bd2e6eb
- SHA1 0a49d8707c5b2b0291d7f98460905709108abfcb
- SHA512 74b89977025d52b1137bda55cfff1402bda995f32fb88a1ba9186ce4ff948a111218b4e349b8f277ad1d7c533824177e33c1b47d1eb8770c783830c47b1a255a
- SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYa051dckw+1MCO6Wm/zLPFGn8W:7gb4mBIBhGFd0i/+K6bxW
- TLSH T14065AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 6eea0d1004e1cef84d7cbe4ff41a6f1d2ecb8ceac54cfc6aad983107d0e71e00
- MD5 f4458ca846aa3a87315b59fa8174bc80
- SHA1 1fb7fbaa9a7b8c8f8c9fec9726f16f0ad7ef39ba
- SHA512 d5442e03433a55c88cdc83d1285f77ede891dfd4a9e59d9676afc08cf319480ba355754e5c12f41f94da7647e44d23c4b05edb1b9f8f077ff6bf65b9ea6f8e2b
- SSDEEP 24576:KG88u8FpJqH1nzria7/mN051dckw+1MCO6Wm/zLPFGn8W:x7ZFPqV6a7/S0i/+K6bxW
- TLSH T11A35F16577E101F0D47BD13889864663F6B1B8250374EBDF0BA88B561F23AE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 c98b6f125afb5be52ad38fa39ca51718b1dce148c1f0a2f8f56c266433bb7068
- MD5 391895d5c60dbec57d52df3d36280045
- SHA1 3ba5908cf614454597e713b0c993e903c9697b17
- SHA512 bc22b037b2b75debfdf208868993c9632d8bda5e024d6ed42935683c0a6f51434b218d8129ebb4f7ccc92da4343ea4e90c65e8a98c20cf49bc4c5e68cda145b4
- SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJ0i/+K6bxW:BG05lO43bW/+K6b
- TLSH T140D5CF6A62EC11F9D1BBC17CD9C64A0BEBB23825033556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 719d9af0149641d8378239768a33274fbf631493c92900b97d9917e1bbce954d
- MD5 2600cac5b13387fd19c3ba3b103b7197
- SHA1 80cbcd9011fe74d9acda6ff13f9cefec7d31f249
- SHA512 402b9263afb354cb88e1d75cbd5c09e0b5b38079942090845161d8388e6fda6d9b7bf00f373ed2590f510bcd80419e7c4d8ad4ffc367229a81588fec1810880b
- SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnj051dckw+1MCO6Wm/zLPFGn8W:ga5POZ3hJt2pasx2+mx0i/+K6bxW
- TLSH T16865BF5EA6F801D5D5B9D17DC583460AF5B1342653329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 355389c7f6a685b187ea99e35014d9dfea62c68495adda39d0e86e2a40e734d2
- MD5 54b8a4615c361db1ae417f41810c8283
- SHA1 236fcdfb6b91da81f845edf859ec1c901a323e6d
- SHA512 7f171c0ebe75a693fce2e18d6b5d6c786ab3238938ef3353764b4c134219987d9f0087eda1b33f3c1cbc1cc67500fb7ee1fe45f91903a8e8a7cab7deb5a53f80
- SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7Fk1051dckw+1MCO6Wm/zLPFGn8W:5Nc/zEOVHFy0i/+K6bxW
- TLSH T17D857B1623E901E4E5BBE1BE89779546FAB17869133086CF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 75ac2253f3b96823e78f341240324ced1586d44ef18feab31a405af0bf539448
- MD5 e16d0b11d73215e386a8bd1a0990c8c8
- SHA1 97d8945c1701728609e88d44f05d4a4d9d406e74
- SHA512 3286046b1871ecc8ad9df63b59f35c52dfe4b19636754c48226fcdbe3e33dc6210e893df75d52a8ea1ee5a186e70be3ee7ee9e8216de55ecc45c4730ad5e0abf
- SSDEEP 24576:Z3kNvNnaFeYhJNtmZBmn051dckw+1MCO6Wm/zLPFGn8W:Z3MwBtOmn0i/+K6bxW
- TLSH T19355AF2EBAB806E4D1FEC6758D238512E6727461073293CF5290C13F5E679D89E3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 bd13e826ca4487ad966d8a8ef63e1958a52bde6257c09eda058b85aa237d8a20
- MD5 47790ce6cf674bb97bc159f7fedcfaff
- SHA1 cf39a9c8b1d63696eda5c0e8df2c505405eccb73
- SHA512 69653729601ce493d68a3360674194281a8a4975a9cc54b3921f31b919ddf19c9bfe881a1d1a2391a043d45a70ff1fac81ec0b9309a3876454473d3ec37a23f7
- SSDEEP 24576:VPUr+NQZ051dckw+1MCO6Wm/zLPFGn8W:VJQZ0i/+K6bxW
- TLSH T14F05F11F66AD1CE5E676E13D89818709F771B866031292DF02E0817E4F67EE8BD39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 3e3b02aeb7f47d099f58e1b067333a41fce9699e998e3916204dc74b23e42b76
- MD5 b42586b89e573cca9c3b36e514c3d38d
- SHA1 b0060121fc63625889f7cffdb6ce12366490cab1
- SHA512 33c40fca51b162c20c7330af5d352460b6ed36bf364fafeaf53a2de6b273546966857017a388b2b1e41557878e68f620e570e1ab895d7119ff4d541ea54e3cbe
- SSDEEP 24576:HD3FHshBIYQgAE051dckw+1MCO6Wm/zLPFGn8W:HDVHeBIAAE0i/+K6bxW
- TLSH T11E25E13EEA5C04E4D57BC17C8A638A06E77138AD033256DB0694C1BA5F6BEE42D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH