d171ae8d667099cc13c25cb37effdff98efd1c3ec99bfff1d1004834ef265adc

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 14.0MB
Sample260804-j3ha2afh46
SHA256 d171ae8d667099cc13c25cb37effdff98efd1c3ec99bfff1d1004834ef265adc
MD5 192afca83d2d04cc0b9ee9efbd382ec7
SHA1 4e62574b8a0d8211fc41c8eb08839224e1a364f6
SHA512 a82dd6ba7644cf747c67f262164b591145c916ef35e558afb393bd6fa3e2cabce99b40793810982e562a754c607c0e531ba2f030db79ee75614e72ba17a31808
SSDEEP 393216:xwfBqWTd3LqxWB04nJIslV0PTmP+00EVkJu6s:qJzlxlW0lV3
TLSH
T1ADE6C007F64081F8C4AEC278C37B9532EA72B889452472AF57E45B112F2BB706F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2572	elevation_service.exe
4556	elevation_service.exe
5852	maintenanceservice.exe
2616	OSE.EXE
2056	PerceptionSimulationService.exe
4932	perfhost.exe
4780	ReFsDedupSvc.exe
1600	SensorDataService.exe
1144	ssh-agent.exe
2772	AgentService.exe
5232	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34fc5291c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1156542174\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1156542174\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1156542174\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_2068064971\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1267514718\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1267514718\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1267514718\_metadata\verified_contents.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_2068064971\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_2068064971\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1267514718\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1267514718\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ff4efcfde823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1e2d3fce823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000026de73fe923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d95d3fde823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df0a28fee823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069e468fee823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000476bf5fde823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c7f59fee823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029220640e923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2748	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	2772	AgentService.exe
Token: 33	5232	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	2572	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 2748	4820	2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 2748 wrote to memory of 4920	2748	msedgewebview2.exe	91
PID 2748 wrote to memory of 4248	2748	msedgewebview2.exe	100
PID 2748 wrote to memory of 4248	2748	msedgewebview2.exe	100
PID 2748 wrote to memory of 4248	2748	msedgewebview2.exe	100
PID 2748 wrote to memory of 4248	2748	msedgewebview2.exe	100
PID 2748 wrote to memory of 5916	2748	msedgewebview2.exe	101
PID 2748 wrote to memory of 2284	2748	msedgewebview2.exe	102
PID 2748 wrote to memory of 2284	2748	msedgewebview2.exe	102
PID 2748 wrote to memory of 2284	2748	msedgewebview2.exe	102
PID 2748 wrote to memory of 2012	2748	msedgewebview2.exe	103
PID 2748 wrote to memory of 2012	2748	msedgewebview2.exe	103
PID 2748 wrote to memory of 2012	2748	msedgewebview2.exe	103
PID 2748 wrote to memory of 2012	2748	msedgewebview2.exe	103
PID 2748 wrote to memory of 2012	2748	msedgewebview2.exe	103
PID 5232 wrote to memory of 2296	5232	SearchIndexer.exe	106
PID 5232 wrote to memory of 3420	5232	SearchIndexer.exe	107
PID 5232 wrote to memory of 4532	5232	SearchIndexer.exe	108
PID 5232 wrote to memory of 2444	5232	SearchIndexer.exe	109
PID 2748 wrote to memory of 5984	2748	msedgewebview2.exe	113
PID 2748 wrote to memory of 5984	2748	msedgewebview2.exe	113
PID 2748 wrote to memory of 5984	2748	msedgewebview2.exe	113
PID 2748 wrote to memory of 4780	2748	msedgewebview2.exe	114
PID 2748 wrote to memory of 4780	2748	msedgewebview2.exe	114
PID 2748 wrote to memory of 4780	2748	msedgewebview2.exe	114
PID 2748 wrote to memory of 2840	2748	msedgewebview2.exe	115
PID 5232 wrote to memory of 4244	5232	SearchIndexer.exe	116
PID 5232 wrote to memory of 1360	5232	SearchIndexer.exe	117
PID 5232 wrote to memory of 1472	5232	SearchIndexer.exe	118
PID 2748 wrote to memory of 1168	2748	msedgewebview2.exe	119
PID 2748 wrote to memory of 1168	2748	msedgewebview2.exe	119
PID 2748 wrote to memory of 1168	2748	msedgewebview2.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4820.816.2665451727164848263 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x110,0x7ffa76b25fd8,0x7ffa76b25fe4,0x7ffa76b25ff0
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1816 --field-trial-handle=1820,i,7221888799748980933,11713376803246748153,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2460 --field-trial-handle=1820,i,7221888799748980933,11713376803246748153,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2572 --field-trial-handle=1820,i,7221888799748980933,11713376803246748153,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3324 --field-trial-handle=1820,i,7221888799748980933,11713376803246748153,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=1820,i,7221888799748980933,11713376803246748153,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=1820,i,7221888799748980933,11713376803246748153,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4552 --field-trial-handle=1820,i,7221888799748980933,11713376803246748153,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=2026-08-04_192afca83d2d04cc0b9ee9efbd382ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4284 --field-trial-handle=1820,i,7221888799748980933,11713376803246748153,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    PID:1168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2056

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4932

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2944 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2944 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9e36279f762213142b6102afcad1178c4ac217446679f915a3b46b279ad043c6
MD5 754fd98280bbd295abd8297694f80cae
SHA1 c1e786863e27883559df7f02ac970115b3f705d8
SHA512 3761bd6d99f38eed28141e0ea6e03d3106a4f8d8c9c6e1a1e9bec242dda3d6dcff7b5229e9bb25e757161f06be747c673e092755d5c7f9a7b16dc7c3d5c7e026
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnQb5+Pl6bJTIZ5jdgpY:t3q6mjB3slgJTIZ5Bgp
TLSH
T128D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 571fce043392e905003fd3094d466e7a97566b9d6ff3b84208e6626bbe609ae0
MD5 63d088b582949c3390f41532f74abae8
SHA1 38d460660eceabe3ed0ab9e858bff1bb21567799
SHA512 8648f549409a6aba7a816e16eb21d116d40687335b7fbe2b83f0ce23ead4c136f4fca43002270f14455a542e648bd9a13006286ca5dec4f969820055e839eadd
SSDEEP 24576:/XYfDtczAgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:KtcOb5+Pl6bJTIZ5jdgp+
TLSH
T12885F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 57b24e4e18ef115d8e267645161aa11fe54f124c0a528db3d5bcc133effbbee6
MD5 fdc25cada22a57a4271c94dcaf32eb80
SHA1 37d6019930ddded7a3664a7cca7fc6fa8acdd896
SHA512 6259d6ab32825fa0e244e39f756155779cc90517d341df297b32744f48219ed9f029b9e458a3628cdc9cd141114fca119f107b52b6db01725a7a10ffb4b28194
SSDEEP 24576:U0Le5ji0hmxyrMVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:UPji0AIJb5+Pl6bJTIZ5jdgpW
TLSH
T12495AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 15a4dfd05448ca98051b0e6669743e9f0cd4daa3bd10bb7f853da30b3e5e2301
MD5 3424d60603315aa54bf4ca48643be270
SHA1 d37ec36049f40fd108b1f8a5f0055c5cd20b7ab4
SHA512 bfe877a83785502cad667e8a85f0ecd62a27a70456268a86dbb63de471439c1cd5bd4a494c855c0a67255748d5369c75165fcc07174dbb69ec1daf7fc8e80c59
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWj6q8wyu/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:A/ezSC6vUzPv+Hjy9b5+Pl6bJTIZ5jdV
TLSH
T145756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 737e417b5a851e99374104a69ab90e596888bbf4031a438f34c1542cc5066959
MD5 fb7a2ec7ffa49069ee1dcfe30314fbc5
SHA1 ee31c10ee5782dd17fb4a46f6543188b059b4f93
SHA512 2748a6a1213a94b0a9100ba8fe45660355706a1898fd5daf8a3578532886bd5d13354f910c03a6a8ff3801d703cae99707b38b2b6a74979b2d3a89fd16950f61
SSDEEP 24576:fVbqPb88hv/l+BUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:fVO88hXl+pb5+Pl6bJTIZ5jdgpg
TLSH
T1A1559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 af738e6dda64411296ade73575eaa8524d7a5116e646a0c99a786a2e23d51c9b
MD5 38614979de8afb0f87a54d1f513210f9
SHA1 711df96d17f3746de6d8db9296c5007f0c2180c7
SHA512 fc1fc19c3bb1115bf036d18c5b1af11735de7fc932484755daf67310520bb06bee6bd5e286272fb93872dfda2c80e4ddbef2a9b085ae4d6597c746501c4c8366
SSDEEP 24576:pFJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:Qb5+Pl6bJTIZ5jdgpQ
TLSH
T13B6523834B6A30C5E5AB1739D9CDDB00F879EF55CD866BB6C575282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 8301520ece217de315179c457f55633526ec7c378b1d8f649e9ece168d943fa3
MD5 840624333ed4f0b60be82d4f85d1c159
SHA1 0a5d27df3e71ded0d338601d77a92078161abdda
SHA512 4284c84b631d2af165e85c1f2f6522597dda5060a83df7422e90a0e84530c6ce30cff578707234d9c6235098c9393b17290268ad7bcb6d9eb384326eaf915f0c
SSDEEP 24576:hJIU8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:hJIULb5+Pl6bJTIZ5jdgpB
TLSH
T10285CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b180c5af3b431ae8dfa5d6727dc6cfae6416cb1912a23d3aab075a7dd5f63ffa
MD5 57309a34886640ea4e1e9fe892a62d69
SHA1 12357782f44cd366e5040349e6fe55f2f651855e
SHA512 9ff000dd6e3dc5414943efdff72b303f61947b167cff80e50aeba0e72705d05ca9598174981c1cfc21ae06fff702e4592cfacd241b95d6dd3a111e5c4f955d09
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THf:tQvGAdlCEL8c/WRNw5CUslgJTIZ5Bgp
TLSH
T1DC266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 2d749327f62a5f8d35ff30a1892d0b8cc5231052e4ffa66d385d7b81d1cf1313
MD5 7048de28ada2d8ccb1867e1d198e1446
SHA1 5c26b04710e15ed33af4b4143eeb0648d2236291
SHA512 cd416127c17300de5d890700509dd5042a95a8a23af7063a0b47b761a97f4d86afe11ff0b217114b65240d379923288baf007f8f89894d195d6c8a4e27635706
SSDEEP 24576:VOewsAj2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:wlj5b5+Pl6bJTIZ5jdgpk
TLSH
T17C85E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 317598f308c6644c085edbb715f795a2018464c757a7fa0f51cf48fddb445c85
MD5 c76d46090f3b73a7e26e32c061da5d53
SHA1 a0c457b9060d86080cc4da9f9cd6018ac045b67a
SHA512 fb99645d68e0b4831a145149c1bb435a34a5f488e501b65fe4b5f7adbfe7d84c207ffbf3ccb424b1ad29afd5693a963404c33171197f26391d946af2862437d5
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHNsT6p:1UEtQevvqc2W1cpV20I32Ns
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 64b3f77762e981b59b75e8b039ed4607098568ce2c0bcc832710673a7c4c88cd
MD5 47bc7edb150ed946521fbb96bbd3cf3d
SHA1 ef5f0fce0363b4e053cb855a5e0ca847664a4566
SHA512 853acfea25a3227c53fa33f851d368d3576aa9f0835a4cb7061a2a7befe75121e89c051dd192ebba877e8a9635aea56d8e3ce6dd6ec6ae2634ec427abaca4919
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zZb5+Pl6bJTIZ5jdgpw:KoqtVjnmoslgJTIZ5Bgp
TLSH
T1CCD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c8e54f0fb6f6329591ea983135a811f06514e0b2f23f84f338e667252a52167b
MD5 02488fc232b2a975e3c4ce91b040765c
SHA1 bda7e494cf564cd617297a2b134a35c80c48fa05
SHA512 08b2ae82e71ac3018a320c3b5c8b64ad8a577c3b706fe2dbd3876fb1193abe3f2764c8835c3361de814a388f71bb623ebf2a71261229078fb425a33636816a87
SSDEEP 24576:yAhGL6IFoiwtA5l7S53Lmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:yAM5Foiq5Sb5+Pl6bJTIZ5jdgpZ
TLSH
T101359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 703fa9004d8a85fbb2baa4d09d9ace38b7754b8b60990e2ca568ec874d4c0b0f
MD5 824e99d14552f2a744f7e0dbd2cd06b2
SHA1 7f02a52e70805b3e3bf61604370494c064abe6d5
SHA512 e6151bf89284f9e98ad9d704821933be14abf677ccb53b161aafaf577687e84eb994dd125cf16084d6078a75be421648ed0efd7da29dbee252e29d2ee244dfaf
SSDEEP 24576:mwuGOWSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:mwNOmb5+Pl6bJTIZ5jdgpn
TLSH
T1AA75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 ccc2d59d5ac14da57df2f8c049fabd0bd0735dc30b4dd79bc028d490e0c0e176
MD5 bffd5dc249c28138d2cd5ad136834b54
SHA1 fc8e51ff8c9ca62fe35bc734cfdeb070801020c7
SHA512 6487d129736ccd9806cc49782006ee70d8b6f67c97df05eca48c22efb7df5c577ac65a54ae78f81ecb91c59eb2338c3c32d523a72470b04ab72abbee4d6397d4
SSDEEP 24576:XZu9mb57GBiOl6a8JTth/RWZvR6wQQ92pN38:Jb5+Pl6bJTIZ5jdgp6
TLSH
T18565128627A830F9E0A7523DCCE58B01E772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 08b202e46952c639d76255ffecaee094536ec22e9a9d5bab8f539a6c3ab48ba0
MD5 fa63a62a15d35b453b5fde69bfb19fff
SHA1 0f02e874a7caf156d41cdbc64a579e4bd19197b3
SHA512 4f4ed5bd5f4b9a0c024f1711fa42aecfaee17f51825a5b88d728ab8d591511a521af9fd1851fe60042cbea32440dabaac6cc04656ee178a08b18e566ee00ad44
SSDEEP 98304:JQRQyi36YOcPDLvw2gAf+PN3jslgJTIZ5Bgp:gQyiKanX+PNTsT6p
TLSH
T106666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 67cf679ed85bbe21a3c68f10de2de1ae66b57ea4d5195804b099b33511332d5b
MD5 54640b8006d3535ae5a08fd2a97e7ecb
SHA1 359073d490ca31f2ebc6911e8c7993169eccb9fb
SHA512 525aed2225224f66c0eb80cda69fa1539fecdc906eca90c8d558395ffc97f44805be1250a796088f48a8b964737b59c654f12f69a7831fd8afba60e253fbd580
SSDEEP 98304:AQRQyi36YOcPDLvw2gAf+PN3jslgJTIZ5Bgp:XQyiKanX+PNTsT6p
TLSH
T189666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ea12a98995945e78c9cb77116a29a266d058f683f2512965040bca3087781dec
MD5 79a954dd9bd46f130e38db5ef1a489fb
SHA1 f687ea14fcdb727499f4f22a1b13dd8e56281c16
SHA512 e26f81f5fc2b1d007b0fd08d498e7cca01a4ce9642fd8f0d8036949009e8c6527a0aa087aa46d3f53a707596a551d454f2468a9ae3ad2bf4e0b5a8587ee84d3b
SSDEEP 49152:H68Qg55nhkeWu7PNU3/Jb5+Pl6bJTIZ5jdgpA:xthTRc/VslgJTIZ5Bgp
TLSH
T129B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 53eaa111d18af0548f997e7bbe859ffd92daeb188e00403f172820920675eaa2
MD5 fa5976cdf54b6067a41fa86477a630ee
SHA1 7653bb0223393813a675bd00a7337c60db951bbd
SHA512 ca7d58fe35a5cad54062739ea09822008c82ef97c66763bfe5db97f7f0e860ceab99ae9d6eefb8244b779f5748547bfcd7890b1eac526a34a8b1924fee3a6ada
SSDEEP 98304:Ly5112gYy5azzVvU69nLKnhZSslgJTIZ5Bgp:mLIHRWhQsT6p
TLSH
T162167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 474eb56c54f5d008a6d6df5c260acc5f078a8ede6cc33c3e153f43d84d34c43b
MD5 883eef3f37b6b5d9ef4c971caa927070
SHA1 6f9009335377f50d5c70a0abbce7ee2f05f23429
SHA512 28e14e497734897c188a1bafe7ff2f20e09cd0de22be8cb8fa6bdb05c61d976bc1b7238bbfce3e854c78b040852ca837e16ce13af6b400f3612f38a9b0c596b9
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glnb5+Pl6bJTIZ5jdgpm:su6JmIxd2dbslgJTIZ5Bgp
TLSH
T1FBD59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8f1353798e58cc36af5d853fca5426da38d04dc2220ba3b54179c51068061a09
MD5 709c11339682821ff8f7f8f09f27a8e1
SHA1 87937459dbb3cbc8781b36101dfa5da914c40c2a
SHA512 d68431da696fb3f8370076a5c751375c606693c6826d02f20353198f0f672506becca5858a7969d019ebaea06f2dbcf51b1a71661a6ff62089677a9360e50b4f
SSDEEP 49152:z1hpsNoJpF1A67U44CwH7R4xrb5+Pl6bJTIZ5jdgph:zmifPqRoslgJTIZ5Bgp
TLSH
T1CBB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 09b93c2e2bca0b7fdbb1c06b7558a4c2b62b16a0f4024e7f7b400d7d7c984f23
MD5 a332f4d73009500d25635bfe16f0044c
SHA1 2f483fc65cd657439e46ea3ecd2458003c42ab7c
SHA512 f373088f432ec4aff65fa1a5c0d9c8ac37d5731475c91a03847148e27a7c4a38b92421b656127ae1eaf2f8287c9c4235312f61839178296f80ecea6f4ba31e0b
SSDEEP 49152:NSuZQIY0Be2KkRVtOnks6NMHqAb5+Pl6bJTIZ5jdgpL:D5dKqi61uslgJTIZ5Bgp
TLSH
T1F7C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 af9a8c39da55a202619cc5d650a48385626dfe6c099fd2cca13c5f06fdab734f
MD5 d0c11afe8f915e7ca0a8a70820dbeff7
SHA1 5da1188937bc81c1cb39e2d1f6be9c1ea8c206d4
SHA512 042b605277d3d84dc3a71eb758c972558995d0076b8fd6c2e6ed0b6bac59f240d91adb497d996421c5634e63fc67c3667badcf6abf08294d172fd90956dac76e
SSDEEP 49152:fhtSn8EApI0figjgiDn0AP5wXb5+Pl6bJTIZ5jdgp8:OX2iWph8slgJTIZ5Bgp
TLSH
T18195BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 352115f66024a1d7acc69a8512797a3c9e849e9613b4bfcac0d73239728b7634
MD5 0449f13a776e9c7218be3e2c37aa4544
SHA1 e18142417b0cde0db378dbbbf71c1dd7d9b79cb5
SHA512 4bcef9736e1ea98c7bcb63527f87ea75cd5fea511d9d50b86b6fc75ff59e18edf7c4f3d1eae33cfee32728a3ef2ba2ed4982023f2e567d8fb108168eb9323cc4
SSDEEP 24576:Yxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Jb5+Pl6bJTIZ5jdgpi
TLSH
T1D66523828D6B20CAE09B5779D9C9DB00F87DAF56DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 febf688bc0a5d4bf9ef8afdbd6c2689d61d1d0b64f1f393e3afd7f2232f695c3
MD5 bec490e46cf88154084956241d95effb
SHA1 8d5fd3fa9eccbb6d6df377d5f93a67b09bfb0857
SHA512 70229d2416fbaa06ea338e3ad7885c31edade88843c297d40c3322a22a1c35a28a412d6a59b5f73c05627de4af71405da76263305e006fe547a0b8073291b1d1
SSDEEP 24576:lKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Tb5+Pl6bJTIZ5jdgpi
TLSH
T1996523828D6B20CAE05B5779D9C9DB00F879AF57DE8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0879920635a24544d337e1cd62bfbc6642225e4c677c46f42a2a787ed84fc319
MD5 a920b69b085061efeaadc360a0d81043
SHA1 8a836a187e2ed4bafe86f8bd1f3394bf8277659a
SHA512 0ee6762be105463a11c5a7513cf164d28dfb63fb3c9b21fd14c8d0c9529dce669dfcfe9825c3446db1a840cbb62ceec53b5e4ab087ea63e4369ee006c244c9c2
SSDEEP 24576:pkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3RE:lb5+Pl6bJTIZ5jdgpPE
TLSH
T17A6523828D6B20C6E09B5779D9C9DB00F87DAF57DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 495b19932c229810348a5ed3ed7a79f1c6c5d8844ddd2181eb2e9269e8148c16
MD5 a1c567ac0371d2d672197c2d31b822ad
SHA1 840e458983d2be6f32bf2c2d0d00a2d236b6819a
SHA512 f1039d3483ba2c2dc1cabd2cf10a4241420ce5958f2eed2e55bd11a142584075118a0aabd5711618b84b4aed332177d546960fc9097e8bbd203883defe6fd3f6
SSDEEP 24576:/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:+b5+Pl6bJTIZ5jdgpN
TLSH
T1906523424B6A20C6E4A79339C9D5D700F4B9BE96DF5267FFC675082BA9313887C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5b48f80bacff583b1ff3446e9a2cf41c32d03e0126d78791a62791fd5011c32d
MD5 49c3182cf2d214a8b0dc4adfd328eb9e
SHA1 34261c3ee4ef443a9b3b86467a6d66991ac7a2d5
SHA512 9b59b460855c23158a8b41c5aff1ca686196b509e53c7cfb39e4e0f031b73b7968d813aa4e365060566717808f325179b2873f66a347b74d56d169786ac7cb32
SSDEEP 24576:BDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:gb5+Pl6bJTIZ5jdgpS
TLSH
T1726523828D6B20C6E09B5779D9C9DB00F87DAF57DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 11ed6cdc43e446e4a31b8ca2576a3ad13a514ed4143b7cf56c7fedaa9ee7645b
MD5 4431a8f91c9b8444556710901ccb212e
SHA1 787c9915fc2273a5c813a1553991e94a63673bd6
SHA512 66b6eac1abc1b4b4b8a722e150e9917f45e8d93bd408340929f66732c92a31f42527c7bad00c83068a7188e0ab801bf3868b762bba490269c7e547a7cfc335eb
SSDEEP 24576:Oemb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:4b5+Pl6bJTIZ5jdgpR
TLSH
T1EB6523868E6B20C6E05B5739D9C9DB00F879AF57DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 17d4b4d84043f116f8e324648eeffbecfee6fdc043eced370ed268b0b7ff9b24
MD5 dac33880b11a48e9c7ecbc4d3a9b20fa
SHA1 cb0ceee55137272d394d33f4dc8f1a9610f64097
SHA512 68c3eb4496bdbdc7757bca25594f608d00b2cd3b82efd84396d29d601077e7ab799dc1978260ae1483bebc9d325f55c5486afaca4ef1d772e7fa01765dac373f
SSDEEP 24576:ximb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:nb5+Pl6bJTIZ5jdgp5
TLSH
T1F56523868E6B20C6E05B5779D9C9DB00F87DBF56DD8727B6C67D0827F234389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 598145d7a043045d9906b6367b9f8832f5864703edc0036c1eeb25a6245194cc
MD5 90b64f3969b5d08f8d194eaad96139cc
SHA1 f7fd2320c1ce9bf3a62917b648342ab7c8d07bdb
SHA512 d4b5ce8b914d62227ed6e4f3630660feebfa178ced93b13bd0d79b655c5917a685a3fa9d079cd736df529d05b66d8879168cfd54e43933c9e05768f5a90085e4
SSDEEP 24576:YZMazFVSOqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:YZMazfxb5+Pl6bJTIZ5jdgpY
TLSH
T1B7850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a78bf290d5898a00a438c7764e8bc89ab82397140bacbda3235d3923a7b75bb6
MD5 6a57659f51ee3870876849608f54bce5
SHA1 e72ea6da8d7cd8235dc09c36be99a31ff3fbea4f
SHA512 84d385c951878b7307b23b310bdab23f376a9b92429dd63daae6fd522ee75f81e69d59d8ed7ce49d006b1ee98ac6b9f8f5b02682175df2a32ec3cbb48a19ad50
SSDEEP 24576:gtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:nb5+Pl6bJTIZ5jdgpm
TLSH
T158652387896B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57D082BF134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 006d11e72fa52a9a2c243df2a710814de81f3ade6d578717dd4aa9a191908c57
MD5 1cf15c1dbeceef4a2bad872a8b044177
SHA1 ba6ffe650b112e3105ffb2a12e1bc07f522260d2
SHA512 534e575b39b3b0ea5b12b3f44de574f95baa2ecf340f8a9890f7b97735a719edaa939159c1a49554c2450bf38d478ec95b604458e0d7b8a4d3582974c634213d
SSDEEP 24576:B5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:Cb5+Pl6bJTIZ5jdgpK
TLSH
T1A56523874A6B20C6E05B5739D9C9DB00F87DAF57DD8727B6CA7D0827F134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5804cf9c649cff5dbc8324d7bba24d0b03caf5b545221e445c935625674d0bea
MD5 3874d92a9f57fa6e0ee5e4e8ed222679
SHA1 fe18433b546009d0c68e801a65d792d7c3e954d8
SHA512 ce105aefa20e5284a6b62b99fbf7a573135721c1b9b58240fe45d314e8a41cab673428e8c10933ee53e89ba4fc4b9984df4c20f5468c7eaf9c5ff0999ff8fdef
SSDEEP 24576:bzymmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:bGb5+Pl6bJTIZ5jdgps
TLSH
T1A975024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 65d5f08d652a95d9be89b0f7e3be8c8c65e6c9acf781cda14d28f1976dea658a
MD5 91e866ca91b7ffb0f6b78d3c6874b7ee
SHA1 a2b9b3be1a829f622440ec9f3a06f23e400ff981
SHA512 e9005d35c2703119d9dd851d20d9551b45e9aef2f8ebf8a18de0b99421b9d99be46a4f308f5458d73e971ba6ce0945e0e23ea67a553a44c9571390ad0d81629f
SSDEEP 24576:vtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:4b5+Pl6bJTIZ5jdgpU
TLSH
T13C652387896B20C6E09B5739D9C9DB00F87DAF57DD8727B6C57D082BF134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a78fc1a29d7811e24e2b7fbd2d5a7572bcc59031b8eecd2276025374a11c016f
MD5 1bc14f3dec25d58535393f173a556b3c
SHA1 612f5fa7fcdbed01fa1e83c099d3e19848ae0c79
SHA512 9b10b2d21c207ae615f28d10b6e585da617903e72f2c6ce07eb0f0c8030e73b0d80616bb28d3c134a70b26bd53b8d6f5b97a5cc2f5129b016722ea314c6559f6
SSDEEP 24576:Stmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:tb5+Pl6bJTIZ5jdgpU
TLSH
T143652386496B20CAE09B5739D9C9DB00F87DAF97DD8627B6C57D082BF134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 27e4017fd6f0e74c0393cb3aeff78463439cb925d209e2226e81ef1726daebd3
MD5 bf5efd25b8815ce8c21ae366c387c074
SHA1 fb5fd9045effe4d99e93b1a5f46f00b8782781f7
SHA512 aa745d66135496a828bc9533c4cb1aeb926d55c0dda5c730521460c9b41078f123ee0874ae0c0c3f554084e540c75964d3de4d44209994ea300f06609fba268e
SSDEEP 24576:pzymmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:pGb5+Pl6bJTIZ5jdgp8
TLSH
T19D75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 a7d0421dd740a26f1d7f75a89a360e32c8c2e86cee46b2e4eaa398133ecbf134
MD5 a324f1bc38a9bb8f730c204893609009
SHA1 e812a4ed7674f80ec638d822fa00cbde62243cf3
SHA512 978f62451b021d90708b93322e973677a4bb785cb140185a937e9383dfe23374a4345130089cb31758532a39405ec8e8bd87710f7974c758d88759fec9addd39
SSDEEP 24576:dT/aLl3z0zD0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:dTiLlj+b5+Pl6bJTIZ5jdgpE
TLSH
T11985F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 6c5973ddb7a80ae26edf698f4a89cad146930cbf67c68fb182717a6cd83e18a8
MD5 871b46e0cded6509363565c07b83f583
SHA1 4fddd71ae5b919a522c4eb864720d0b9ceaaa232
SHA512 0c374c18fed8d64dc600caf3b8b180ae37b70bc1d15d6e4964b2ece0dc7472d108b4827a4711ea492e2adf28d6aa6625698d7d05d5fc7a1eb0f158bdbb69f7f6
SSDEEP 24576:y3Ud9CHKy7GZImb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:UUd9CHKyaxb5+Pl6bJTIZ5jdgpH
TLSH
T19B95CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 2caddd5efe272de7c06dfd985599ec3704b15f466fc2310b9b731d8393186b33
MD5 e58062b34dcf09f35bedaac974af0a2c
SHA1 3eda6a71cab8dea955c2a76cad977b8e4ccd1036
SHA512 345bd7f100c41b76f7ab3fe3f5cf6e4408dd533a92ea1e538d0728bbf53b79487bdebde96d81d2759da6d0719c3dd6704551913e7ab3ff745b96baf3d10c7227
SSDEEP 24576:6Emb57GBiOl6a8JTth/RWZvR6wQQ92pN35:Qb5+Pl6bJTIZ5jdgpD
TLSH
T12A6523828D6B20C6E09B5779D9C9DB00F87DAF57DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 33d15c72adb96e28ea19efe11464891361296fbe42387e4763a329abde3f4551
MD5 5cabe4f5db612ccc29850a72887a728e
SHA1 db161a78486b4aa7a2828639a0a0a7c111b6561d
SHA512 d9f92cc373a4abbd19a465d9afac15388b8b529f96194d3a031b38dba31b5d39e6d221c0b01ba745d184ed629c0291a1004321e6bd20d750f6c1014419c8f364
SSDEEP 24576:afwvhk9RX6wkyAIpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:TMnYIkb5+Pl6bJTIZ5jdgps
TLSH
T13795CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 27a5d6305e8ed1d0f1dce3e0fd26dedd7c9cc358212b89f34c84020a264d7baf
MD5 a84b41d6354542a33b48ae04400f3836
SHA1 f1bbe391a525113224d5710a495aac6f9a75bfea
SHA512 a093bcafb31438edc4f8c3e2e8c9236a849d6d2975f0750dea96ce5b3d510fdedc52e3fd15525ff36f173ce8928267430ae43968732803c427bb52e153642fc8
SSDEEP 49152:qYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03b5+Pl6bJTIZW:VySzPDslgJTIZ5Bgp
TLSH
T19F066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e4fb785e37df38f8dead82fe6dd0d4805ae1dd3a52aae4bb82c07dbc1501b925
MD5 66176aae2ef0f4bd5021d47a9c56e463
SHA1 c27c35fa4e531897fea7705dc875022ed436ffcb
SHA512 91bd59f32b0421f8731770a503332105ec83a20f0ee817e776ce8b096727d61d18c2eebbf76b33a555ee10e915486ff2555c576cc6e0bdcc1ed1e19438691f3a
SSDEEP 24576:c47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYamb57GBiOl6a8JTth/RWZvR6wQQ92G:c47JUQjqirIhCnDHUPfF/nb5+Pl6bJTK
TLSH
T10665AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 dfabf25f0c21682244a952a041a3d1e810040f6478c048f48c5f31aeb471dc60
MD5 ae7e7d160e1b846e7a1115f78e27f477
SHA1 708061908e3cb7a7246f45f876012bac84266c57
SHA512 5ec9f1098621a2c268e462138980814d127945857026091ed7d9d2d98e4b086be6300eb65fe5d5cc604189a0d29e036d69a094d77fb56beabf4e4ed6987a7263
SSDEEP 24576:n9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3U:Ab5+Pl6bJTIZ5jdgpW
TLSH
T19075F14AC29811D9D06F6279CB858A00F7377D658BE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 952KB
SHA256 4367b8ea091657b59a8f28028459b42d413bee1cb6a6f2a5e9e953ea4386bf80
MD5 cd1db5df47e2ace4f07d9b30e39d6984
SHA1 8fbeb2f866dcd7b9e9b4392b4c09b7d5e435e929
SHA512 ceb947288eeb7e5341a9a8e384774f18fce966b48f4b4076b0c8185b7b281e0e2198b75dd8e5094c7735af4f628329c355da686b99e9ddb3bfb92b81db89401c
SSDEEP 12288:eItzpU3fy6KgwUKfJcZ/G5v4Bmly+/muAOCOkB9w:eItNUPy6KoKfJcZ/G5X/3AlFvw
TLSH
T17D251750762BD75FC6A944325E33D5CCAB707D01EE05AB0372C84B2FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 89eea78a4e99af3af898288b5ef2aac08a45ee5a8f497b5ed8bf0f00c9029bf0
MD5 d42f559a858cc4b090b45b74e337279f
SHA1 a3de3ee3b412d1b386c07b7ed3546e3e63473d34
SHA512 58e93e4d4570ec80d1947984fdd7af49ee53423e474ecf0050f7e816c2f13a184e37dc47295714fad41d1415fa855f207689f7d940088941dc607fff09a98cfe
SSDEEP 6144:xMvoZIKfJcZ/G54K+NDKYu58gjOoKfJcZ/G5OQQ9UbjFNZYih5zYQuM9wxvUe+qB:xIouKfJcZ/G54K/jKfJcZ/G5DZ9I+k
TLSH
T1E355A6815037E38FD1FB2132472A5B4DA764EC06B309AF666384453ED86BB65B0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 066aee0dfffd51af4139992b27a5800b054f0f3f9334751cf2ebbfbd1ab72ac7
MD5 1c681e74d92d8e24d4eadebabadc27e3
SHA1 bdbebe1970af64ec5c2ed07b84e64643c90c3460
SHA512 63cf29466f37931506eef28c9e1643d7c7b569a862d57e4f97a1aff9c91a50de7800169b85dc7810ff912e2c6ba6bc9631775328230275356d82269ed373461a
TLSH
T165D0121672425535C02025330002A2085440D91F410E401074289D9E2E580F00D26451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5877880d0d368391908fd97ec3710f528ee649d3e62fbf872355f9f5c90fabd2
MD5 2ad267b9c86a8ee917b1d0ff2a44203f
SHA1 eaaee1b5d80a65f0ebda0ccc0bb220601e0b8a23
SHA512 23600d252c5775dbf5f303d96edb2832858ca42dcae65d2be291b7f19306a469eae0157d979fd7e5021167e54e2db98f328744d9dd984b938805e17ea1422142
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 292d1ce54f5f2f4ead584555d49919c3fc56410416641f8d84d81bbb0066affa
MD5 18495aaa1e6bfee8cad244317c4e56ee
SHA1 e456b30546d59946a74b898c79a5f15d683600fa
SHA512 4a261dbf1e15094b55cab31c327d6d8df9f7cc4539c895539206ed4dc7085e50456e4df3f95bb60b28c4b2f6c3384a0e5fa1ba6d27541f1eddd1520c01520288
TLSH
T13DD01281EE708024F3344534AAD2203039FBC48A42834EE48CA034FA9EA0B5AB325642
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59acff.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59acff.TMP
Size 48B
SHA256 ec8b6ad3498923ef1f1868dee1a8e5bda0ce86d2a9189b53194d19f0aa97f003
MD5 ad67c0f6959067cdb323fb90e075283e
SHA1 585d37855e4b5c9fe7b78465d399ad91adf10826
SHA512 3606ca343f03c6c7e5a2d4b1e4e79b77bd2eb234690c215f4e428cc58141e78c9d691765406952dae5ffee1078aa87d5ae22f0480369869a426a19284f8e8ad4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 baa6d897c1a96e621017a4b148339dcba38935134a78169d1b3d988001cd1058
MD5 505aa98b65eb7e1675fa0ace74a0692e
SHA1 bff6bb4e0256ee0684e62cfae059cfee6f44b480
SHA512 89565b969db7dcca022dda2ae722313b5b95c3ca12b38b28fdb981a885e66d7e28c861e13d4268ee5cb31cf76caf7813e8c24f2d7b2b20b4d2482b2aec575f2a
TLSH
T1F6319CA2C2E4C76D8A456AE467347917CC2E051D92282D37CDDBEBEA67E1071E22160F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7d11.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State~RFe5a7d11.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
Size 6KB
SHA256 2a395f7956280f5f93918bfb7ab0877bc6139807206304d4c61a6a56a54c089a
MD5 1a19abaf522240f73af5ac6ec5d61fa0
SHA1 168c921fb3fc0d8bd28f2bbc85716683639674d4
SHA512 73f942bcb78ff706afc030e8905b1cc53b68490ecf61b12d31ca2a7b6009c7ac59932530fd69c49d8479cccc49594a621f4cd087f7ac33363b03eecff27164bf
SSDEEP 96:st2/d1PNGvqQb92kwo5h16Z0Ks7/x+6MhmuecJw/1eje4K+g528XM1C7K:stujtXonKsV+Fdw/QjY3G6K
TLSH
T17CD195025E24797B4CC7E119BA29BB17E2FA607261911E58EBF9562C04EB6CC331790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
Size 6KB
SHA256 1ce5b00effd2065a6aaeec8631c9b84dc04cb56a09f86c859ca6ca9effac816a
MD5 0f120c1654ad42d59b695c828540a472
SHA1 50569d6ef2a7c376c7f930db189db88584636e63
SHA512 fd7666ede56cbae22b699d0c7ee9e8f4d26e11869ec3b671fd696bb3ce2c0deb062b6437f0157199a807b6edd233cb4727fd7f765846c48a8ca948304d62fc83
SSDEEP 96:st2/d1P2vqQb92kwo5h16Z0Ks7/x+6MhmuecJw/1eje4K+g228XM1C7K:stujjXonKsV+Fdw/QjYMG6K
TLSH
T16CD1A5425E28B97B4CC6E119BA39BB07E2FA607171D11D58EBF9562C04EB6CC330790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59a677.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences~RFe59a677.TMP
Size 6KB
SHA256 3c629766632d83258c25ddd71d077b6761e281ffefc75903641d5c2442dcc6e1
MD5 78361a78106399b197c74f767b81a358
SHA1 f6e3e51884b9fe955707772185e8ea5fe3d06fbb
SHA512 7a2460d07baaea9fa16a2c71428f05589ba49803826facb0881edcd53f8b3cae01c76824ce54d7621c8dd45b763c70e20a76a720183aeb9bc8d5fa3e4182fda0
SSDEEP 96:r2/d1P2vqQb92kKdo5h16Z0Ks7/x+6MhmuecJw/1eje4K+g228XM1C7K:rujjponKsV+Fdw/QjYMG6K
TLSH
T139D195425E28B97B4CC6E118BA39BB07E2FA606171D51D58EBF9562C04EB6CC331790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 003301a7ed577304742e08cdf7205619ffe160ba6b5c6f470c4719cc80cec401
MD5 747a8c52e64a77cd4b71e2c27d5a8cde
SHA1 cc62ee0fbacd97b887917cbbbd6f8c34f8358a7c
SHA512 b324f9fe51a27241fc7233ad181d7692b0e2fd65341933bc03c19870726017a50ebd19b29a3f71d02741d1fca7fdcc0a9bb538b096a09118b91bea74b24b163e
TLSH
T19F51D8737920BB37DAE253043D462F13AE7990A296561F61E5DD2B0C00EB55C2342D3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 402deeb52f1b840fd1bd26b1345be5234e9c4dd5da19c407b326b381921b1c9e
MD5 d42c6fa525db77120f434f5acedf6e28
SHA1 30bb0ed99d617efbcd3419630f23e63b67de5655
SHA512 32c8dbb7cff6d7ba210034d009501c875b17149307b7032227459babfb7c9c81f7d1c0e19978143c255faff0be928ff1b85a4f12c7ccebb653fbd29859583039
TLSH
T14961A5736974E93B8EF2960578862F06B7A95063E5953FA1D5EC1F0C01EB2981342D2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 64fce111e0640094157493892eeec4bfaf8797f3d4187aa7e1250fdedadeadbd
MD5 5f804ca604386d66ab5eed6d192988dc
SHA1 b14954ed8dae955f2098a44b94ce0c873f98cf8f
SHA512 846fad9e31b505a2650c5c455bcbe7d0ebb99eebe2d584841e8cebdef11a1ed65850c6fc9ac9106e5bdca6fa79de97555cc437793ac0641673a11a2def83bf00
TLSH
T15281A622A574B93B8DF2D605B9463F03B7A49067D5953FA5D9EC1F0C01EB2881342D1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 15KB
SHA256 c9c27ad5cebfbad40f10cbb7f3f78a89703b0ebac7744839e0d92d611accbb17
MD5 131a1c1d4ba1697dc11644f7cfb1801b
SHA1 f61d3528f0d3e8d2408db8c625da05c3943e83a5
SHA512 c32df48e2e9386f415dc089c3245647941a5ac38e1e229245e468309155d95cba5cadf5d21098c08380532f8c01987895f39b761251ff39eba96ef3c260ec8a7
SSDEEP 384:jj+aQikB+z/xvxjg/qhEwNBSzQuoCH/d6S7u9zs:jC/UxvxjgC+bxxF6S7uFs
TLSH
T10572AF2796797E27E5F7E604394D0B4FDBB894B391822EB449AE6F0C06D72D8130291B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5952d9.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe5952d9.TMP
Size 1KB
SHA256 9961fd9f9ccde55d74b93098ea019973c838a4eed26ffce9016906add12775f2
MD5 cab8ccb9193b2e64c2645a43bf4d9c0c
SHA1 db19021c0ce40db822ec254569929f020f91a725
SHA512 60fadfc846fb7cbd1d31774f9e877f3f410f58179ad8c101db4bbf1d5b0722a949c29aadbcdbdbd119f3954ced356ceea73205f9c52c88e099d6ce80192bb6ff
TLSH
T1902170B3E1A4AB36EDD123463202AF472E6050A782210E00A1DE6B1C01EB25C5656E3F
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 781cbd584e931a81de21bbc30501427ba1011b18dafe406e52ccaf912bb44e90
MD5 99425793a8c7d75d01356a0550ca6f01
SHA1 f2c08a1f23d6c8cce7bc40f86180b586431cb8b8
SHA512 a92e7f8a2e93aec4f54538645f627a5b083affd9b8088afb1af3fbbd7303a48ba4dcee066be65c4609b47ac9279115d2c711d349b93a78adc52aca704d342d72
SSDEEP 24576:61mb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:64b5+Pl6bJTIZ5jdgp8
TLSH
T1D66522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C529142BF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e21cbfa99b95155a0d6f866d56315c1be1b3e4ab377cd36e9813d63f19b5b631
MD5 78b261f089334934013f4042afe1a839
SHA1 e795a663e304feb09021d123e1a7d2dd055a6bc9
SHA512 422a7f3f6a0f2a2cc8edff104ae2ce3a9858679c47057a688b4a059f59733c780159165ea1f23f3b700f2817b58f9a52c667415c64b96759741254f7eca96a1e
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bY/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:6gb4mBIBhGFFb5+Pl6bJTIZ5jdgpA
TLSH
T159659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e5393847db605bfc1ddb99cb9625d72cadc9ca26307da8b156389cc684ab3756
MD5 3c3997f9e872beac3da7642f9e700bd2
SHA1 1552a3b4f1b4a800b3298f7d6132a68321e0ba83
SHA512 0d6de1f6c978b4da45fa9ec3ba74ee234c37c06714d74f7c2c115ccf9c5032b3d44613416a1295f33b31324ec5cc5f89b0f4f13dc9afa3f7c6dde6ce53dd6803
SSDEEP 24576:yG88u8FpJqH1ozria7/mqmb57GBiOl6a8JTth/RWZvR6wQQ92pN39:p7ZFPqVXa7/Wb5+Pl6bJTIZ5jdgp/
TLSH
T19495F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 968e5e9216a5fdfab39fcb8e952d37a53098f13971de9601c27c3e986a53ebe5
MD5 6bf1586f53817c2ebe3d11a5269094f0
SHA1 635f17744595a656d004d327175b0469a28f409e
SHA512 7b2ddc9edc096466ec4403cfc3bbd4e89e6df71cd2703efb0eb4cb48faf782af1120e85b7c0b6555964b164d3dd91739de69ed649a84f9d0baf5ee8a7f5c233b
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBb5+Pl6bJTIZ5jdgT:DG05lO43b6slgJTIZ5Bgp
TLSH
T15DD5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 43d24c348c952f00a6ecd264932be0a6f5fd8cfcf4de9dc3b8194c8e471d6c8c
MD5 efb28b9d9ab66d1235487779b11d9554
SHA1 314135f6ce23867a100f998b5d38fa2064485e51
SHA512 3a07d813fd1c62e56bdf7376f945de534f342bee6f45a0765d00bc1c3157ad71d3cc51050a19aed78b1c2c8875f1fe01e6d92e83aba405847411cdc99a0151bd
SSDEEP 24576:Mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnAmb57GBiOl6a8JTth/RWZvR6wQQt:Ua5POZ3lJt2pasx2+mJb5+Pl6bJTIZ5n
TLSH
T1B965AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3f7e15f0bd0efacb202d47f137fe405a64025d2f68c7a2f916e51d8cfe5ddec9
MD5 76abd0bbb40f00782a908bc645d675eb
SHA1 ac70eab62e5a80ed6e172c77a28a04c44ff68a7a
SHA512 ab80f8c205b9c10cb67996ca8be62383272595015fb54f7f960d5516b0416b873fff327be611c08056b8d9cb44e389146dee8b5116121dc2dcf61755467b1d19
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7Fkymb57GBiOl6a8JTth/RWZvR6wQQ92pN30:UNc/zEOVHF2b5+Pl6bJTIZ5jdgpC
TLSH
T1E1858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 49e3ed34226a0d3d7c14370c677137dd8086855659c43a55e3f2caf940950723
MD5 4f7ae52d763fd19e23f13f18907ece91
SHA1 95825dd9bb06268f70a76fbbe80a1d615efff891
SHA512 4dfc9f7075f4ed97250f3576546cf801da95339fa9dabca53d9f687cb2eea16a2e06ef6dbccc596156c6f6aa3b2bd1c89d9afb21212e0d8783f32673542c71c7
SSDEEP 24576:zzkNvNnaFeYhJNtmZBmsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:zzMwBtOm7b5+Pl6bJTIZ5jdgpl
TLSH
T19755AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 02d88d50a32cacb2ac51acc9f499737f61a3612c839c88698c4b4ea5d0f5a23a
MD5 ce4fd510c88faf73611ce9351648e112
SHA1 f3957e9e91d9f4cc08aa17192be189fc69d7a654
SHA512 54285cecf546e504375a6f0de820f4973711fd3e04959621de3c05fb7710f51ab4f78fd41ab7c0929464a4c0001e2291d6864f5be0574cc824b42c0fa691c83f
SSDEEP 24576:qPUr+NQOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:qJQxb5+Pl6bJTIZ5jdgpL
TLSH
T13575E11F26AD18D5E67AA17DC9C68709F771B862471292DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 ee5c6a6a4f65e00163e6fb82362fa24e997e2db855c1c7ecb5159adaf47058a3
MD5 41b2a94347a085f7262337c805edd7e3
SHA1 3092e62f66f5948960e3b7fd6160f69954b7732b
SHA512 3a98fe66485a18f0d785cabee581b95d85ad317e3fb7e1d448fc5f34834a84bba339408108642f48e78a139aad8ce4f357d1cdb948c825bfd18b5f2c6ed1e2eb
SSDEEP 24576:uD3FHshBIYQgARmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:uDVHeBIAAsb5+Pl6bJTIZ5jdgpg
TLSH
T15A85E17ED65D00E4E47BD27CDA938A06E67138A9472266DB02D481BA5F2BFD43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1144-525-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1144-132-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1144-126-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1600-487-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1600-481-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1600-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1600-113-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1600-119-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2012-505-0x000001C984E70000-0x000001C984EE4000-memory.dmp

Download

memory/2012-199-0x00007FFA98E90000-0x00007FFA98E91000-memory.dmp

Download

memory/2056-79-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2056-85-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2056-408-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2056-77-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2572-124-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2572-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2572-25-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2572-26-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2572-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2616-73-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2616-66-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2616-363-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2616-67-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2772-290-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2772-300-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2772-302-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2772-283-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2772-284-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2840-713-0x0000019FA1CC0000-0x0000019FA1CC1000-memory.dmp

Download

memory/2840-711-0x0000019FA1CC0000-0x0000019FA1CC1000-memory.dmp

Download

memory/2840-715-0x0000019FA1CC0000-0x0000019FA1CC1000-memory.dmp

Download

memory/2840-710-0x0000019FA1CC0000-0x0000019FA1CC1000-memory.dmp

Download

memory/2840-706-0x0000019FA1CC0000-0x0000019FA1CC1000-memory.dmp

Download

memory/2840-704-0x0000019FA1CC0000-0x0000019FA1CC1000-memory.dmp

Download

memory/2840-714-0x0000019FA1CC0000-0x0000019FA1CC1000-memory.dmp

Download

memory/2840-712-0x0000019FA1CC0000-0x0000019FA1CC1000-memory.dmp

Download

memory/4248-227-0x00007FFA98E90000-0x00007FFA98E91000-memory.dmp

Download

memory/4556-304-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4556-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4556-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4556-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4780-475-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-568-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4780-570-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4780-108-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4820-107-0x0000000140000000-0x0000000140E15000-memory.dmp

Download

memory/4820-12-0x0000000140000000-0x0000000140E15000-memory.dmp

Download

memory/4820-6-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4820-0-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4932-90-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/4932-89-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4932-95-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/4932-438-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5232-529-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5232-306-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5232-312-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5232-305-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5852-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5852-44-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5852-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5852-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5852-64-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5984-611-0x00007FFA98450000-0x00007FFA98451000-memory.dmp

Download

memory/5984-612-0x00007FFA98620000-0x00007FFA98621000-memory.dmp

Download