e5cc87f30ac6210977c3faaf7dc78a66e5aff6797554e2f2c5f1437a6f72362a

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 5.5MB
Sample260807-axe42sthrg
SHA256 e5cc87f30ac6210977c3faaf7dc78a66e5aff6797554e2f2c5f1437a6f72362a
MD5 890b3b5e49b7f54a374f259209211935
SHA1 a2a7dfca11dd15ec36e843349da5b26791a4a21a
SHA512 a35846f848f0cfa84dc887dd026b1f812624353629d906c5b5affbb05cb0c9bdff3f8c59b5705596094734240c492a2a1adcef0991534c009f53143a7ce01a33
SSDEEP 49152:5IoVZrH+NXYD7mpXMvb7/M+8hj65z78IyVy9X38iDUI7IqyBLUyBp8gO9Oy7xDDa:XZP80z7SAx3dPmTwdHHMgDdLm
TLSH
T196468D53F3A611F8C41EC9B44B1E5522A9747C874734A3EF0AE876221A75ED86F3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
688	elevation_service.exe
4344	elevation_service.exe
248	maintenanceservice.exe
5644	OSE.EXE
976	PerceptionSimulationService.exe
5628	perfhost.exe
1540	ReFsDedupSvc.exe
5016	SensorDataService.exe
6048	ssh-agent.exe
5344	AgentService.exe
5832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7bdf31fc8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034cc82ae0426dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b93c3dae0426dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000597763ae0426dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054f31ced0426dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000556824ad0426dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d41680af0426dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdf2feec0426dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
688	elevation_service.exe
688	elevation_service.exe
688	elevation_service.exe
688	elevation_service.exe
688	elevation_service.exe
688	elevation_service.exe
688	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5552	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeTakeOwnershipPrivilege	688	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5344	AgentService.exe
Token: 33	5832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5832	SearchIndexer.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeDebugPrivilege	688	elevation_service.exe
Token: SeDebugPrivilege	4344	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 4884	5552	2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	89
PID 5832 wrote to memory of 4812	5832	SearchIndexer.exe	101
PID 5832 wrote to memory of 5672	5832	SearchIndexer.exe	102
PID 5832 wrote to memory of 3328	5832	SearchIndexer.exe	103
PID 5832 wrote to memory of 2340	5832	SearchIndexer.exe	104
PID 5832 wrote to memory of 868	5832	SearchIndexer.exe	106
PID 5832 wrote to memory of 5856	5832	SearchIndexer.exe	107
PID 5832 wrote to memory of 5836	5832	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-06_890b3b5e49b7f54a374f259209211935_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe" --statistics=https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=service_unused,-brand_id=unknown,-error=UNKNOWN_COMMAND,-installer_type=service,-launched=false,-old_style=1,-old_ver=,-result=0,-stage=error,-ui=30B9A205_BE2D_472B_B2C7_C715122ABEFE/*
  2⤵
  - Drops file in Windows directory
  PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4812
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 67459d6fe8b8698ddd3b83a1123c700c6714bdbf931466ac6b14812a0992b221
MD5 7d7d14d9d58e684ce016a7a9e1cbf3cb
SHA1 c26a6969cde1acab1d47a07507f1ff46291080c6
SHA512 d82151c1b6f086cc9159848ed50eac6de08cbdd7291c216e7c96e8b288af0a7df305e812f8aec04254310f5b94ddb49a8d3ef7377dfa5878811d3cd906e0d7bf
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVQ/lFTjN4:A3q6HjBRLm
TLSH
T1EED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 5755efcd0c0125a1ab626d0222561152354a80ead18ecd643471391458210906
MD5 67957b2ffd1fe8c8c3e5aa7a4d75438c
SHA1 5159d96069ad9b96ed17bbee3d19fcbc4de1fd6d
SHA512 b7399cf8c92233067deb465a5a8eaa16c7adc1d7efccdb2d209ce039d322a30109fa37f82462f491c4e9adb574aa1761dded7f3f5cc8d9c107bfc6b29a7e9ca9
SSDEEP 12288:L1XLsswWkxy2lRq2czAsDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:xXYfDtczA6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T14775F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 281a4a63d3eac5c91d070b6ea35517785e21f2bbcef6a6cf3ee5f26733e6e003
MD5 fe7ffcfe849f68afa495167218a3f64c
SHA1 9f1e05a85b569b631b6e2d13f3251e11d93436b4
SHA512 27aa2bac3a81343b3fcbd911ad36aa8b6f1cf3c489471eec0b7d314b50e489d7be95163c88b824c8283e54218484eefbfaceb1bd0a43b3ddf2d1f27c34611576
SSDEEP 24576:F0Le5ji0hmxmrMBnQ/tbw/2Mkjy6Fr7g0o:FPji0AoEQ/lFTjN4
TLSH
T11F959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 853e6d899ee74e5d211de1930d8e9b4bf66f45751149ac809e74b54d1d4f34d6
MD5 2ae8a35a25ad926fbe12e12bc8b174f1
SHA1 b5a4f2c6445987c71cf5db6101c865cbfe93402d
SHA512 084176e2fcfd419caa3f3f52130a8cbea9501ce337d1b01f39a445df9c258e0128963fe16c1881b2457015b389711a789fd654b9365ad58d198dada4e1054a3b
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyujnQ/tbw/2Mkjy6Fr7g0o:z/ezSC6vUzPvxHjyYQ/lFTjN4
TLSH
T1EB755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 27b7c36ec104e0f4acdd026b4baba93f5c1ac29e8c6d01756640c04f31f99e65
MD5 98a3cf87a0ce5ce0e54f94a89924642d
SHA1 4613ce7312b1a5f0cdd4c80d9bff6c7c9d1d87bf
SHA512 421c226013e6a4d29abb8ba2d7c71c7a7d222363af21c14826619fa6342ba3ffc47c8af43b4e64999013b80f91d2b10286ef06bc5aaf2b5a7870ae404ba1ac10
SSDEEP 24576:4VbqPb88hv/l+6qnQ/tbw/2Mkjy6Fr7g0o:4VO88hXl+VQ/lFTjN4
TLSH
T1AC559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 3759e7df1fb4496bcf5a77a200207c953d14622cc8036e7db6ec485f77e903a4
MD5 7a9bcfcde4613a4b0a145401ec4906a4
SHA1 b043a95cb714e436d54594f3df0fa4df31b9ea19
SHA512 ad2df72646bed4a3db34491ff7adf1c1f80341d58f708fcdf5e51f73ce0e7ad0f994a58ee171016d77507974dad584240406da6e58dd3152e101f231981ba849
SSDEEP 12288:/99GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/9dnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1295523696A24F88BFF2B06F15CC38582AB7B0DC1AFD0A74E6744322D853C39456DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d031054e69f7935d6af7cdcbbd0bfe55a9d357d2ff82e212d0b45c556b4e0617
MD5 505a245209acaa875c086c70fb8b45aa
SHA1 99bf4803d6680ac1bb2f7a58f8b1b9f2717bc887
SHA512 0f8a32510059bf17828823d0302ecff8cb171e0dccde4df5203e272a381e5b9010cdf6be8e5c09b2833fa08fa9f7331066d80d6285261f54bbcd5df10a3e4cea
SSDEEP 12288:beBNUbTVO86UCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:bJIUCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T14475CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5b92ec4efc8e9a390a4f0d1112746f0febf011d6ccf54d4709a73289160f5899
MD5 a6f9867fb88dff79be4d618f4e39e511
SHA1 41a21454972bf6bfba42dec8b8bd5f3dd00dd67f
SHA512 5acbb5c6da612b7807cc519809a9018473d17e49c7914776c6267952db511a45aa861751ec7437981fd239f6ff4462029a884121e8705aad881d1e371b59fe21
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:3QvGAdlCEL8c/yRNw5C4Lm
TLSH
T170267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 46403284561c095815d80898ab44a827f964c3ae4d58d820e499cca90a733511
MD5 6396603546dafab56f0523fa44ac52ab
SHA1 2cdaad8b96f8ea7256452266de225a3f7dcb31a2
SHA512 daae69796e29b52972e7ab71f9efd375965d494742f6778b612f5f100c11e77115ec038583751b6096af47dfc2e96202a396b7d63740a46a09be34b6a047671c
SSDEEP 12288:6AwSfxL/2Dc3kDLLmt0LDQewsAjUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:P5ewsAj0nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DB85E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 06e2cafd56c49bef4b4bf92d473f0a54cd37e96693a8e3bd1c95beef41e9f2e7
MD5 cf5de3a0bd0780150b329c2434475239
SHA1 cd0635aa2d61daaa79b1a583d2060693cf7e70dc
SHA512 b7962efb0cb741c4b95624e47bed4f90654bff54b3dae69e90f3388aa75bdaa183640253fb065abff143ae336122f198202ad205d3ab622d46a35a17e8a51d33
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHfL:/UEtQevvqc2W1cpV2EI32
TLSH
T16D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ac36e30c0755002d7fb77d4ced867979cb8338ec808ab6e9c5ef47015ef96edc
MD5 5bc97a0ad2b0ae183452875924666c99
SHA1 3a2117d4024296401b6d79f16395e8b91ea94de2
SHA512 246962e4318f60c72220d09cd2085507b18a6460610854e7db3d34b1e51355bba593096e60af2e934b595cee4dab042755f7cefa4e04315422b6b31e65850045
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zUQ/lFTjN4:toqtVjnmsLm
TLSH
T121D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 49367b12c957a9060810b352d35f78ea147602b969d525468ace7bb3b1b235eb
MD5 9b6e0147e1c024dcf83c20fbc330f1f2
SHA1 7c052c7897a5858a6eeb05bdf0a82d0e1018e803
SHA512 520e8c48377d8607c18c163bfea48be364360360ae0d795122e2a5a5c021089483bb3f93fd35776192c1f2d35d81a2dd47158f4f82df470c5adcec37c6e2c2fa
SSDEEP 24576:OAhGLJIFoiwtA5l7S53nnQ/tbw/2Mkjy6Fr7g0o:OAMyFoiq53Q/lFTjN4
TLSH
T1F835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ecfbc74377a63cde315b1abeca8aa050223cf165b74d6a24d29305f9b599ea37
MD5 99aef3394f8c70c63a213552fc64b1ce
SHA1 311482b8b6f7fb2ca9424abbd434bc5ad15f4a9c
SHA512 4cd0e42deb181d424905e427077bf449ddb102c91c5b800d8ac6669727aacd5b9092602ef9a1e179616abb6ce4bad7efc8685abc346988c15bae4a5fb10ee304
SSDEEP 12288:umw5HEjsChNZBFgl0WDm+CPDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0Hjo1:nwu0OWInQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A375F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 6091b484206dc741175f462edbe397eb3b5c09b72dc55eda3620382e04f588a0
MD5 610e8fbeae0c574cd9ba33578b39a26b
SHA1 b0912f8d34ca2d822a39e21735b53501c5afa884
SHA512 b3753892aa3d973ea1716914532118fa71d45b261d850d33e89634e998bce5b5cb3868425569e03f81ad81b9a6a95d55aa603c867a98aceb343a304c05965192
SSDEEP 12288:W1Z1IyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:0Zu5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BB65126933A470FAE66742B8CCE28646E77338826B7193CF275442695F3B7C01E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a00d7be23d41a15ab0d87e5aa10876cf9fd94d6731dfa78b7d80ffe63f364bc7
MD5 33f72012faa032ab883f64ff61c32676
SHA1 45e1cf4274922b5b3e7114657b6a4eacac2726b8
SHA512 39785fb3fc09f31f33112e897eeb1d1a8c6f6adad6d8859b377d8a775ee4f888890df8d6556fdf5570f8281aeb40dc82013fb9db4ce29e63092efeb6a54ceef7
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:5QRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T1E1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59a3806bd1903654633419b72b689a5814e3e6a578dd63936e11fa94bb0fca02
MD5 d3f4574c01bd10f99eb64285be9b2731
SHA1 7c2e6b2563844b442ef6a40eb5f60ab3d9edb16c
SHA512 0279fc57498c691c09134902f817f68cb7b595c9b7e9ea5cfd3b14344a84c361674cd15fc455cf9540f0f804e3db8bff8409eaf6d52ebd04a46c7bb34a62703e
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:pQRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T125667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7734a03d9a369910b5ded02f34c29b98f1e2bc526b2321ce54365344c42c385a
MD5 73075c7902ec7e36d51d2505c05a4e2b
SHA1 71414e53e4832de93394bc036418c5281d53ad7e
SHA512 bf42e9766900433062a355c5c54f32ec8186dc1955ae77adbb608e0199ad4896c26a3e0426f25b9c978f5d28258f26975c99c0f50d200b68a5a29e1263ec048f
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0JnQ/tbw/2Mkjy6C:168Qg55nhheWu7PNU3/EQ/lFTjN4
TLSH
T1BCB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d9e95229c646ab0cced3f0a85ba6dbe0186947ebbc87dc6ada419b70f7a2619a
MD5 7011667943a19e5d3cc464c41521a98a
SHA1 b36d4c69ed242c48aee5ea82d3e1c28399c0e07c
SHA512 8fad8cfdc1a1cf6d56856120b793584dccd6fb1c556b339441b0227e0e509951297fe11c698ff736818f4749f7a8da717c9fd7acef862e085dfa8cca834ae763
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:0y5112gYy5azzVvL69nLKnhZSLm
TLSH
T165167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c89754608ccd019d332e18be875feef58d9668bd1c74b9bab3ea1337fd76f962
MD5 f3d81677ad2999203318fd9a83a96452
SHA1 a9ce0d3eab5d5aee60b492c87fa4459f2fb2f54e
SHA512 f690e55b3d0f70aa6b62c04b65548213d297c345752cdc278793a37c0abd32cd5d96ddbebadbcbed0ec5309b337a610c5b0a43617640486a575bb3544c6820b2
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqQ/lFTjN4:4u6JmVxd2dlLm
TLSH
T1F7D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 491a8d0c4a8e3d0033185ed7592051a6064f22aff3301e015d7852b7abb77047
MD5 6896b7108f129510f72533bd2cd9af03
SHA1 61b2e3fe86203085cce7a8294dfbc929c3716397
SHA512 2a20afdabc65609d98c0c5e0d54bde2968872b72c3b907534db4cb0aab9bc0d2595b41858fa623e75752f209be2e44b48605bfb22b0db3d0f4fe64392989d862
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xiQ/lFTjN4:6mifPbRsLm
TLSH
T130B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 868dd5808bf3a27967af5ad293ce9fef942451aa3bf84b42b4ff1bf017913658
MD5 cabae6dab0f8d3673ba58d40008a7a77
SHA1 eee08f4cc2eb27f7fe3e8b0da2599a7332df8a2c
SHA512 bb0e28376b0fe9cc7dfde8a7487164a125fe713ff3b7ca44de4b841da48315c085c8188eb4a48001e73f15a0466eea19aaa5145c36901584d88fc267ee4387ea
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHq5Q/lFTjN4:45dKTi61uLm
TLSH
T178C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 177761c77f1b047d24c5715efadcdb434203cb50a43e8c42ffa081e51522cfda
MD5 aabc9f2d71225462996aed2f0d40988c
SHA1 1e84e475d99c8edaaf1ec524678459370c0322cc
SHA512 028c996f95aa96a817afb31e0ea0a568526f466ed99839b4774c9d2086654bdb537be4e7f9ff420d961dd41a54bf87742f81b98d9a3c81d96936fafb629e94e5
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wuQ/lFTjN4:8X2iyphwLm
TLSH
T1E195BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 a1523c410ec73d96a1d89ac8bd2bfe71ef0373e128524f538e481d37afb27492
MD5 662153a97ee208e8d1eefec61f338131
SHA1 02000793db1f70cc2c179343c011b6313a3bf69c
SHA512 d1a9d1f4c1fe8e2c999cdcbaad356e9f9d7c195df54f43a899da6dd3bf5ff08808836468b6fcbef37ebd4e037d74702c60901e59b4c50ae30dbbcf886fa87548
SSDEEP 12288:41GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:4VnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1675523686964F98BFB1706F18C838182A73F0DC6BFD1A38E77482129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 ce055db45a8bfd350ce2fe292ba40f593966cb0ae9d7a1b0e3569c46833eb854
MD5 837d9707c0f035ab22684b28f2d260a2
SHA1 865d1de5fe373ec27b982b1692b54ebd5cc54b34
SHA512 4d50eb1840b9282539f6730471176ab81e3c140b312466b6660ff251e16abe13dc9796f772a6e40750f38a3bc1550b491e49350c0be4dc6bd616b45ac377b0a3
SSDEEP 12288:wAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:wgnQ/tbw/2Mkjy6Fr7g0o
TLSH
T13A5523687965F98BFB1706F188838182A73B0DC6BFD1A38E77482129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 f4c04f8a43e9b89e901978f29aeb9b568259d75331256d457a9fadbcfc7d9f37
MD5 36bd33e38d271859c253045a7a6a595f
SHA1 0e34e4d7c4b837e3d7aadab4be1639c0b66319a0
SHA512 ca7c4f16f749dd7bc8241d80182c3bb834e0e02e3c326127d3f0428c768a4fab25f885955eeb0d24f06758622c27c885f9bc231251ec91fa1833a90f5de02ec3
SSDEEP 12288:96GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:96nQ/tbw/2Mkjy6Fr7g0o
TLSH
T10D5523686565F98BFB1706F188838182AB7B0DC6BFD1A38E77482128D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1e7c36343aa7b42f293936b0e613015e9682a8b03f1077ffd1270c54a1ba0150
MD5 b6cefc4cbcc95531be72e17a8a207588
SHA1 4f0289e0040ba1ba45b71d6b2ea55e55c7b2aa68
SHA512 96a031dd9c6867e5d3cb3c50e46d0bb913ba7388e700fd925bbb38660f3fc6cf50ddc9dbe52966f6ab2f7ee7b545da4765c54de6d172a5e2080a7bc82aa49160
SSDEEP 12288:UVnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:GnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1805523693669A4C7F92742F5CC938142F7BB3DC5BBB1A3CF6B0011194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 d894c3517fad0e75c71c22eca999f397792db637ebdfe5674f394672e23dffa3
MD5 229618378e8f9b0ee008f9e21f93b50a
SHA1 4c03f5a5c39be05615803be150f53c7edb8458d7
SHA512 a17414ff6bb747807707c1cf69381e8bb59242f9ce9a0a7e7c0239c0545329ed09c43bdd8b8f659d786627007718e9bf9434f7e2e8e9b3bf2359391003c85b96
SSDEEP 12288:BPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:BvnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11F5523687565F98BFA1706F18C838182A77B0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 ec8db27877e259000d9dcd881b86c55cb7f43755d1f0aefaafdf62a9cb70ace9
MD5 e00398044889f8ab55907c62e6529637
SHA1 bf3853f5979fc332fe1782849a0e05668723e4cf
SHA512 04c2c4cd49d594ac63c4f3ccaa5e45c3cfeeca8f626609d4a93818493f47d401fa6b413890eb4af4fe2090d912d8a9b2235cf5d833de7eb4f56a77e298263549
SSDEEP 12288:nsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:nsnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B45523687965F98BFB1706F18C838182A73B0DC6BFD1A38E77482129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 5fc3e32f8679a296b758e3f68e6d1007b7f4c9844869b8a43465d1edc0d6c735
MD5 157a5d457670040e4d4ecd7ad2ab2d20
SHA1 7979777225192e9adea469b47f51487b6ca7191b
SHA512 cd9d2787a42df5da24f8a1c8b50137161e64429b1660b7f40097ced95c698f8c4bfff1806dd7ea7270b97456485a00c3e214fed3eb3230f67e207c0c53501e63
SSDEEP 12288:JIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:JInQ/tbw/2Mkjy6Fr7g0o
TLSH
T19D5523786965F98BFB1706F188828181AB3F0DC6BFD1A38E7B481129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 1c3814461b56f20d754c913a9ef325a490c7f75c40840c333b9d921255f2eb87
MD5 ae52f13438e682adac0e9be6b2e47325
SHA1 b753663fc962b3ab15ce179e32b56ed54b529cf3
SHA512 d22f25efd2150090923b7bf66337d475b5c33750a071504eb49ef39d1159cadd9e7bfb8b62a523e0dc8cc58559a1d302f93a01798e86999ddda6a299e320c709
SSDEEP 12288:WiZwb2zzFEoS2cPvygGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ZZM2zFVSOAnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1807501A4B35058F9ED67827ECC528906D6B27C5A1BB0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 082f13c5d44d39dca789d2cf6fe97e0bb851b955531ba38fb488bc8894fc083e
MD5 4b6caf2a5e2bf2b305897dd1faee0c3c
SHA1 0606fc8561ef3b1fc097630bd430d75fd6f177d9
SHA512 5284fcf45da91b9a9820feae5a636815d83bdede99bf6bd713ed9dc25f1982bf01617b35e21c49ed75384d4ca116faa628ebd05be4bb9792a7dd93fb18d7d24e
SSDEEP 12288:OZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:OpnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1EF5523686565F98BFB1706F188838182AB7F0DC6BFD1A38E77482128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 6525d483fc3988845c30d99ed46244abf02a97895366a0324c48285148a5f419
MD5 b9b89d3598924013b78795c802041373
SHA1 f3760a46949c2932e7cc21e38b66666e48b6f2b5
SHA512 e1c9a4241bd6640a55d4e01d7ce076a80d258b21e6dd658fc68ca98b8dfede0b3529e2bc1bf60cc1cffa0f78bd37fc3f7b6c59304f891964e55a7d871b027c03
SSDEEP 12288:/tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/NnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1765523687565F98BFA1706F188838182AB3F0EC6BFD1A38E77481129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6587d9c0a9e62bc4dc3cf38e5702c243fc3b25e9c29f1eae86106bc0c9a464bd
MD5 1892d4d244510cce020b360d6c31a85b
SHA1 37b2fedac2a2e390f1fac1151d6e8ea8c2eb1c0a
SHA512 c8fde66a9ffd133c0d8556aab7aa4af68e969d7b414aa46ef61a0b74ae62fba7768098e0e7b8b1eedd8126a62482c480f12288d3bcb60fb1f0154837a8d2b56e
SSDEEP 12288:FyPz5L8EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:MzyknQ/tbw/2Mkjy6Fr7g0o
TLSH
T13A65021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 709358eead6b065aec193d829319fd6974570730c0f90054df2407e8bbe05b4c
MD5 578ce713f704d4debd1f26f713aec4a0
SHA1 4335adb1d44381bec138731e2b4c4e1180b4b1b3
SHA512 9459e47ff79c377b79ad5b47464c03e0f08d31b3c58ddff7ff00e8c64d43b639b33626a0b0b79280a1087b61d29ce2fe4e7b904c1d46f4f93446176d88e76e7b
SSDEEP 12288:4ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:4pnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DB5523686565F98BFB1706F188838182AB7F0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 b133b16b4543dd7ae5701f609945c04206e16e30eaff6a9af044c0f8846b8a66
MD5 657c184eeaf8049b834d3389000af6b0
SHA1 6997d4171892b91bbeaeff087cba3a110229abc7
SHA512 f66abb8e9ef5368cbb1bfeebdcfa91f33dd14a6c1fa1ae4373c36cd61e2e02c2efd597c770131a1025d883cc1c2bb406d84130814a07d1fe676c9b441240dabc
SSDEEP 12288:2ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:2pnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1305523687565F98BFA1706F188838182AB7F0DC6BFD1A38E77482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 9d49ab1c5435932042bfc809e0c275193e735f5d83e3783f4338e94410f2fcad
MD5 45490601050dfcbf335ea1f7ca310b34
SHA1 166ec7a8ed9b124a2ce1b4766a4ad986522d5482
SHA512 68c2c894f93a0db690f6d268590715244ba6a51982566c766cc6b60b1bc839a1cef1ec02ac42770a2dcc8c4ac7f5d30809e72483a8e667847e70995434322aaa
SSDEEP 12288:byPz5L8EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:WzyknQ/tbw/2Mkjy6Fr7g0o
TLSH
T15C65021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 d442f4dd6fd669cbde481942124b96f4856e8808a8859e55034c1d511a8d8a2f
MD5 dd6d4caad02cdca25b151d4aa0aa1342
SHA1 fef778965b61d6a7f566c574a97e13b40c8ec36a
SHA512 af5930811726bd4790e912de439b2dcbb1298396d30f846a0d6f1fbe87d609c1a413e96ac37b0787d2cf9081288d2e020a0444261771bb3efb4c7c3599cfe33f
SSDEEP 12288:mCd9CWYoaLHF3z0z04PDvhKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:nTDaLl3z0zDKnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CF7502A4B3505CF9ED67427ECC528906D6B27C5A0BB0C75F13A8322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b99cb2f10dca6526cd6a120db162874f3b3b3cf6edbba2b7c1daa19f0bcb2f74
MD5 b16e1b9de5eb19f4c0f41b5347b725ac
SHA1 1f64d83708439548ea5e4d8fc4a2767a0da6e260
SHA512 8f30a3123e439eba63f4cc9a920024d476e496fc8179befb7175c6078863f85e9dc0a5217e0040239dae9ec5ac16e89574103fa42f83b40b2f4086f66a0f82a6
SSDEEP 24576:H3Hd9CHKy7GZGnQ/tbw/2Mkjy6Fr7g0o:XHd9CHKyacQ/lFTjN4
TLSH
T13B85CF90F3E414E9F1B78A758D724502DAB67C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 7730f6bd3665d993d70668bc11076cf835b0a1312797fb8025a703863c973146
MD5 42b9855279522dec46d8f691b7896f09
SHA1 116317d6b66e9444bf277daa0523470113233bb7
SHA512 9ace336b45d7b0fe9d07555b93c886b6f8f1ae13c37d885866866b9c5cd86cbc8947fbd9fa36bfe8bd1e8e5a5cd2158230088c5184c32173f94e1102d1b1dcdb
SSDEEP 12288:gaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ganQ/tbw/2Mkjy6Fr7g0o
TLSH
T1055523687565F98BFB1706F188838182AB7B0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 6b5c3457f0d2c61ff2663cd6e0b1d6dfc4e2f60c790b41c72eaa307b16ee19e7
MD5 112c34899c5a13ec244407709646c6c3
SHA1 5e8b720d3f770e46e569bd6d4d46dfa6c0a6bbc4
SHA512 bf1bd803056e69e4ed22c6172943fd16e2fd7c2aa2dee3da93b21694c014091dfe328bb4bd77ab60ff976ef8d9ae02b143911cbc57e7366b56737d12b86cd9ce
SSDEEP 12288:CkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:CEnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1475523786964F99BFA1B06F148C38182AB7F0DC6BFD1938E77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 08f94fc3bc571c6fc50be5d8dbf2af739dcc488a0591cafa2025918e8cc06f3d
MD5 9287e19120480e81cfd27d17e7de0f31
SHA1 fcb4d399b608b965e7ed2113c75922ecca03a8b3
SHA512 6777e6927a271adde2db3e8eaa5b396125137bc30758a4e0be965c7b727ac13c86cf295fa0ce7df8af1584a931118585b3c55839258d3f8360866910023a6cdc
SSDEEP 12288:f7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:frnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1635523687565F98BFA1706F188838182AB7F0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 c70e2bf39afa9298b1a35d159f709b9cb511ea04c74cf479026aa72c2dadcad7
MD5 7d0236f1566d3159d5c1a2904c685270
SHA1 d02af8cc1ea3d8b34771f7f5b872b3e551f08f39
SHA512 17a144132e4f71badca33df9f420a1dd5890437e2f04e990c2cd99566990c79923e1f27fbc49fa3d76fb8a29e269468010ca9c3b175105463878210baa1044a4
SSDEEP 12288:cZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:cpnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BC5523687565F98BFB1706F588838182AB7F0DC6BFD1A38E77482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 1acc56b2aeeefb725d608234f870cee9d020580d6649011df43525b77c86f421
MD5 dbcd318af40e2ddd05f3794fc4d78742
SHA1 ace7ebf43ce374956cbb4e4358b8c6500346e6ec
SHA512 91004bb5c17d37bcc1447fd47185d31c7ff633aeaea477eecf127bbc41eade60ef26ab27179fd4c7b37d631f2042b4f7353fafed2ea9e10a9ca9416c9cb195c1
SSDEEP 12288:6aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:6anQ/tbw/2Mkjy6Fr7g0o
TLSH
T13C5523687565F98BFB1706F188838182AB7F0DC6BFD1A38E77482128967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 6555da4155cacb8b34258ddbe2bad13b0781e7d5fa1978d73523c45241ecff8e
MD5 7f0d88a31a3839bef6f221074edc1478
SHA1 113faf06c0549d192d8daf63a8210613560d7eeb
SHA512 3c1f72108303f0650e63d51438ec3b0730bfdf2ec10430a42103b1c85e3ffe862269265d8f6db2ae1af838ebbca526c45a49cf68352cb44d0e3aa3026cfdb0d0
SSDEEP 24576:XfwvZk9RX6wkyAI9nQ/tbw/2Mkjy6Fr7g0o:AMnYI9Q/lFTjN4
TLSH
T10185DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6d24dc935235fd68d9ff4d5f4b2bfb8d917b297d6ec6aead83f07d426b2da9c4
MD5 2c766a9a832eeffa47c51abd26fa9cac
SHA1 a4f534651420edec047f96dec4d5daf37f4b118f
SHA512 f213ba3dd4e91bac87026b5c1b3d16a2ca3ffd060997e71418739ddc233697de4b22fc0367b005d9042e86b6e4a4d3b398a703ec49bbbb0cd1d0bddff344ff18
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OQ/lFTjN4:pySzPRLm
TLSH
T1D9066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3bf10502d90bdd72d69227bb49d12fc89de5b10f10bed0c29be979ce125778ae
MD5 c3d833aa4a8b74320a17562104e249e8
SHA1 3a23bc176c23fb952aa8eb8b496773a4107de2b9
SHA512 f02d5ac9588675e7a8df50530834a2658784403db1b572213ce6233219be7539e9af659ed29c49ea4709552643e4d96c95b293b905e43c9ae0cbadda2958fec6
SSDEEP 24576:T47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYwnQ/tbw/2Mkjy6Fr7g0o:T47JUQj1irIhCnDHUPfF/+Q/lFTjN4
TLSH
T1CE65AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6dd2c9a4558e76b6fc14e686b9813b8c34d24b121271135c76402ee34482e4c5
MD5 4b10d3ad0c74f96ab3660a50c3985f57
SHA1 aa4f2d26e94595313a38479e17d470968ca096cc
SHA512 2eea825f96545ea9453a7377300ac4455a7227be15e6dcf30fa93843ab7ad52c4068ab6f2fd4840ab1d58c2feaacc28e55872589063cdb54cf08412db90c9b70
SSDEEP 12288:SRsfpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:v5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T19965F119D29852E9D12E52B5CB828641B3373C9597E1D3CB67C0F13E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 75eb2782bdae93fae72ce83a03644b920f83d45d26f43c5435034a21f605c63a
MD5 a8f9268699875425d7aa9b0457371bde
SHA1 19ce21a81c79114f2321b86b221c91648ea08980
SHA512 94019eedf314498060d2db75cac006ea8f940c1df1b454c1a35ba4871b74ba41820ee5f147047c69f56afb367dd64c494628b05ca876aa0d860a333ffe2a177d
SSDEEP 12288:LX06U3ftCe3HS1bIIfkdSgxN0cc266pWd:LXnUPulk0KNrc26oC
TLSH
T1EC3529417626C74FC66980321E32D5CCA7B07C51EE44AF0773C89B3F9576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 389a4a54a96a66931de9912664ec590fd7deff080956116a865e2fd2e4ca0b85
MD5 8322ba84b3831a63c5c2893546975033
SHA1 6ae72a284108fd6de84bccd87b1a8fa12387d010
SHA512 524451bf5047998485eef24a7d40e131c2d90dd3fe7d0095b9d341993b936599f08c70e5b5767b341efde25a39d51a88576c11f24021cde861b2eac82865274a
SSDEEP 6144:bMJOun+dTnlm3EfkEGd2rGuDSqtMxI9aN1SqtMxF0gpkrO11oAebsRy:An+Fl7ME8ucNzO1zaF
TLSH
T1EA6509415037E28FD1FB6032472A5B4D77A4EC43B7096F26B388453AD86AB15A1FA3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 528f52745453cfa48058311190a9f496aef7ae157ba89dbcb2d87f4031c6395b
MD5 e5a9f3433ff875730fbf4c0976a69d9a
SHA1 45ac7dfee7ea3a8695fffa1f2d64509a2d0fa615
SHA512 b238b6453fe9fc428426bbfb2bf6a25196c49a9da52e6a2c992bde64f5cafd12bafbcb4d7c4c4e56a92d11996c2cd70e9aec9e264b95c68129b4281597fa71b1
SSDEEP 12288:ko7tDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:R9nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1855523656668F94BFA3B06F048928111773F1DC5AF90E3CBBB082269953D3C41EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 897c5edfdcd58558169fb1d625f70e937ca23a107c00b0c1d7b87ac4d7faa6be
MD5 d258c0e827ca2cc63cbca3a8723376bf
SHA1 96a644f25ce88e955b36b8a6578aeb8ee4423fcc
SHA512 0bbc42b9f3a24572149a03d63f7ae05522496cf5b8e0979dc0c698fee8bc84f288bebf40a6ca5c775235436daa7cc7d9f08d75bc138ad4279002eedfa0bf8741
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYjnQ/tbw/2Mkjy6Fr7g0o:qgb4mBIBhGFwQ/lFTjN4
TLSH
T19E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a35335c73a3fe781608c9697a5b5a94de86c625b68e522d9c5ce631e8644b291
MD5 a05b08187146876cd0ec28d5a8520849
SHA1 fd7bda045beace039d4654d9119a9fd9eb625344
SHA512 01c102f08943b1587fc76d2613111981b04173006e5315b66372aea6b16d69ecafb95a575c0351c1b7404a385e007acbe81bced0b0a53ce307f37d2c6e08bba3
SSDEEP 24576:pG88u8FpJqH1Hzria7/mAnQ/tbw/2Mkjy6Fr7g0o:87ZFPqVaa7/LQ/lFTjN4
TLSH
T12A95F06576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9311debd4bdf0c8053a7338773840a0f66620d7260e67fc7bbacd9f3f7ea1f98
MD5 4c3aaed05c42e07d918c1ee4b71af74f
SHA1 0c9075a834b9374644336dbc19659aa59f8e2385
SHA512 f193a2b2ebfed07256e79d02d2d3471ca408030afa1ec7e9a2bae220bb6a8517e86aa08c1fb272f1300a05a1cc988608bde9f7be92e43b5cf769ef43b4914764
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsQ/lFTjN4:5G05lO43bqLm
TLSH
T1B7D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4ac90742eb24c9fd18231035fcc2585710c1484f0a61a897d04bb5b48268312e
MD5 9200ddee7c73974458a54007f1b5d25e
SHA1 d4f6b7b79a644798f0f70a470fea44fdac3c2ea8
SHA512 0f5b2c2471e397c241cd5a989d7f578b52b84363c2931cfa4951e13a939cde17f79c22853985a91e2610c6a8b4e7291e2b708b6e11af8b94eef0abb044692037
SSDEEP 24576:Pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnOnQ/tbw/2Mkjy6Fr7g0o:3a5POZ3+Jt2pasx2+mEQ/lFTjN4
TLSH
T11765AE5EA6F801D5E579D17DC583860AF5B1342253329BCB122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3233841b7443c7fa43c9b3faeed9b8bd265c354146ab0bd22b8539e8931b1943
MD5 301a93f97b13c6efb7f9d2ad6bafa5fd
SHA1 e464063cbf3bb78670fc4657fed180416b6f86eb
SHA512 251ec5297b2d30cb99769f865751dc8859da34d350cbdccfb586c226e4910f80a8f4847c7c1130744b7d5009c7ec22b98f1407b3ec10d3c6dd9eec9bfb4aa85b
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkYnQ/tbw/2Mkjy6Fr7g0o:ANc/zEOVHFrQ/lFTjN4
TLSH
T153858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yandex_browser_service_update.log

Path C:\Windows\SystemTemp\yandex_browser_service_update.log
Size 4KB
SHA256 8b32796200988e4968bbde6f7e730e2209b075e66ba58eb6448430dbd2fffc81
MD5 d1c71bd849373b546534d848344f037a
SHA1 f517a77c4fe7f4454f7636a4c65c92a1908293f6
SHA512 98ce127e2ab82856f244d58d31df5bc310caf77a7d628fc465c367640b0024a16a6c7f597904bd51880fef18c46d8c0ba2974afdd017bc9cb38be77abaecabf9
SSDEEP 96:KUHQUHphrQe5ewHhkdF221XiI6Vehb+0/poeg+0/po3HbUHK3+0/poKHQhb+0/ph:gwvW3SmDW84lJ
TLSH
T18CA1630856ECCE753E1D12DE96A32F72090131C67B4CC5B4A1E991C958E605E3EFE2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yandex_browser_service_update.log

Path C:\Windows\SystemTemp\yandex_browser_service_update.log
Size 3KB
SHA256 e9c3e2c752931fbff4ca0398c726c0331912cef267ea1f3a5e71db36e8ccdad1
MD5 f1dce0aa23c81f74dc55ddd58ef4e9a9
SHA1 1b6160697203d407b0c70783db1581a58bb9cf86
SHA512 136c3630e3aed06f6994d6b9604302967047fabc9005d4868f178f86557c0832509f24478c98c61482752ba28abbf7a61ca29e259e2dd93f822037f2d1fae037
TLSH
T12771544859FCCE353E0D51CE92932F620E0032C66B0C91B4A1EE91C959E605E39FE6C6
MD5 SHA1 SHA512 TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7bb0a2222dead5f8530624df6acbd210fd9649dbbc98dfa4c5ebc3dc343227e3
MD5 38038aaa8a2159a6a450721f8af784cb
SHA1 644ebaf02f413b8c1109e63e77a7d44908998b35
SHA512 e24c981e893e398c80d0292d1033af0d38f4011b5e69c13e45313d91d1876c1d06b5d4eecb066a90bb85e0d0b83bc25b66be714777cc02a9f12a5aea7399ddd7
SSDEEP 24576:/8kNvNnaFeYhJNtmZBmunQ/tbw/2Mkjy6Fr7g0o:/8MwBtOmuQ/lFTjN4
TLSH
T1D755AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1cc50ead64ffc78e267715b12f71f226392d37b3ab3b73746d86aebdc9ec60e6
MD5 ba022cdb6df08ff847c4bbe0e024f567
SHA1 9511417bce66501916f7f972c6d4008d42099436
SHA512 98efae0cd1f1d07d3edef86efcd120bfa925413c7fe14b3383cbef56104cd364081641e84ed5caf0b2137d872933d04992f9e9484a1ac870b77523a4f30d96c7
SSDEEP 12288:lHvUrBFrEjwaQaDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:lPUr+NQcnQ/tbw/2Mkjy6Fr7g0o
TLSH
T12675E12E26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 869177bf29fe6528d489797f0c10aed97dbfb895e6ebc8affeffc8adcda80472
MD5 8baea138c1c1084d7c3dd7bbae03016a
SHA1 fe9a6d9c07b9b4043dc36f096761845805307b9c
SHA512 8a188901a204453c7fc97070d2e4ba0f791faa9f347edd275d842fe55eb1b06f8b5b892fe99b115818d59bc914411a0b42153c159d8e9652ebc9917e36ea9d69
SSDEEP 24576:HD3FHshBIYQgA1nQ/tbw/2Mkjy6Fr7g0o:HDVHeBIAA1Q/lFTjN4
TLSH
T1DF85E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-82-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/248-97-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/248-101-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/248-76-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/248-72-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/688-46-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/688-179-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/688-47-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/688-55-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/976-118-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/976-112-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/976-333-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/976-119-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1540-362-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1540-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1540-380-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1540-149-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1540-142-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1540-143-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4344-218-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4344-68-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4344-62-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4344-59-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4884-31-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4884-122-0x0000000140000000-0x00000001405A7000-memory.dmp

Download

memory/4884-107-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4884-37-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4884-44-0x0000000140000000-0x00000001405A7000-memory.dmp

Download

memory/5016-155-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5016-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5016-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5016-154-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5016-161-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5016-365-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5344-180-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5344-181-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5344-187-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5344-191-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5344-189-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5552-0-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5552-8-0x0000000140000000-0x00000001405A7000-memory.dmp

Download

memory/5552-6-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5552-126-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5552-140-0x0000000140000000-0x00000001405A7000-memory.dmp

Download

memory/5552-110-0x0000000140000000-0x00000001405A7000-memory.dmp

Download

memory/5628-348-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/5628-132-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/5628-137-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/5628-130-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/5644-99-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5644-90-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5644-89-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5644-286-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5832-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5832-203-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5832-197-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5832-196-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6048-174-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6048-168-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6048-166-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/6048-364-0x0000000140000000-0x0000000140200000-memory.dmp

Download