65782c880f9622704e4f20771ad8287046cea6723fa0f876d386fb48c49bafab

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 8.0MB
Sample260807-bavfwsdp41
SHA256 65782c880f9622704e4f20771ad8287046cea6723fa0f876d386fb48c49bafab
MD5 2f049647f7c844c9a84fece81379318d
SHA1 820e6d7d45e0b21d355a5c67d8d52f0d2af78dbc
SHA512 439d63e854c2d86a1da4872e10d2f4146b12ad814953f2161a834da5e519dcba6a97e246d06e2d3c1d8a49276c613c5adb68883bddb958a1fe5cf4f4428107a5
SSDEEP 98304:84a8kHtsiUS64kVlGQgCEKPQ/eUaOVgB/AU0MTLm:Fm7Udnmss9Lc/AUtTL
TLSH
T123867C53F2A611F8C01EC978876E5632A9757C4A1B34A3EF0AE43A211E75ED46B3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4444	elevation_service.exe
1784	elevation_service.exe
4896	maintenanceservice.exe
1008	OSE.EXE
1492	PerceptionSimulationService.exe
2676	perfhost.exe
2844	ReFsDedupSvc.exe
2452	SensorDataService.exe
2436	ssh-agent.exe
2740	AgentService.exe
5276	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e6c8e8283806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\yandex_browser_installer.log	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_installer.log	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021e70cb10726dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000094264b10726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b34b46f40726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8fcbcb00726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5a721f40726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006aca12f40726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2740	AgentService.exe
Token: 33	5276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5276	SearchIndexer.exe
Token: SeDebugPrivilege	1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	4444	elevation_service.exe
Token: SeDebugPrivilege	3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	3360	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4272	1564	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	89
PID 4272 wrote to memory of 3360	4272	2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	91
PID 5276 wrote to memory of 4660	5276	SearchIndexer.exe	102
PID 5276 wrote to memory of 3792	5276	SearchIndexer.exe	103
PID 5276 wrote to memory of 1732	5276	SearchIndexer.exe	104
PID 5276 wrote to memory of 2312	5276	SearchIndexer.exe	105
PID 5276 wrote to memory of 2420	5276	SearchIndexer.exe	109
PID 5276 wrote to memory of 1292	5276	SearchIndexer.exe	110
PID 5276 wrote to memory of 3356	5276	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=579248180
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Admin\AppData\Local\Temp\2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4272 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.1.1039 --initial-client-data=0x2d8,0x2dc,0x2e0,0x2cc,0x2e4,0x1407382a0,0x1407382ac,0x1407382b8
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4896

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2436

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4660
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f2b60e655ec82c9443a5b365a043cffcf936cc32749b33e48b63695db42099b6
MD5 8f1d6175fe9b3de4b7670ef76ba04104
SHA1 4afb84ca99b2564c5fc249c437e4b9f6376a1902
SHA512 5cb5208718ba0eddc4ff404e701ab858a72f60688e6230b4a0c17698ea1d133dc7f6ca7d25cd00da4c16e97f4b381af0c34323857a134b3d8a5e74f2c830216f
SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnzQ/lFTjN4:M3q6HjBjLm
TLSH
T105D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 7d089bb04acfdf80a8dc1a097b416d73dcc19ed929b98ae409a02fa4312cf3df
MD5 40fc6c55e2e70ab4fd1109d0079c21e2
SHA1 51d0ffa8fe4dc0b203099cd4aa10cc0ba52441ce
SHA512 5904645efab7c6a2475a31bb4c53e3bb256672ddd2c8e3cd6a3434f774c98ac688017cc7d1a6fca7c7e5af452262e79cebab78163a892222b48ee13875817a99
SSDEEP 12288:M1XLsswWkxy2lRq2czA0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:6XYfDtczAUnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A175F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 331f9da8d6c1bf50cbd85736c71f326e9d17fc8cca317a78a0769ade1dea3cb9
MD5 be404da04a33a81dabda5822e336f28e
SHA1 37682ee32e2a47ba18f5f7464b5f30f1aa9dc71a
SHA512 1a0b50c443f2ffc5bc09f1d8d0d03a3fddb51997802a621f23485d6445c439435477fab3e2f471fa51b1695495f7da749e9d1dbda9f7c4cef8319191542f27e5
SSDEEP 24576:40Le5ji0hmxmrMrnQ/tbw/2Mkjy6Fr7g0o:4Pji0AoiQ/lFTjN4
TLSH
T1EC959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 60d41bb4dc9b98a8e7f1be55e60d5ff0e80e2a67ab5a05786cffc9c6eb70e074
MD5 d8f5ea36901dc2eb5d1b2498827c163f
SHA1 84a045f1e729b32e34532e13635d48390a4cc63f
SHA512 46424d315c46c5b80492e15c1d003f31c9fc9eee3668e6e831708153a0f93792be37b27fd9375dfcbf35186188a899d4364a71c6abb78d26740cb2b01a45514d
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWE6q8wyutnQ/tbw/2Mkjy6Fr7g0o:X/ezSC6vUzPvxHjyWQ/lFTjN4
TLSH
T1F1755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c04af5f3096989d5066c107b571aef9d400b79a80c72427982ae6003499da14d
MD5 73500073ceff018ed032591163462648
SHA1 d6e3637dff9b5fd8a64139d45c1c497e8b3e0890
SHA512 75b4d7519a770676fa743e4c3b048a05b7ffc5e9634c1a21b59ae206a3619c6a1137722afe167f0a1073593ceaf84f950acbcd39d264973d29b35a3082ef0267
SSDEEP 24576:0VbqPb88hv/l+6AnQ/tbw/2Mkjy6Fr7g0o:0VO88hXl+fQ/lFTjN4
TLSH
T127559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 4f89013e71faf031ecae6922bd575063b3babf3f8763a60315f743d846e03d98
MD5 587e470bf2d7fd81d9e63125f25ecb82
SHA1 5dcaecc947e165cde6841e95cf6a742c389849ca
SHA512 71e19ad0487dca7303251ba4d5aca7733b239e1178f91a36adb73672470f9ce37f875d392ce173aa97fbd862e45ccb7ff26fbc9a3dcad7b9e4a4401706de7506
SSDEEP 12288:Q9HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Q9nnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BA5523696A24F887FF2B06B15CC38542AB7B0DC1AFD4AB4E6B44322DC53C39456DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 183b7bd338de1f393d4a8999e0db92fce9f4140b265825265ea9c03ac1cdbf05
MD5 9da1117bd2149c60e2a8d7cb46d24990
SHA1 ef3da41ea06b5ac4e0c19a7bf8b1e04975b32d77
SHA512 561ecae93a8317bd4965d99ce9dd185edbc5b98ec5ef05e76402872700d95822725cf6fd6970c2f2894d6ced68b4b6cfe2f6d1cbb0e2a07f2a637e1507579cf4
SSDEEP 12288:IeBNUbTVO86U4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:IJIU4nQ/tbw/2Mkjy6Fr7g0o
TLSH
T15375CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1096ea9528b02823d02389eafeb8f00d14afcf3fa9b03d399bb389382106393
MD5 d48f6b50b7c85bb685c20255d41633e9
SHA1 81cc48313aaf8743ce317d958f12895779669835
SHA512 a82c3975663f5110c6ea08a91634fd36b1fb41142aa809d6a68a38172c0abbb9679bd686808406f9ed7081d4b89650ac71c5d94789dc86548a84db95966da984
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:SQvGAdlCEL8c/yRNw5CSLm
TLSH
T119267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 74812879e757822c8c2d23305ffe96da9b034c224461e5df7cc490112b8366a2
MD5 8227e97c9360dd269de5c725bf69872c
SHA1 17c137aa62216450cecce3e03f2c3467a2cf6003
SHA512 8e6aff055039eb84cb8adb2bcecc58c8453f5e818ed2accef6090c68fe4d1e7bf9f8eb8ae6e9d1f8cccd2f5c7304574d66b4cabc38d07dd92c97490f98f8d442
SSDEEP 12288:ZAwSfxL/2Dc3kDLLmt0LDQewsAjSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:K5ewsAjSnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15685E031FE74E436C77F0DB21B22C706683D69604FA11AC3E3A85A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8b8cde7cb0c39e34e630aaada52b88c0e443cb4cc9ebb7669506e967f4bd359b
MD5 27eab8b18e758d82570f5d28dc305a53
SHA1 6881213cc75492e17df18170d55724c79d1a97a7
SHA512 f4a6b6c51ecf367d278236f302ff0112e81f9017eeba8175d880bda86fa0657f3925c860513d2cb6249b88b9e19504aaff4d7214e220a695ceb1a0123bbc91b5
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVL:HUEtQevvqc2W1cpV2EI32
TLSH
T177474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7bed73ab13107f30f3cf7da13f583fe843e59f3c8dac20ec3af7f80fd5f6b27e
MD5 214234eed3a9a3aca14fb522a04deb26
SHA1 34b5b4218dd22e6943bd3d3712a160c3a495af9c
SHA512 464aa1479b0edecaad509d2159e65df503d483c9ec59a987fbedb2ff0885de4d46ce406359cd74a4527ce445def0da13a8cced00beb24d0288d95b9e1787f9f4
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zyQ/lFTjN4:MoqtVjnmGLm
TLSH
T1E3D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1b8f1e1f80e9e57cab161b08d447fcf22aedbdd8f02ff1ca20d3ed8390b4dd0b
MD5 ed9294c9aa41ca8d0701d39c6b38a12a
SHA1 aa35198f9350e9824b5c3a180693bd16bf95cdab
SHA512 e4390853a9582ff4bd91ccc6ff72e83742dbd17adc134cc4bbfa71bc0dcb02cf5e2d60fdaf6f1ced2f28d7b2f08ab90b188dcc6eb6ae2b83f4caaf58c4a8d584
SSDEEP 24576:+AhGLJIFoiwtA5l7S53BnQ/tbw/2Mkjy6Fr7g0o:+AMyFoiq5RQ/lFTjN4
TLSH
T1AF35AD81E7F955D4F5B3AAB899B68171EA76BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5b7a04e7c6546633f0e55bc32b4a6017cfb1e783653ab857558b6d5082c9a87c
MD5 8d40948d4a930e2a8c7625feb5d617ba
SHA1 0b899f72c41678914382220c3ca8cb05f969289e
SHA512 acb208ec3ec1696961de8a5fe5c657779dc44936b304803bef7db1467efdf143c9ed26beb97ff5fbba0ccd5e052f5a42f9cf8f429516710cbed746e4e77c97f2
SSDEEP 12288:9mw5HEjsChNZBFgl0WDm+CtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:4wu0OW2nQ/tbw/2Mkjy6Fr7g0o
TLSH
T14175F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 dcf4d7d163e93a26087bde7dbbd538b4ae532b69b604a513124f4511b468ca53
MD5 4048569a1e332e97455e91ceb9ab214e
SHA1 64d6ae14709424a7c594bb6609e43349bb8af4e5
SHA512 52feddfa7210fe69b80e4d0871ee6460610b87cb0c3eccfb6ba950aef9530110ca8f741a399f79677b82efb58e85d935eaf715bbe3d1cc82c236cec4e44b5af5
SSDEEP 12288:J1Z1IyCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jZujnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11665126933A470FAE6674278CCE28646E77338926BB193CF275442695F3B7C01E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 75ac41ab2c1b0d8b176a8096fe3c4c13132a61e643c807b6097d6175f89c2891
MD5 83c5d86582a39ef1bc9416b4ae843ee8
SHA1 db405df1275f4dc69357199d78e4efe6eacd0e49
SHA512 dc89d8218aa7aa8a6d5dd3553b4cdfcfa7150b428db1518ceeaf81ff92e53185fbeeb4bee46c6cd2e870ae08b2463d1689ed7120926472b41de5b1c8b94d1b9b
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:8QRQyi36YOcPQLvw2gAf+PN3PLm
TLSH
T1E3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 24b2ae24b331a011ca975e0a8d161636c7f695d2085adb55fa0d4c75691d6687
MD5 9bb94d727f7b6cf388fa022a2b889d15
SHA1 0d46f71db40d892914a6d5fc643f33b3c303c01d
SHA512 dcd0fd02aa67622fd2f7c42381c32e6bc32d4c7e140966b898d6e8b7a73e79efa701a0cdc10cf9e833a7aeffde54eda7275d6acbc5cf6670422c29155c942fb2
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:gQRQyi36YOcPQLvw2gAf+PN3PLm
TLSH
T120667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1107291fa37ded48a999b32b5fc937ae5c9d9409c62cc759eac279c6b3380866
MD5 e0e598a4dc3acea9903347a8d2667fb3
SHA1 77790b89c4324309ee1567efa6dcda52bac913bb
SHA512 e9898b74709e93c9923859b11023c42dba1fc0ad9acdff72103e8c8ee807438e67fe13c9b5d3419a6c08b2230f45a0ddb836a2f16aed028a2901dcfa04ad9a40
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0znQ/tbw/2Mkjy6C:Y68Qg55nhheWu7PNU3/iQ/lFTjN4
TLSH
T1D7B55A33B2F60099C44DE1769F46872196E27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6d3633b06bd81c8921ffe10a0a080d731c82997099d9db2b679f2c322d28b397
MD5 4bf93c768c65a733f1ca41d8088d89d4
SHA1 a32f73ac2db7ac3824d685c234b3e4258fdc2c7e
SHA512 401ad9a3c99876f18227191f6b7f8f7da8ad34b4e79c6e981f3f5ca95cac7e8812180ca1f0ca7de8c98d91b6459b773dc4b6bb7fe6d60b09e1b23c00c1eead52
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Wy5112gYy5azzVvL69nLKnhZMLm
TLSH
T18A167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8e1adea6f426dff4f1e1cfe559056b12031a95bab59ef1bb9bce1a8d6b13b0de
MD5 0b309e510343d915c7660148ff2e94e9
SHA1 1c0465f66dcc7c5ac8ef89a572f8a28cda7026ef
SHA512 ea87d24ad94bf40fe98bb7d04602ad7225cb6368d72dfb3e2befc5f592535e55262b8e2dc77bd8e11f84c2af397fbb04eca43425184dfb74d0bafd571b9cb394
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glkQ/lFTjN4:wu6JmVxd2dXLm
TLSH
T19CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6817d2f67a1e133fea216c9865637a5322a2e4cd4ba4d58915305b6292aeb17d
MD5 4d6018d06940f845787f52c25cbaef49
SHA1 d6f1e937c6ba70210070b5d90698174989372153
SHA512 532a0c8b48e01834d5e8a5c8bba14f00534578527e30ad073c118dbb4ad1503a39ad618ca00d0bfd53ef46caec650527e00d9f3b983dc4bf6d6db0abd5090aed
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xYQ/lFTjN4:AmifPbRGLm
TLSH
T1B9B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1fb87f265429c710e419e198a947ee72a9e30a611134b1487d0c4dada1610f4b
MD5 f31af9954afb8267032a0835f27c06e7
SHA1 7af465818c18c65ae2bd67c55b526298bd1cee8b
SHA512 9c67cee11c22b40b55b581da4d72e05bcf3373601c0d3ea01d27743d1e087397eca8ecadc8f967182ed2581dd0b95a60510046cbdeaa6493db6f8d2efbe2961f
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqjQ/lFTjN4:n5dKTi61ILm
TLSH
T1BDC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1ef95ea9472ad43f976d92d9cf64f7eb8f49cfba7793df85885a135401beef96
MD5 791504b7b1ae550ba4c504ef775cb3b0
SHA1 62c6e732532999ab3bcc41e5107f1f75124098bc
SHA512 c076a0c352514daa27da19d6b13ef3074a313f157e4633cfb958e2ba1c7b5a89361aa16a0d67b30efb6da8f4a6bfb6eba305c9c86f1bac1491298960d8e03f0f
SSDEEP 49152:khtSn8EApI0figngiDn0AP5wUQ/lFTjN4:lX2iyphKLm
TLSH
T1EC95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 a791e8f9461fac87e5389e51c006653c2b9aff98cd1763767ee8b639389753d5
MD5 8e62469bc6da3198c45579a25052834c
SHA1 710fe511e0bb1ae7c7464bcf5e075077654f21ec
SHA512 388d29e677ec1f2967ed54fca3d27b7c6b744bd1f299685885340fecd3f78ff0e745e712a292d1a3e310df5a03f14d37626c2cef4dcce47bc9ca183efe17e7dc
SSDEEP 12288:m/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:mfnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D25523686965F98BFA1706F18C838182A73F0DC6BFD1A38E77482129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 91cb211f3b2a5ff1bc08d417ee569fb0e310e79c5de3266522c92958be7d850f
MD5 34821d1bfd8069e42807e1de8d5a56e9
SHA1 3c7d16955ab8059abf5a8460f7e28919fdc9bc60
SHA512 3add2484752a45f6d6feee4cb761134a0d1035c3651a04efbe9bcf36e9c10116a6c40f8d9365d76fb7edf57664385e49421d8a6eea0943671a038fa823d5682a
SSDEEP 12288:M+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:M+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T17F5523687565F98BFA1706F18C838182A73B0DC6BFD1A38E7B482129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 79635ebb532789b7d9d957dd3ef5d60201d409704be737f09a564ed0770d3072
MD5 495d5961d6424fb40555626a38108243
SHA1 4f43535f5685f804cca361ef5ca9e427fa293c5f
SHA512 47bedfb92c9a9543a6b325cc1ea1f9a4b59e384212fbb65580d3af3f0daf946f23d4a16a629f3b21477dc05058ce901c2791cac794483a29d3b114e4cf96cbea
SSDEEP 12288:vwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:vQnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1395523687565F98BFA1706F188838182A77B0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 61a6ae350330fd308880757de35818ff1470951fecfcfc7aee7c0f63c8ef8390
MD5 7e1d7192eba90c7a260a40dd58dfeb8d
SHA1 6353e3f56e4a032260cbdc31c1d3aba34d0d8582
SHA512 0bd50676fc0283e9432fc67d3bbfdb6eb85646a0e1da06367090f9cd5c2b8827976862f0a1f3327d4f2bbcb18e72fe394848e9f9dff232faef308bce384627bd
SSDEEP 12288:iVRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:GnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C85523693669B4C7F92782B4CC938142F77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 8c7581c0fc71399201335f9c7285428b5d75c9c7f06a4c2ed8a499ea038a1119
MD5 d643d639599d0525f52e651e85d902ad
SHA1 7ed3a4fbd0438f03795ff7399da678c693c8ba3f
SHA512 ab72d79a34baa1024cb1487ec12e92eace1fc37bd162bca05e1b450377197bbadc8db55df1d8b563ac1b437aa2f6e7482e6914d8ee9e890368a2d909b3ee83ae
SSDEEP 12288:uZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:upnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FB5523687565F98BFA1706F18C838182A77B0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 04e485173d9baec446f8055151fe2878237b0f5dd8b5f352a50e94f26617132d
MD5 3d7370b2b5906a5c2bf108c8e4714336
SHA1 66b78aa310a7ef431fd6ef739d21153222a46366
SHA512 5be0051798732e29a5b2ab172d4ac380773bc2a1825835e8ecc882c48d9b696a622955a584b6a517ac19ebadb11e3015f9ce0da2003f425649598c06ca4e1663
SSDEEP 12288:wKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:wKnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B35523687965F98BFA1706F18C828182A73B0DC6BFD1A38E77482129D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 d62f705adb8e533b52735c094c7ef8f07bd02bc3268684a0459d42b6366c5d7a
MD5 3d6578b1f0672736dafe3055be7654f0
SHA1 c6e935194e98040fcd00f8a963d487837589c3dc
SHA512 9a14426342b0112e7b8240bd07673c69fa42e5c05851adc63e5c9042a37f1f0f93e7888ba507f798d711928aacdb55ce8f1c86b9c961ca2658f07d022206a672
SSDEEP 12288:jmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jGnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16A5523687965F98BFA1706F18C828182A73B0DC6BFD1A38E7B481129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 5652f01c2d0bce8be1b4bb7925ab821c82ccac62348f78036cc148272c91d113
MD5 dcf3c7c973a943e77616cccca0e2775c
SHA1 9c491d54da5d6f1e71c0553632c1869324b114e6
SHA512 7acf21597590cdc2f4b566f4bf45f9d0c50a00bda2352afcc329aa0d59f422a4cd39c3292e32fbbd1c7778d3ed2f114498aeb8866934d5240a1c3a787745ce44
SSDEEP 12288:xiZwb2zzFEoS2cPvyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:0ZM2zFVSOenQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F87501A4B35058F9ED67427ECC528906D6B27C5A1BB0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 1349e53d9b53443b5f52456a40223a2d4103389aa84c600d21d71b8c3bdc21c9
MD5 512ff3800fd43f8eba11e671e1d5be20
SHA1 a14bb78621bf7a2c7e5cc5142bab870c66b75b82
SHA512 c8cbcff800130e116ef91770b3fcc40a210ec9721a34b66f415ccff8269da416d28bcf8e4bf25b40a9a99cb32752b6fe4b368613d1c2b73e7a8bf6dae59cbc1c
SSDEEP 12288:/jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/TnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16A5523687565F88BFA1706F188838182AB7F0DC6BFD1A38E7B481129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 70eca2dc60f5edc62ac034b9cd44ba6ef25bfafdb58719f7acc1042f43112c69
MD5 017e11b34093111d139acb679dd39aac
SHA1 747c81f1b392f8bef919fda651d5ac641b664032
SHA512 dd1b5396bdcc4109b3c9516437fc9aedeb32c8f08c4c93165f5726e76c58abb51356a90882dbdcb98d4517b0d2461056fd1a2fe1ef41039377c819111b812b0c
SSDEEP 12288:I3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:IXnQ/tbw/2Mkjy6Fr7g0o
TLSH
T14A5523697554F98BFA1706F14C828182AB3E0EC6BFD1A38E7B481129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 297dcd540fe4c5260182d1a00554bfe5a20b1d5c68e9c38426b08d923a636f06
MD5 d619402bdd1ad73be0bea298bc4ece39
SHA1 3cb87f04cd5ed3e27dd91c6234563836ba3decb5
SHA512 eeb4b9293d38640710615ef76028ffabf5e0350e50f7ba48b8d6dccd97dfb5c2508b13845df7c9fa8b78a94384a2fba50a2d66e0930d30f3b1907d85102979a2
SSDEEP 12288:uyPz5L8CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:zzyCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DC65021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 33fe35d83172a7579a2f89a5dfd6e83cc3f284c5103f9d52400c4a2fc3a73119
MD5 e6fb0ed45bff50b434673c2b5e45193a
SHA1 0327c6a915d3dea33a91159cd59aaa4f6a630ab6
SHA512 0d1dd1d584b957bedfc8d13b8c68a721db5cc043238ee63d933054fc25599a3428fef38656b6d33ef305e0d35c88482cb40022ce809056dd291a0d4eddd493fd
SSDEEP 12288:FjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:FTnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C65523687565F88BFA1706F188838182A77E0DC6BFD1A38E7B481128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 d244b22c13295fcba81a4b79e27187d2a723e7a574fac4ba0972aa1a1f5b70a9
MD5 bc2b6c6162179b800c8f887dd1a0c2cc
SHA1 c0b2198d22fe410312a3c1839831395d207edd52
SHA512 8ed2614bed21e8c161fd64f7d9d92475284c0e3b683e61dfcc2b381b139a27c3bc65aae99e2daf7ba2edd78b1b61a19fb382f871794f133abfd797c0043d2f8f
SSDEEP 12288:7jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7TnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1155523687565F98BFA1706F188838182AB7E0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 ba4c8b7e3ca4d943cb1d19d11671f9cd2ec6a4bd8eef10a4cb1ccb27ad6c588d
MD5 a72ad46d3da749aec273ed203991773d
SHA1 89b02ef9ba84b3f425ab16e14dfb1108801daada
SHA512 548fd710b1a9c02f30184cd3bc63626955f3df999424433aa40395bdc377c67c03934646d616ee60aa058c92e229b3e0a9935b7ba30410bee48392420bcb4c42
SSDEEP 12288:CyPz5L8CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:fzyCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16F65021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 93dbb91eb1749c2a141d2d4acdcd16cda382ddf7422d2c27eac550b2646015b1
MD5 8d458e203cadbc22c243331fe066339c
SHA1 a234785fa7c07517bf080e9503fe7024e24ad532
SHA512 f92c71589f35348d2c54d787ee01972f4ad986954b96066e1347788f757edfa19e80ac916a9ee9878a24364224ed9b9e3b70e005ad2bb46aa29cae26e87de4b7
SSDEEP 12288:uCd9CWYoaLHF3z0z04PDvhAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/TDaLl3z0zDgnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1297502A4B35058F9ED67427ECC528906D7B27C5A0BB0C75F13A8322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 5a3edecfecdd6de0509589361711cc26bf574c716a733532b689ca401e76f047
MD5 4c7b1b34c2e72e1928659e3f9a72fd86
SHA1 5914a500e25e9c2f1a17ca75cdfaf5b89db24e1f
SHA512 3196f0ba93b4bc930a08f9c660fafa104de044354cf9665092c90a37333dd8f3edf567ebc1306fb388d019b992f61087b695db99a88f987a8a0c5129bfe73031
SSDEEP 24576:J3Hd9CHKy7GZMnQ/tbw/2Mkjy6Fr7g0o:ZHd9CHKya6Q/lFTjN4
TLSH
T13985CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 dc756307ada7815827fd732392237c121db9a6ae0a23a9b05ab0d5c5038665d0
MD5 2f303d4b27a7eb917abef00239d420db
SHA1 f0e291c8ef58f42dd7297ee6b0ddd3989d02be75
SHA512 ac20ee00f72987d84e74c3026d7b8301ba623d472087a9ad6bea3e2e9f10af3632a3d13d87b273a66e5aad6a08a3351df76cbf75e544b40d88b2293561e91717
SSDEEP 12288:JQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:JwnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1385523687565F98BFA1706F18C838182A77B0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 3602c3f5dc272e8c0da393aa3f3ac1f0cdc2758958bb8e0f54e0141280d69175
MD5 8a67c4126541ea09f0cdb5464d42190f
SHA1 814dc6a8c0f77d049312987cefc94e2219784c92
SHA512 abf9c2f7a88914d17a8406b5dc79e524b6a7df6a5102fbdd14defc329a2636fb8be88d748d3c8440ad60ae014220df09c45196a2a1dc2c0f86f2c7b7b2ed63c7
SSDEEP 12288:hiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:hinQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D35523787964F89BFA2B06F14C838142A77B0DC6BFD1A38E7B481129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 f7c0d0c1b59ce33e0b05c73185a87f7424ae0392e795166033e3074891b62111
MD5 920bc9ea04376c25f6371ca7bdf4653f
SHA1 c5ab05e5680d8b4a014b0f74164cec846830622c
SHA512 9428ee2dcb0b5430f3472bf8cf423dc7968fcc0db20658198e8733be57c4f413d1ecb6faf9c2af5e81680fbf27dcd61a6efdb0a267262e8595a3998c883d064f
SSDEEP 12288:X1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:XVnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1805523687565F98BFA1706F188838182AB7B0DC6BFD1A38E7B481128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 73903f1acfdafd05f7b65b8dcad2a01459a66cfe1f87b7344e082c1e0c7253dc
MD5 e9b37c7c2749d3822583e76ec075a73d
SHA1 ceaa64a41b8a57e9cfef15f810fa7db1e7021553
SHA512 0178a938198beeffb63b0c682030dc647573f1c071191bce8a94d25dda6f4d3c7f05c8a9773715c7f3a5ce7f5e0fb66e75f9cd65e0fcaec6a3c868214f59dc40
SSDEEP 12288:MjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:MTnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F55523687565F98BFA1706F188838182AB7F0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 56ef422ce5ba3f62d9727f0d957153f5fbfba07eb019f5cbac7beff5df8b9ce5
MD5 07dc470750d3041d0198df49e97fe356
SHA1 1c83e2b3524383be88ab1df93ab1e61f49bc7ec1
SHA512 6d278b13902b938e32bf293329e6b4de3cc3d64d0f1ee35d399c93eb5c2428b91cb9115903753c16873e5353771e2a54e1048518bfdd22bc824e01da866ad2ca
SSDEEP 12288:+QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+wnQ/tbw/2Mkjy6Fr7g0o
TLSH
T13E5523687565F98BFA1706F18C838182A77B0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 1c60018fe94288b621e0d0a33cf612ffad0c2d013fe48bbaaf37f7d91e12995a
MD5 c989ee11f8ab5e591df7e1d098186628
SHA1 2896fc1ef74bb481d7197bb479c5a36849c384b8
SHA512 413a3ce9fb50073b095f27afb0bd3a016544f2be5b74b748cd2ddc838e47a10cd25fbbc5b2663c1e5e7da4bdaa8e72b94b33a3b5d86450ee5bdbca473ed8ec2a
SSDEEP 12288:QLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Q7nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FD5523687965F98BFA1706F18C838142AB7E0DC6BFD1A38E7B481229D67D39405CF784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 e4512caedb1721d11ce4552fd65ef0bcf52059437d6f8728db9ea5aa0379e518
MD5 59810f29f84a10ffb358c48d9f26dd37
SHA1 cccadaee0a5babc2b928db63b2219cc74dabd832
SHA512 2f1c66deba2d6692bcc962854c036cb454032edff937a4ccba0d51ce33612e7d8045b50b718120c61206a933969f43111f37be76b88ffbdcdd842172b2fc05fa
SSDEEP 24576:IfwvZk9RX6wkyAIHnQ/tbw/2Mkjy6Fr7g0o:BMnYIHQ/lFTjN4
TLSH
T1CB85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 50202cbeeb389d192a844af83208af7c5d303e6d8be83703993be6d203592ee8
MD5 0a32ffa700b9a2ca889dbb518efdc530
SHA1 18f08a0f671165bdb3e5eef538e5cb553a0129fa
SHA512 bce4898d61c7b776081923f9562ee9b00e9d29a883280867568955855b148f87a755ec4d89162f2cba6b14fcf94f707cc40f8fd883b8656d1a5d9b7aec5fc573
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Q/lFTjN4:/ySzPvLm
TLSH
T142066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 18d11b76d29cdb2d52b6621c2ed7125ffcba37f79bc020732332db94c8873ab6
MD5 f9901786f7dea4f8e7acba39d8cc7136
SHA1 a4c9e334e0faca7381fd7464db9892bee6ae342f
SHA512 7de5ad52e814ad84a88e5f77e7e475df737a7c20adb5ca3f16f7a371d531b580f21fe11219520fbf0a49f77e4665269eebc4a9f5b96e31e0f8bdad17aabb969d
SSDEEP 24576:Q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOnQ/tbw/2Mkjy6Fr7g0o:Q47JUQj1irIhCnDHUPfF/kQ/lFTjN4
TLSH
T19265AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a1ef971334457d1aaae773965f7011490ce5c59dab993e52712b96f08529e037
MD5 2763afb8d9aa5a6853388e6ede72cfc8
SHA1 ecfcd73a7f547ea37745e5752048e5a08867e632
SHA512 24c275ee5e4385a439a342d910265c904ddfa66f31a64b032fb093df29cf4be8a5e19529999017e589dfd107a5e85be122a85e404a285107a35183eda59216c3
SSDEEP 12288:QRsfzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:9jnQ/tbw/2Mkjy6Fr7g0o
TLSH
T12F65F119E29852D9D12E52B5CB828641B3373C9597E1D3CB67C0F13E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 aa53a0e9790fcb32580e3dcfbf75885ba2e0b45bd04a485cbc2f3a1f85ebe85d
MD5 a5cfe3dce28633d8ea98afce03dc6494
SHA1 efad9232fd0d70cd8abeafe3d02b214a68b6ed68
SHA512 9f663d3121041cc173ee5fde4aa8ea6aed00f90d7853f80e3dc70493db2793dc4a8a88e767cb73c84097893acb3daba47e58b7a863542fad42d153928cd10587
SSDEEP 12288:+dqeU3fDaKQJdrrNbzyEa9E8yXHOiBaqHFH:+d5UP+jVNBgPQHncoH
TLSH
T17A253910766AD75FC6AD40325E77C2CCA7707D41EE05AB0372C8972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 fd4f822f9fff0dfff229a75be29b432f4e2959b30d3ce9c60fb0a9c68e63f49e
MD5 b4c6d0b4aa25bc98882ff33045e150a8
SHA1 d38acb14157c79ea5cfbb95f6e563d23f595cbe9
SHA512 113ec79a1c0ca7306a77532ec428b63bf4c33b0689b69d3ca44047cc9c713bce619c83c47fd12f242718b3416672dae9423bc057cfa70bf506bc428c36adbb28
SSDEEP 6144:GwIPvJ2wzOcSpO35ri8J2rghLx0DWk2GWXVujrJ4r0cbVtMxCVis3doRYnVKLu1P:ICwX6whjJb
TLSH
T15355C7815437A3CFD1FB6131072A9B4CAB64EC42B3095F2673C8553AD82BB65A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e6c8e8283806d8d.bin

Path C:\Users\Admin\AppData\Roaming\6e6c8e8283806d8d.bin
Size 12KB
SHA256 02212bafc9a01181315696de1851fef01ca03225a1d7a5e8f53fe9b569897981
MD5 e014b842fac4deba166c028418e352dc
SHA1 2c20f34f4dee395cb0bd9362da5a6230f30b0338
SHA512 937988f62d7e9fa6530f244d2c13e28f6e4102bd719a37cff7ea71e88f36337ba4db4ea295d62cc20bce66649186b376de867ea86fae3a2594b87e46fc43507b
SSDEEP 384:t3fL2II7Eq/9J1j6PYfp+VojGWJWq5vbNw2jT988k1B:dCv7tFJ1aoYyNkKvby2X98JB
TLSH
T1B842CFA1FD7055544F33CF5116B7BA31E31CA4D402AC14A4B80B529CFEB62A3C8AD8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 da739d6a31e478a444fa4529936dd92c232294a04ddecfd4fa82e7a167af9d72
MD5 dbb74c12be23cded8f4ff06956ce00e4
SHA1 b8e8324e1ed6af03db1edf073982aefe515fda94
SHA512 2909e2f311329ef62b54541a2c060bda226f6ca1b751b4b5afecc5d601415ab256145c50cda89663295154cbbc7ee79ef8bf9bdb0bc633097fcff8a6391ff74e
SSDEEP 12288:Ko7bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jLnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1365523696668F94BFA3B06F058828111773F1DC5AF90D3CFBB082269953D3C41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fd96d3eb57344bd77a3fa2f41953e4f7be9d15c188c41c901c15743fbf9499fa
MD5 2fc0531923b0c3722fc757ada256f57b
SHA1 7f921a3dbcab9540c67962b10a130744789022be
SHA512 d174b016c3bc94e1803081771a8cf0574a350c7a9409bba0cacfc47c4f7a47ccddc6de57de7190daa94dd9dfb7f8a0276a784d4dbb753ab9d391551419c83d13
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYtnQ/tbw/2Mkjy6Fr7g0o:Wgb4mBIBhGFOQ/lFTjN4
TLSH
T17965AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 817a1da4eac3ecbdaf92208280c63fb08b2ed66660c47eb5ba11a3c43bcc9fa3
MD5 292da4bda7a59ce84b579372db9eac65
SHA1 d987d528c508fc9d3ed67e2a850099c07b8c2483
SHA512 22f5b5952b40c11f3a104f56b5c40cc264f9f9290c879f05a6cf2fa73bb8dc526cfc9b4ebe505ac9b3c03710caa1a3c27dbe1a949c18e386bb3964007f167cd1
SSDEEP 24576:cG88u8FpJqH1Hzria7/menQ/tbw/2Mkjy6Fr7g0o:f7ZFPqVaa7/1Q/lFTjN4
TLSH
T18B95F06576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7c398842e1c67d534cc3757b6e63cca82cf4911b2e68edcf5e6a04f3f543e750
MD5 dc5edb1cb27ba38044c49a46a0881b5f
SHA1 60ea9d517fb906cb7a61811306469f32bd39533d
SHA512 da8b7846701660a76b7718dccfed2a8d1d32c9d1464690d12122a57b1def91cc627ec7002cbf74e2617c50ad7f4fe6373b717724a8865692a4375957ef5509bd
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKQ/lFTjN4:nG05lO43bELm
TLSH
T132D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e930d89c0f02640ba595ab35ab52c57d29706b539ae73b682f3ad556b9d97f40
MD5 d3582a18d5227c27aa8e26f5db56bd8e
SHA1 f38f497655a968118bb5c713c5c8772bf6b53bc5
SHA512 eb1b2676499b2ed5aebcedd54de04f63347f32520d0ab246db345d55bf3301a1632eae329d1bd345211af752b5e83d425e04cd15f8790055dd3fc5650e0a1dba
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0nQ/tbw/2Mkjy6Fr7g0o:ya5POZ3+Jt2pasx2+miQ/lFTjN4
TLSH
T12265AE5EA6F801D5E579D17DC583860AF5B1342253329BCB122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ed24dfe59c63b52e82c40fc61e801e77f967733fc268f5df0be6cc032d8e7c0c
MD5 5ae1e00027e9d4693d76587b5352f23d
SHA1 8642ace65a685d2689944be47a9049c29c31fb5a
SHA512 86799d3bb4912527e940de69d7518f2e967083242458722313eb16b7e9afa8207e53d7280bafcd3a39086ce672eb83388d2f28f4d296ae46e03c0010080dba99
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkWnQ/tbw/2Mkjy6Fr7g0o:GNc/zEOVHFVQ/lFTjN4
TLSH
T104858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yandex_browser_installer.log

Path C:\Windows\SystemTemp\yandex_browser_installer.log
Size 2KB
SHA256 5e28806330596b64ef3d7704fb168b9584a78d081c44af918a4cf1129837e7a4
MD5 a06b0cc38def376077b76c07e2f2b843
SHA1 c958f551947314d678e2fc750ff1c6e10311eb5e
SHA512 bdb364cd86eb06bc24c319e0bc6089a39252ad1ead8ab86acfe406d51363c402c756381080e646745e1eccbbaffb322044081a21cff1b1520c0611a56f3cfeea
TLSH
T169412221CF930AF9908D421F702B9F966CE111BAA7E150B023AC06AAF5214542C7B1DF
MD5 SHA1 SHA512 TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d93ade40e8636c85e6c5859fa7f8339a3bd71c2017d41a3923edeb7dcd61af81
MD5 641a1b5bd3cc26c190510f2890f05d1d
SHA1 5e8af905a47387ff4b628538d9ebb513724efc2e
SHA512 14c93eda6600bb548c6a321886754844940260190d2fcb7b0f784c7501c3e8f62e035ed346ef47043590ddb6f9b6e990858885908421cc558b3b28ada8268844
SSDEEP 24576:V8kNvNnaFeYhJNtmZBmonQ/tbw/2Mkjy6Fr7g0o:V8MwBtOmoQ/lFTjN4
TLSH
T14455AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 41199c2eb7d71a3bf685d44093d093ed76194a48a78917b40035a9f27ec8d23f
MD5 5ec5c6828e357a27ea2bb9b80bc1e78a
SHA1 ce38bd26216f064f7a7491790fb2d27053ff31f4
SHA512 abdc5327a588c35e365c6f8583563df72517ee42d125fc58480f180c77e165ae8f12b5f52c9b2cb7c4ec4cb1293725b32dd0df1f6acc5669467e3938b811e664
SSDEEP 12288:THvUrBFrEjwaQ6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:TPUr+NQ6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B975E12E26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 64acc15f071775ee0bef92019db410a435538a47000b2c9361f2d816523456fc
MD5 a94ba819f2efd4f58a3719818218d0d7
SHA1 7260f854967b032a5e80dd5929cb10096f539777
SHA512 19bd24f711ea36658dfc0d85f4d8b030883325cb9849fcc3774613c15c8442da221ece1d68090d79418842faf57688da7536496cdfb58443f5c71feadb886e2c
SSDEEP 24576:+D3FHshBIYQgA/nQ/tbw/2Mkjy6Fr7g0o:+DVHeBIAA/Q/lFTjN4
TLSH
T16B85E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-78-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1008-72-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1008-135-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1492-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1492-136-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1492-89-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1564-379-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/1564-7-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/1564-6-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/1564-359-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/1564-8-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/1564-269-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/1564-1-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/1784-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1784-54-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1784-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2312-345-0x0000024CFE3A0000-0x0000024CFEA20000-memory.dmp

Download

memory/2312-430-0x0000024CFE3A0000-0x0000024CFEA20000-memory.dmp

Download

memory/2436-131-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2436-140-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2436-328-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2452-330-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2452-113-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2452-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2452-119-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2452-139-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2676-93-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/2676-98-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/2676-137-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2740-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2740-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2740-155-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2740-150-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2844-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2844-138-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2844-108-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2844-102-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2844-414-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2844-412-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3360-35-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/3360-41-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/3360-134-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/4272-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4272-14-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/4272-28-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4272-355-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4272-357-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/4272-297-0x0000000140000000-0x0000000140846000-memory.dmp

Download

memory/4444-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4444-31-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4444-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4444-317-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4896-64-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4896-68-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4896-70-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4896-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5276-166-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5276-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5276-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5276-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download